Edit tour

Windows Analysis Report
2N Driver for External USB Readers.exe

Overview

General Information

Sample name:	2N Driver for External USB Readers.exe
Analysis ID:	1432058
MD5:	e3dd4a7013de228f707e6acacd69acce
SHA1:	3bfc3ebc9be3747e4dc88cb822c26e20715e1110
SHA256:	aa4d8231efa01b1e141dbd392c8bff871c7692b04e0de8e14bcca2c71ee5d146
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	49
Range:	0 - 100

Signatures

Submitted sample is a known malware sample

Drops executables to the windows directory (C:\Windows) and starts them

Installs new ROOT certificates

Modifies the hosts file

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the driver directory

Creates files inside the system directory

Creates processes with suspicious names

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

2N Driver for External USB Readers.exe (PID: 356 cmdline: "C:\Users\user\Desktop\2N Driver for External USB Readers.exe" MD5: E3DD4A7013DE228F707E6ACACD69ACCE)

2N Driver for External USB Readers.tmp (PID: 6320 cmdline: "C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp" /SL5="$103E4,35010763,947200,C:\Users\user\Desktop\2N Driver for External USB Readers.exe" MD5: 0EBFBF63EE915B391F691DB46B024A09)

netcorecheck.exe (PID: 6804 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 6.0.4 MD5: 92E65CD72CF9F57DEEAC5C0C4186A5BD)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnet60desktop.exe (PID: 5024 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" /lcid 2057 /passive /norestart MD5: 80CD452760F89BFE92B859FB620F1653)

dotnet60desktop.exe (PID: 6884 cmdline: "C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart MD5: 9B29FA18CED2536A6AF5978740439137)

windowsdesktop-runtime-6.0.4-win-x86.exe (PID: 2988 cmdline: "C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{4C86AD50-ECFF-4E0C-8859-69C2F732A1B6} {4190C1E9-DF0B-4777-B67E-25C22799E37B} 6884 MD5: 9B29FA18CED2536A6AF5978740439137)

netsh.exe (PID: 5036 cmdline: "C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe" "2N USB Driver" DISABLE ALL MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HostsHelper.exe (PID: 4020 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe" C:\Windows\System32\drivers\etc\hosts MD5: 034CD0A95425744B3D1676EA2E62D6B5)

conhost.exe (PID: 3780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CertMgr.Exe (PID: 3248 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine ROOT MD5: 181C8F19F974AD8A84B8673D487BBF0D)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CertMgr.Exe (PID: 6368 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine TrustedPublisher MD5: 181C8F19F974AD8A84B8673D487BBF0D)

conhost.exe (PID: 3472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dpinst.exe (PID: 5292 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe" /SA /SE /SW /F /C /PATH C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4 MD5: 4192A5B905374E423EC1E545599AA86E)

setup.exe (PID: 6360 cmdline: "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP- MD5: 2F8443D48AF26BA07A554BEFA46F142B)

setup.tmp (PID: 2584 cmdline: "C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp" /SL5="$705E0,17762851,56832,C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP- MD5: FFCF263A020AA7794015AF0EDEE5DF0B)

rundll32.exe (PID: 1672 cmdline: "C:\Windows\system32\rundll32.exe" libusb0.dll,usb_install_driver_np_rundll C:\Windows\zkdrv\ZKFP.inf MD5: EF3179D498793BF4234F708D3BE28633)

DPInst64.exe (PID: 6772 cmdline: "C:\Windows\dpdrv\DPInst64.exe" /s MD5: C3AC43B2018114A617E946AA8FDF3CAC)

regsvr32.exe (PID: 5924 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 5800 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPDevTS.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 6528 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DpFnd2.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 3416 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

msiexec.exe (PID: 1880 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6776 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5F08179E706612A6B7A04DE10E46E3A3 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1804 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 0AE14355DA77B8EC5D78BBA627A31F90 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5376 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9A6BE86B09F849551CC63C9676854998 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6596 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 029EEC1918DF13259116589682A83A05 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4876 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 42ABA69F9D42EED2BA1E1226AEC89AC1 MD5: 9D09DC1EDA745A5F87553048E57620CF)

windowsdesktop-runtime-6.0.4-win-x86.exe (PID: 3840 cmdline: "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /burn.runonce MD5: 9B29FA18CED2536A6AF5978740439137)

windowsdesktop-runtime-6.0.4-win-x86.exe (PID: 5868 cmdline: "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057 MD5: 9B29FA18CED2536A6AF5978740439137)

windowsdesktop-runtime-6.0.4-win-x86.exe (PID: 2896 cmdline: "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057 MD5: 9B29FA18CED2536A6AF5978740439137)

windowsdesktop-runtime-6.0.4-win-x86.exe (PID: 5820 cmdline: "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{5B3AA127-E574-49A0-B320-16AAE8743C18} {B68FB661-CED6-45D2-8A04-5EF32E491C00} 2896 MD5: 9B29FA18CED2536A6AF5978740439137)

svchost.exe (PID: 4836 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 4396 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.inf" "9" "42c8444f7" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\users\user\appdata\local\temp\is-clj4h.tmp\twn4" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 4900 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\ZKFP.inf" "9" "429e2a833" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\zkdrv" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 6092 cmdline: DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.inf" "9" "47ae312af" "000000000000018C" "WinSta0\Default" "0000000000000194" "208" "c:\windows\dpdrv" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\SysWOW64\is-4C9RD.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\FPSensor\Biokey\is-IO0QL.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 4836, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DCA096 DecryptFileW,	8_2_00DCA096
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEFE7F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	8_2_00DEFE7F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DC9E7B DecryptFileW,DecryptFileW,	8_2_00DC9E7B
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B3A096 DecryptFileW,	9_2_00B3A096
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B39E7B DecryptFileW,DecryptFileW,	9_2_00B39E7B
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5FE7F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	9_2_00B5FE7F
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9FE7F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	10_2_00E9FE7F
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E79E7B DecryptFileW,DecryptFileW,	10_2_00E79E7B
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E7A096 DecryptFileW,	10_2_00E7A096
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CEA096 DecryptFileW,	15_2_00CEA096
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0FE7F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	15_2_00D0FE7F
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CE9E7B DecryptFileW,DecryptFileW,	15_2_00CE9E7B
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A7E7F HeapSetInformation,LoadStringW,LoadStringW,LoadStringW,LoadStringA,LoadStringW,LoadStringW,LoadStringW,CryptUIDlgCertMgr,CryptMsgClose,CertCloseStore,	29_2_004A7E7F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A644E CryptMsgGetParam,printf,printf,printf,CryptMsgGetAndVerifySigner,CertFreeCertificateContext,	29_2_004A644E
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A1A5B strtok,strtok,strtok,SetLastError,CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertSetCertificateContextProperty,CertSetCertificateContextProperty,CertSetCertificateContextProperty,CertEnumCertificatesInStore,CertFreeCertificateContext,	29_2_004A1A5B
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A8163 CryptFindOIDInfo,	29_2_004A8163
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A2B61 CryptDecodeObject,printf,	29_2_004A2B61
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A3C7E CryptSIPRetrieveSubjectGuid,CryptSIPLoad,memset,CertOpenStore,CryptMsgOpenToDecode,CertCloseStore,CryptMsgUpdate,CertCloseStore,CryptMsgClose,	29_2_004A3C7E
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A3272 CryptFindOIDInfo,	29_2_004A3272
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A82C8 CryptDecodeObject,CryptDecodeObject,CryptDecodeObject,	29_2_004A82C8
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A22DB CryptStringToBinaryA,CryptStringToBinaryA,GetLastError,CryptStringToBinaryA,GetLastError,	29_2_004A22DB
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A81D0 printf,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,	29_2_004A81D0
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A5CD6 printf,CertGetCertificateContextProperty,CertGetCertificateContextProperty,CertGetCertificateContextProperty,CryptAcquireContextA,CryptHashPublicKeyInfo,CryptReleaseContext,CertGetCertificateContextProperty,CertGetCertificateContextProperty,printf,printf,printf,CertGetPublicKeyLength,printf,printf,printf,	29_2_004A5CD6
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A2BFA CryptDecodeObject,printf,	29_2_004A2BFA
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A17F3 GetModuleHandleA,CryptInitOIDFunctionSet,CryptInstallOIDFunctionAddress,	29_2_004A17F3
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A2FF4 CryptDecodeObject,printf,printf,printf,	29_2_004A2FF4
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A2390 CryptStringToBinaryW,CryptStringToBinaryW,GetLastError,CryptStringToBinaryW,GetLastError,	29_2_004A2390
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A81A9 CryptFindOIDInfo,	29_2_004A81A9
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A32A1 CryptGetOIDFunctionAddress,wprintf,CryptFreeOIDFunctionAddress,	29_2_004A32A1

Compliance

Uses 32bit PE files

Source: 2N Driver for External USB Readers.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Creates a software uninstall entry

Source: C:\Windows\DPDrv\DPInst64.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\E8FD6EF8CC869DE121501FB543A7C0674D30756F

Creates license or readme file

Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\eula.rtf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\LICENSE.txt	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	File created: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\eula.rtf

PE / OLE file has a valid certificate

Source: 2N Driver for External USB Readers.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2N Driver for External USB Readers.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: E:\Workspaces\zkteco svn\libfpsensor\trunk\libfpsensor\x64\Release\ZKFPSensors\libzklibcap.pdb source: setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000002.3061790570.000000000018E000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpDevDat.pdb source: DPInst64.exe, 00000028.00000003.2964085180.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006547610.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2998219929.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpd00701.pdb source: drvinst.exe, 00000029.00000003.2999026102.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\GitLab-Runner\builds\WzT4ZGRf\1\ac\secured-card-tool\src\Shared\Rfid.Encryption\obj\x86\Release\net6.0\Nn.Rfid.Encryption.pdbSHA256 source: is-77UBH.tmp.2.dr
Source:	Binary string: CertMgr.pdb source: CertMgr.Exe, CertMgr.Exe, 0000001D.00000000.2767345124.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001D.00000002.2768431869.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001F.00000002.2769914048.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001F.00000000.2769071550.00000000004A1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.11.dr
Source:	Binary string: e:\TeamBuilds\Core\DP_ENT_WS_MAIN\Binaries\Win32\Release\DPDevTS.pdbD source: is-I03EA.tmp.37.dr
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpDevDatx64.pdb source: DPInst64.exe, 00000028.00000003.2965141208.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006784725.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2999546158.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: g:\fingerpr\mars\src\usbscan\objfre_wlh_amd64\amd64\usbdpfp.pdb source: DPInst64.exe, 00000028.00000003.2963361782.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3005824851.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997532265.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpi00701x64.pdb source: DPInst64.exe, 00000028.00000003.2963704354.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997861422.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006443858.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Thomas\source\repos\winusbnet\WinUSBNet\obj\Release\netcoreapp3.1\WinUSBNet.pdbSHA256 source: is-HP6R9.tmp.2.dr
Source:	Binary string: e:\TeamBuilds\SDKUI\DP_ENT_WS\Binaries\Win32\Release\DPPTUtils.pdb source: regsvr32.exe, 0000002C.00000002.3042172324.000000006FB88000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpi00701.pdb source: DPInst64.exe, 00000028.00000003.2965474924.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3000014532.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006880739.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpd00701x64.pdb source: drvinst.exe, 00000029.00000003.2996375367.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3005824851.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\NightBuild\Installer\obj\checkout\IDKit\bin\x64\IDKit (Release)\IDKit64.pdb source: setup.tmp, 00000025.00000003.3058605092.0000000005C0C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Work\usb-driver\utils\HostsHelper\obj\Release\HostsHelper.pdb source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, HostsHelper.exe, 0000001B.00000000.2761274455.000001827EE32000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: DpInst.pdb source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, dpinst.exe, dpinst.exe, 00000021.00000002.2794901615.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, dpinst.exe, 00000021.00000000.2770689280.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, DPInst64.exe, 00000028.00000000.2933095406.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, DPInst64.exe, 00000028.00000002.3038803899.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, is-AL0OI.tmp.2.dr
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb source: dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: g:\fingerpr\mars\src\mp\sputniki\kdevice\dp4000x\objfre_wlh_amd64\amd64\dpK00701.pdb source: DPInst64.exe, 00000028.00000003.2966647351.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006988043.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3001362963.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\native\net6.0-windows-Release-x86\System.IO.Compression.Native\System.IO.Compression.Native.pdbXXXGCTL source: System.IO.Compression.Native.dll.11.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: api-ms-win-core-handle-l1-1-0.dll.11.dr
Source:	Binary string: e:\TeamBuilds\SDKUI\DP_ENT_WS\Binaries\Win32\Release\DPPTUtils.pdb source: regsvr32.exe, 0000002C.00000002.3042172324.000000006FB88000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\Repos\deployment-tools\fork\deployment-tools\artifacts\obj\win-x86.Release\native\projects\NetCoreCheck\Release\NetCoreCheck.pdb source: netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: System.IO.FileSystem.AccessControl.dll.11.dr
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpDevCtl.pdb source: DPInst64.exe, 00000028.00000003.2964431689.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006655772.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2998634796.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Thomas\source\repos\winusbnet\WinUSBNet\obj\Release\netcoreapp3.1\WinUSBNet.pdb source: is-HP6R9.tmp.2.dr
Source:	Binary string: C:\GitLab-Runner\builds\WzT4ZGRf\1\ac\secured-card-tool\src\Shared\Rfid.Encryption\obj\x86\Release\net6.0\Nn.Rfid.Encryption.pdb source: is-77UBH.tmp.2.dr
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpDevCtlx64.pdb source: DPInst64.exe, 00000028.00000003.2965863378.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006988043.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3000450737.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\native\net6.0-windows-Release-x86\System.IO.Compression.Native\System.IO.Compression.Native.pdb source: System.IO.Compression.Native.dll.11.dr
Source:	Binary string: e:\TeamBuilds\Core\DP_ENT_WS_MAIN\Binaries\Win32\Release\DPDevTS.pdb source: is-I03EA.tmp.37.dr
Source:	Binary string: DpInst.pdbH source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794901615.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, dpinst.exe, 00000021.00000000.2770689280.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, DPInst64.exe, 00000028.00000000.2933095406.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, DPInst64.exe, 00000028.00000002.3038803899.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, is-AL0OI.tmp.2.dr
Source:	Binary string: E:\Workspaces\C++\zkidentify_openssl\x64\Release\fpslib.pdb source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdbP source: drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.AccessControl\net6.0-windows-Release\System.IO.FileSystem.AccessControl.pdb source: System.IO.FileSystem.AccessControl.dll.11.dr
Source:	Binary string: E:\Repos\deployment-tools\fork\deployment-tools\artifacts\obj\win-x86.Release\native\projects\NetCoreCheck\Release\NetCoreCheck.pdbiiiGCTL source: netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb/ source: dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpi00701x64.pdb source: DPInst64.exe, 00000028.00000003.2963704354.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997861422.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006443858.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\NightBuild\Installer\obj\checkout\IDKit\bin\x64\IDKit (Release)\IDKit64.pdb \( source: setup.tmp, 00000025.00000003.3058605092.0000000005C0C000.00000004.00001000.00020000.00000000.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100698F __EH_prolog3_GS,FindFirstFileExW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,__EH_prolog3_GS,_invalid_parameter_noinfo_noreturn,	3_2_0100698F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DB3D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	8_2_00DB3D89
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DF488B FindFirstFileW,FindClose,	8_2_00DF488B
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE7857 FindFirstFileExW,	8_2_00DE7857
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DC9B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	8_2_00DC9B24
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B6488B FindFirstFileW,FindClose,	9_2_00B6488B
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B39B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	9_2_00B39B24
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B23D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	9_2_00B23D89
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B57857 FindFirstFileExW,	9_2_00B57857
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00EA488B FindFirstFileW,FindClose,	10_2_00EA488B
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E79B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	10_2_00E79B24
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E63D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	10_2_00E63D89
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E97857 FindFirstFileExW,	10_2_00E97857
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D1488B FindFirstFileW,FindClose,	15_2_00D1488B
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D07857 FindFirstFileExW,	15_2_00D07857
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CE9B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	15_2_00CE9B24
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CD3D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	15_2_00CD3D89
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00452AD4 FindFirstFileA,GetLastError,	37_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	37_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	37_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	37_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	37_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	37_2_00498FDC

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll, type: DROPPED

Source: System.IO.Compression.Native.dll.11.dr	String found in binary or memory: http://.css
Source: System.IO.Compression.Native.dll.11.dr	String found in binary or memory: http://.jpg
Source: windowsdesktop-runtime-6.0.4-win-x86.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.2712304320.0000000000871000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3191090059.0000000000892000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3175444140.0000000000892000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 2N Driver for External USB Readers.tmp, 00000002.00000002.3192968875.0000000004870000.00000004.00000020.00020000.00000000.sdmp, CertMgr.Exe, 0000001D.00000002.2768834531.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D60000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2789179117.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2788067294.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886224881.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000002.2892572494.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2890795608.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3019442083.0000026964E3F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000002.3022171824.0000026964E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: CertMgr.Exe, 0000001D.00000002.2768834531.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, CertMgr.Exe, 0000001F.00000002.2770070849.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2789179117.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2788067294.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886224881.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000002.2892572494.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2890795608.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3019442083.0000026964E3F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000002.3022171824.0000026964E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0P
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Timestamping1.crl0
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: drvinst.exe, 00000027.00000002.2892572494.00000240A8850000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2891246833.00000240A8850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crm.innovatrics.com
Source: setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crm.innovatrics.com/
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: dpinst.exe, 00000021.00000002.2793695970.000000000056B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabt
Source: System.IO.Compression.Native.dll.11.dr	String found in binary or memory: http://html4/loose.dtd
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://libusb-win32.sourceforge.netN
Source: drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://libusb-win32.sourceforge.netb
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.2712304320.0000000000871000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3191090059.0000000000892000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3175444140.0000000000892000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035586309.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com0_
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt
Source: CertMgr.Exe, 0000001D.00000002.2768834531.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, CertMgr.Exe, 0000001F.00000002.2770070849.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2789179117.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2788067294.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886224881.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000002.2892572494.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2890795608.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3019442083.0000026964E3F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000002.3022171824.0000026964E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt0
Source: dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt9W
Source: dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crtP
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2015/sc0
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760897614.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2562791382.000000000110D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752977068.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2754280071.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2660004896.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2753298811.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2660004896.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752630825.0000000003510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2015/schema.xsd
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcb.com/sw.crl0f
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcd.com0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: dotnet60desktop.exe, 00000009.00000002.2708076898.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761380592.0000000003860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010Hd
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.2n.cz
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.2n.cz1RZ
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.2n.cz32
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.2n.cziRZ
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globalsign.net/repository/0
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globalsign.net/repository/03
Source: rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globalsign.net/repository09
Source: setup.tmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: setup.exe, setup.exe, 00000024.00000002.3063856766.0000000000401000.00000020.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: setup.exe, 00000024.00000002.3063856766.0000000000401000.00000020.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: setup.exe, 00000024.00000003.2797211868.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000024.00000003.2797392558.00000000021BC000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: setup.exe, 00000024.00000003.2797211868.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000024.00000003.2797392558.00000000021BC000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/20-p2-rel-notes
Source: dotnet60desktop.exe, 00000009.00000002.2708114386.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/20-p2-rel-notesi
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/dev-privacy
Source: dotnet60desktop.exe, 00000009.00000002.2708340549.0000000000709000.00000004.00000020.00020000.00000000.sdmp, dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000112B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758490285.000000000110D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758490285.000000000112B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758004763.0000000001142000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.0000000001142000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/dotnet-cli-telemetry
Source: netcorecheck.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=hXReading
Source: netcorecheck.exe, 00000003.00000002.2135554084.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=5.0
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/dotnet-docs
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761380592.0000000003860000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/dotnet-license-windows
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	String found in binary or memory: https://aka.ms/dotnet-tutorials
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.3193501314.0000000002260000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2125775570.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000024F7000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.0000000003862000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.00000000038E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.3193501314.0000000002260000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2125775570.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000024F7000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.0000000003862000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.00000000038E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x86.exe
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0)
Source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000003.2763134408.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000003.2761955887.000000000350A000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2753072927.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752283030.00000000038EA000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752630825.0000000003510000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2754157109.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dot.net/core
Source: dotnet60desktop.exe, 00000009.00000002.2708114386.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dot.net/core2
Source: windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2704627944.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2705444131.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dot.net/core7
Source: System.IO.FileSystem.AccessControl.dll.11.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: 2N Driver for External USB Readers.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repo
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, CertMgr.Exe, 0000001D.00000002.2768834531.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, CertMgr.Exe, 0000001F.00000002.2770070849.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2789179117.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2788067294.00000238D4376000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886224881.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000002.2892572494.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2890795608.00000240A87FC000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3036874849.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000003.3035189642.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, DPInst64.exe, 00000028.00000002.3037536715.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792952819.000000000061D000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.2127173120.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2127593853.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000000.2128996068.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.2127173120.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2127593853.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000000.2128996068.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-279IB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpersona_x64.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\usbserial.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-ADA36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\dfu.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\siliconLabs.cer (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-ASR1N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\symantec.cer (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	File created: C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\SET773C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\ServerSSL.pfx (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\is-DKDRB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpersona_x64.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\zkfp.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-N73BK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\is-CFPTC.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SET9FE3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCC51.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-6D6F7.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\SET7A78.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\twn4cdc.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\zkfp.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	File created: C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.cat (copy)	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	File created: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\is-DO317.tmp	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	File created: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBEB5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\twn4cdc.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-6EMJM.tmp	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

File written: C:\Windows\System32\drivers\etc\hosts

System Summary

Submitted sample is a known malware sample

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped file: MD5: 181c8f19f974ad8a84b8673d487bbf0d Family: Metamorfo Description: The attackers used various techniques to evade detection and infect unsuspecting Portuguese-speaking users with banking Trojans. Public cloud infrastructure is utilized to help deliver the different stages and play a particularly big role in delivering the malicious payload. Legitimate signed binaries are also abused to load malicious code. References: https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.htmlData Source: https://github.com/RedDrip7/APT_Digital_Weapon
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped file: MD5: 181c8f19f974ad8a84b8673d487bbf0d Family: Metamorfo Description: The attackers used various techniques to evade detection and infect unsuspecting Portuguese-speaking users with banking Trojans. Public cloud infrastructure is utilized to help deliver the different stages and play a particularly big role in delivering the malicious payload. Legitimate signed binaries are also abused to load malicious code. References: https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.htmlData Source: https://github.com/RedDrip7/APT_Digital_Weapon

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0042F594 NtdllDefWindowProc_A,	37_2_0042F594
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00423B94 NtdllDefWindowProc_A,	37_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004125E8 NtdllDefWindowProc_A,	37_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00479380 NtdllDefWindowProc_A,	37_2_00479380
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0045763C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	37_2_0045763C

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Code function: 37_2_0042E944: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

37_2_0042E944

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		36_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		37_2_0045568C

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df02a.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{8075C447-DEF3-4DCC-BB39-8497717BE91E}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF56A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df02d.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df02d.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI16AE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df02e.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{61373008-0285-40B8-93C2-26C8110BC4ED}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1BA1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df031.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df031.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1C5D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df032.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1F0E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df035.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df035.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21ED.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df036.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{28F5CA46-286A-4C61-A86E-525F06E456DD}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2847.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df039.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6df039.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI563E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI689E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI69A9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	File created: C:\Windows\DPINST.LOG
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-1KSCE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-OHV6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-APUGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-J3PKB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-EL1CK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-DQHA8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-6EMJM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-GC5D4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-ECSVK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-NEUSB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-JPCD5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-5NC7F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-RD0A7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-RULKA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-KMSK2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-S4LL1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-NR955.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-8O2DU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-H2VJ6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-A1JBL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-N97T5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-8NF8V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-52V98.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-GVF50.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\is-0V5J0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-LV194.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-NTD91.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-59OUT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-4C9RD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-JDKR1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-1C0V4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-PR4RR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-5B4KM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-U28V6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-DG1QU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-S6M9U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-DSTA3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-1GES6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-C6HAI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-LRLHQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-MEAI8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-ASR1N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-HGQH9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-7O1AC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-8VQ00.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-AP1V0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-IPKM0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-591T5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-TGQ65.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-HAADG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-E9LLE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-IGODE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-702MI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-C1CQG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-FDOTF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-FVSOJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-OJSTD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\is-US67P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\is-4L7MR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\is-43LAD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\is-0I0LF.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\zkfp.inf_amd64_ab1035548178aff8
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\dpersona_x64.inf_amd64_d9a56a0c507c5e8f
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem5.inf

Deletes files inside the Windows folder

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

File deleted: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100CAF0	3_2_0100CAF0
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DD4085	8_2_00DD4085
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDC132	8_2_00DDC132
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEF2A2	8_2_00DEF2A2
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DB635B	8_2_00DB635B
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE26D1	8_2_00DE26D1
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEA600	8_2_00DEA600
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDF9D3	8_2_00DDF9D3
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE2905	8_2_00DE2905
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEAA98	8_2_00DEAA98
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEDC1E	8_2_00DEDC1E
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DEDD42	8_2_00DEDD42
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B44085	9_2_00B44085
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4C132	9_2_00B4C132
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5F2A2	9_2_00B5F2A2
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B2635B	9_2_00B2635B
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B526D1	9_2_00B526D1
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5A600	9_2_00B5A600
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4F9D3	9_2_00B4F9D3
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B52905	9_2_00B52905
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5AA98	9_2_00B5AA98
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5DC1E	9_2_00B5DC1E
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5DD42	9_2_00B5DD42
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E84085	10_2_00E84085
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8C132	10_2_00E8C132
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9F2A2	10_2_00E9F2A2
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E6635B	10_2_00E6635B
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E926D1	10_2_00E926D1
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9A600	10_2_00E9A600
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8F9D3	10_2_00E8F9D3
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E92905	10_2_00E92905
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9AA98	10_2_00E9AA98
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9DC1E	10_2_00E9DC1E
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9DD42	10_2_00E9DD42
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CF4085	15_2_00CF4085
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFC132	15_2_00CFC132
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0F2A2	15_2_00D0F2A2
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CD635B	15_2_00CD635B
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D026D1	15_2_00D026D1
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0A600	15_2_00D0A600
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFF9D3	15_2_00CFF9D3
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D02905	15_2_00D02905
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0AA98	15_2_00D0AA98
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0DC1E	15_2_00D0DC1E
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0DD42	15_2_00D0DD42
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A57BD	29_2_004A57BD
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_0040840C	36_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00470C74	37_2_00470C74
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0048ED0C	37_2_0048ED0C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004813C4	37_2_004813C4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00467848	37_2_00467848
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004303D0	37_2_004303D0
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0044453C	37_2_0044453C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004885E0	37_2_004885E0
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00434638	37_2_00434638
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00444AE4	37_2_00444AE4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00430F5C	37_2_00430F5C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0045F16C	37_2_0045F16C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004451DC	37_2_004451DC
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0045B21C	37_2_0045B21C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0043533C	37_2_0043533C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004455E8	37_2_004455E8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00487680	37_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0046989C	37_2_0046989C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00451A30	37_2_00451A30
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0043DDC4	37_2_0043DDC4

Enables security privileges

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00408C1C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00406AD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 0040596C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00407904 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00445E48 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00457FC4 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00457DB8 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00434550 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00403494 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 004533B8 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00446118 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: String function: 00B60657 appears 682 times
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: String function: 00B238F5 appears 502 times
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: String function: 00B60B3E appears 34 times
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: String function: 00B63770 appears 79 times
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: String function: 00B2204D appears 54 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: String function: 0100E196 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: String function: 00DB38F5 appears 502 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: String function: 00DF0B3E appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: String function: 00DF3770 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: String function: 00DB204D appears 54 times
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: String function: 00DF0657 appears 682 times
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00D13770 appears 79 times
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00CD38F5 appears 502 times
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00CD204D appears 54 times
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00D10657 appears 682 times
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00D10B3E appears 34 times
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00EA3770 appears 81 times
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00EA0B3E appears 34 times
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00EA0657 appears 682 times
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00E6204D appears 54 times
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: String function: 00E638F5 appears 502 times

PE file contains executable resources (Code or Archives)

Source: 2N Driver for External USB Readers.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-0DRB9.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-BQ92G.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 1639755 bytes, 2 files, at 0x44 +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Win2k-WinXP-Win2k3.exe" +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Vista.msu", flags 0x4, ID 12343, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Source: is-H5954.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Microsoft Standalone Update, 256987 bytes, 4 files, at 0x44 +A "WSUSSCAN.cab" +A "Windows6.0-KB971286-x64.cab", flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1 compression
Source: is-H5954.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-5KKTG.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 1384567 bytes, 2 files, at 0x44 +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Win2k-WinXP-Win2k3.exe" +A "Microsoft Kernel-Mode Driver Framework Install-v1.9-Vista.msu", flags 0x4, ID 12343, number 1, extra bytes 20 in head, 43 datablocks, 0x1503 compression
Source: is-NEGFN.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Microsoft Standalone Update, 240840 bytes, 4 files, at 0x44 +A "WSUSSCAN.cab" +A "Windows6.0-KB971286-x86.cab", flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
Source: is-NEGFN.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows

PE file contains more sections than normal

Source: is-JBSJJ.tmp.2.dr	Static PE information: Number of sections : 15 > 10
Source: is-P6L7J.tmp.2.dr	Static PE information: Number of sections : 16 > 10
Source: is-00NGS.tmp.2.dr	Static PE information: Number of sections : 15 > 10
Source: is-18QUK.tmp.2.dr	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: 2N Driver for External USB Readers.exe, 00000000.00000003.3193501314.0000000002298000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs 2N Driver for External USB Readers.exe
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.2127173120.0000000002619000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 2N Driver for External USB Readers.exe
Source: 2N Driver for External USB Readers.exe, 00000000.00000003.2127593853.000000007FE05000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 2N Driver for External USB Readers.exe
Source: 2N Driver for External USB Readers.exe, 00000000.00000000.2125477292.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 2N Driver for External USB Readers.exe
Source: 2N Driver for External USB Readers.exe	Binary or memory string: OriginalFileName vs 2N Driver for External USB Readers.exe

Uses 32bit PE files

Source: 2N Driver for External USB Readers.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-SD9NL.tmp.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-BQ92G.tmp.2.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9985629322738576
Source: is-5KKTG.tmp.2.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9981172708256713

Source: is-2J23P.tmp.2.dr, Crypto.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-2J23P.tmp.2.dr, Crypto.cs	Cryptographic APIs: 'TransformBlock'
Source: is-2J23P.tmp.2.dr, Crypto.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: sus32.troj.adwa.evad.winEXE@95/1072@0/0

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DB20A3 FormatMessageW,GetLastError,LocalFree,

8_2_00DB20A3

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DB4674 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	8_2_00DB4674
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B24674 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	9_2_00B24674
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E64674 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	10_2_00E64674
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CD4674 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	15_2_00CD4674
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	36_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	37_2_0045568C

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Code function: 37_2_00455EB4 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

37_2_00455EB4

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DF34D0 GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

8_2_00DF34D0

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe

Code function: 36_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

36_2_00409C34

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DD6A02 ChangeServiceConfigW,GetLastError,

8_2_00DD6A02

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

File created: C:\Program Files (x86)\2N TELEKOMUNIKACE

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\DPDrv\DPInst64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DPINST_LOG_SCROLLER_MUTEX
Source: C:\Windows\DPDrv\DPInst64.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3780:120:WilError_03
Source: C:\Windows\DPDrv\DPInst64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DIFX_PROGRAM_FILES_MUTEX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_03
Source: C:\Windows\SysWOW64\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\5924
Source: C:\Windows\SysWOW64\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\5800
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\SysWOW64\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\6528

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe

File created: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp

Jump to behavior

Source: Yara match	File source: C:\Windows\SysWOW64\is-4C9RD.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\FPSensor\Biokey\is-IO0QL.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: cabinet.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: msi.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: version.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: wininet.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: comres.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: clbcatq.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: msasn1.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: crypt32.dll	8_2_00DB1070
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Command line argument: feclient.dll	8_2_00DB1070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: cabinet.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: msi.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: version.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: wininet.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: comres.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: clbcatq.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: msasn1.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: crypt32.dll	9_2_00B21070
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Command line argument: feclient.dll	9_2_00B21070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: cabinet.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: msi.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: version.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: wininet.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: comres.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: clbcatq.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: msasn1.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: crypt32.dll	10_2_00E61070
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: feclient.dll	10_2_00E61070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: cabinet.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: msi.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: version.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: wininet.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: comres.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: clbcatq.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: msasn1.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: crypt32.dll	15_2_00CD1070
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Command line argument: feclient.dll	15_2_00CD1070

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" libusb0.dll,usb_install_driver_np_rundll C:\Windows\zkdrv\ZKFP.inf

Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: create table iuser_info(title varchar(32) primary key,value varchar(32));
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_idkit values (:001,:002,:003);
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_idkit_images_backup select userid,templateid,image from iuser_idkit_images;
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_idkit_images select * from iuser_idkit_images_backup;
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_tags values (:001,:002,:003);
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: select value from iuser_info where title='db version';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: update iuser_info set 'value'='1.4' where title='db version';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_idkit values (:001,:002,:003);insert into iuser_idkit_images values (:001,:002,:003);delete from iuser_idkit_images where userid=:001delete from iuser_idkit where userid=:001insert into iuser_tags values (:001,:002,:003);delete from iuser_tags where userid=:001vacuumdelete from iuser_tagsdelete from iuser_idkit_imagesdelete from iuser_idkitselect custom_data from iuser_idkit where userid=:001select templateid,image from iuser_idkit_images where userid=:001select userid, name, value from iuser_tagsselect userid,record from iuser_idkit
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: create table iuser_idkit_images (userid integer NOT NULL,templateid integer NOT NULL,image blob NOT NULL,PRIMARY KEY (userid, templateid));
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: update iuser_info set 'value'='1.3' where title='db version';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into iuser_idkit_images values (:001,:002,:003);
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: create table iuser_idkit (userid integer primary key,record blob NOT NULL,custom_data blob);
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: update iuser_info set 'value'='1.2' where title='db version';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: select type from sqlite_master where name='%s';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: create table iuser_tags(userid integer NOT NULL,name varchar(100) NOT NULL,value varchar(4000) NOT NULL,PRIMARY KEY (userid, name));
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: update iuser_info set 'value'='1.1' where title='db version';
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into %s values('%s','%d.%d');
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: insert into %s values('%s','%02d/%02d/%02d %02d:%02d:%02d');

Source: dotnet60desktop.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: dotnet60desktop.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: windowsdesktop-runtime-6.0.4-win-x86.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: windowsdesktop-runtime-6.0.4-win-x86.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: dpinst.exe	String found in binary or memory: Some post-install cleanup tasks failed. Error code is 0x%X
Source: dpinst.exe	String found in binary or memory: Could not re-add '%s' to reference list of driver store entry '%s'
Source: dpinst.exe	String found in binary or memory: Successfully re-added '%s' to reference list of driver store entry '%s'
Source: dpinst.exe	String found in binary or memory: Install option set: Suppress pre-install of Plug and Play drivers if no matching devices are present.
Source: dpinst.exe	String found in binary or memory: During undo of install, we failed to re-install the driver. Error code 0x%X
Source: dpinst.exe	String found in binary or memory: Error 0x%X - Could not delete service info key for '%ws', even though there are no more DIFx-installed driver stores using this se
Source: setup.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: 2N Driver for External USB Readers.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe

File read: C:\Users\user\Desktop\2N Driver for External USB Readers.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2N Driver for External USB Readers.exe "C:\Users\user\Desktop\2N Driver for External USB Readers.exe"
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp "C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp" /SL5="$103E4,35010763,947200,C:\Users\user\Desktop\2N Driver for External USB Readers.exe"
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 6.0.4
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" /lcid 2057 /passive /norestart
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Process created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{4C86AD50-ECFF-4E0C-8859-69C2F732A1B6} {4190C1E9-DF0B-4777-B67E-25C22799E37B} 6884
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5F08179E706612A6B7A04DE10E46E3A3
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0AE14355DA77B8EC5D78BBA627A31F90
Source: unknown	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9A6BE86B09F849551CC63C9676854998
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{5B3AA127-E574-49A0-B320-16AAE8743C18} {B68FB661-CED6-45D2-8A04-5EF32E491C00} 2896
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 029EEC1918DF13259116589682A83A05
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 42ABA69F9D42EED2BA1E1226AEC89AC1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe" "2N USB Driver" DISABLE ALL
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe" C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine ROOT
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine TrustedPublisher
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe" /SA /SE /SW /F /C /PATH C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.inf" "9" "42c8444f7" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\users\user\appdata\local\temp\is-clj4h.tmp\twn4"
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp" /SL5="$705E0,17762851,56832,C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" libusb0.dll,usb_install_driver_np_rundll C:\Windows\zkdrv\ZKFP.inf
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\ZKFP.inf" "9" "429e2a833" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\zkdrv"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\DPDrv\DPInst64.exe "C:\Windows\dpdrv\DPInst64.exe" /s
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.inf" "9" "47ae312af" "000000000000018C" "WinSta0\Default" "0000000000000194" "208" "c:\windows\dpdrv"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPDevTS.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DpFnd2.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll"
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp "C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp" /SL5="$103E4,35010763,947200,C:\Users\user\Desktop\2N Driver for External USB Readers.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 6.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe" "2N USB Driver" DISABLE ALL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe" C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine ROOT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine TrustedPublisher	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe" /SA /SE /SW /F /C /PATH C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Process created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{4C86AD50-ECFF-4E0C-8859-69C2F732A1B6} {4190C1E9-DF0B-4777-B67E-25C22799E37B} 6884	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5F08179E706612A6B7A04DE10E46E3A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0AE14355DA77B8EC5D78BBA627A31F90	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9A6BE86B09F849551CC63C9676854998	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 029EEC1918DF13259116589682A83A05	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 42ABA69F9D42EED2BA1E1226AEC89AC1	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.inf" "9" "42c8444f7" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\users\user\appdata\local\temp\is-clj4h.tmp\twn4"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\ZKFP.inf" "9" "429e2a833" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\zkdrv"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.inf" "9" "47ae312af" "000000000000018C" "WinSta0\Default" "0000000000000194" "208" "c:\windows\dpdrv"
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp" /SL5="$705E0,17762851,56832,C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" libusb0.dll,usb_install_driver_np_rundll C:\Windows\zkdrv\ZKFP.inf
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\DPDrv\DPInst64.exe "C:\Windows\dpdrv\DPInst64.exe" /s
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPDevTS.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DpFnd2.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll"
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process created: unknown unknown

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: propsys.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: edputil.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: netutils.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: appresolver.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: bcp47langs.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: slc.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: userenv.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: sppc.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: pcacli.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: srclient.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: spp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: powrprof.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: vssapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: vsstrace.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: usoapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: srpapi.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: wkscli.dll
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Section loaded: cryptui.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Section loaded: cryptui.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: drvstore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: devrtl.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: spinf.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Section loaded: apphelp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: apphelp.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: aclayers.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: sfc.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: sfc_os.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: version.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: msasn1.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: uxtheme.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: msxml3.dll
Source: C:\Windows\DPDrv\DPInst64.exe	Section loaded: drvstore.dll

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Window found: window name: TMainForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe

Window detected: Number of UI elements: 21

Creates a software uninstall entry

Source: C:\Windows\DPDrv\DPInst64.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\E8FD6EF8CC869DE121501FB543A7C0674D30756F

PE / OLE file has a valid certificate

Source: 2N Driver for External USB Readers.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: 2N Driver for External USB Readers.exe

Static file information: File size 35906760 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2N Driver for External USB Readers.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: E:\Workspaces\zkteco svn\libfpsensor\trunk\libfpsensor\x64\Release\ZKFPSensors\libzklibcap.pdb source: setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000002.3061790570.000000000018E000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpDevDat.pdb source: DPInst64.exe, 00000028.00000003.2964085180.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006547610.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2998219929.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpd00701.pdb source: drvinst.exe, 00000029.00000003.2999026102.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\GitLab-Runner\builds\WzT4ZGRf\1\ac\secured-card-tool\src\Shared\Rfid.Encryption\obj\x86\Release\net6.0\Nn.Rfid.Encryption.pdbSHA256 source: is-77UBH.tmp.2.dr
Source:	Binary string: CertMgr.pdb source: CertMgr.Exe, CertMgr.Exe, 0000001D.00000000.2767345124.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001D.00000002.2768431869.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001F.00000002.2769914048.00000000004A1000.00000020.00000001.01000000.00000016.sdmp, CertMgr.Exe, 0000001F.00000000.2769071550.00000000004A1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.11.dr
Source:	Binary string: e:\TeamBuilds\Core\DP_ENT_WS_MAIN\Binaries\Win32\Release\DPDevTS.pdbD source: is-I03EA.tmp.37.dr
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpDevDatx64.pdb source: DPInst64.exe, 00000028.00000003.2965141208.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006784725.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2999546158.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: g:\fingerpr\mars\src\usbscan\objfre_wlh_amd64\amd64\usbdpfp.pdb source: DPInst64.exe, 00000028.00000003.2963361782.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3005824851.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997532265.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpi00701x64.pdb source: DPInst64.exe, 00000028.00000003.2963704354.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997861422.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006443858.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Thomas\source\repos\winusbnet\WinUSBNet\obj\Release\netcoreapp3.1\WinUSBNet.pdbSHA256 source: is-HP6R9.tmp.2.dr
Source:	Binary string: e:\TeamBuilds\SDKUI\DP_ENT_WS\Binaries\Win32\Release\DPPTUtils.pdb source: regsvr32.exe, 0000002C.00000002.3042172324.000000006FB88000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpi00701.pdb source: DPInst64.exe, 00000028.00000003.2965474924.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3000014532.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006880739.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpd00701x64.pdb source: drvinst.exe, 00000029.00000003.2996375367.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3005824851.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\NightBuild\Installer\obj\checkout\IDKit\bin\x64\IDKit (Release)\IDKit64.pdb source: setup.tmp, 00000025.00000003.3058605092.0000000005C0C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Work\usb-driver\utils\HostsHelper\obj\Release\HostsHelper.pdb source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, HostsHelper.exe, 0000001B.00000000.2761274455.000001827EE32000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: DpInst.pdb source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, dpinst.exe, dpinst.exe, 00000021.00000002.2794901615.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, dpinst.exe, 00000021.00000000.2770689280.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, DPInst64.exe, 00000028.00000000.2933095406.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, DPInst64.exe, 00000028.00000002.3038803899.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, is-AL0OI.tmp.2.dr
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb source: dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: g:\fingerpr\mars\src\mp\sputniki\kdevice\dp4000x\objfre_wlh_amd64\amd64\dpK00701.pdb source: DPInst64.exe, 00000028.00000003.2966647351.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006988043.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3001362963.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\native\net6.0-windows-Release-x86\System.IO.Compression.Native\System.IO.Compression.Native.pdbXXXGCTL source: System.IO.Compression.Native.dll.11.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: api-ms-win-core-handle-l1-1-0.dll.11.dr
Source:	Binary string: e:\TeamBuilds\SDKUI\DP_ENT_WS\Binaries\Win32\Release\DPPTUtils.pdb source: regsvr32.exe, 0000002C.00000002.3042172324.000000006FB88000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\Repos\deployment-tools\fork\deployment-tools\artifacts\obj\win-x86.Release\native\projects\NetCoreCheck\Release\NetCoreCheck.pdb source: netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: System.IO.FileSystem.AccessControl.dll.11.dr
Source:	Binary string: G:\fingerpr\Mars\Run32\Release\dpDevCtl.pdb source: DPInst64.exe, 00000028.00000003.2964431689.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006655772.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2998634796.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Thomas\source\repos\winusbnet\WinUSBNet\obj\Release\netcoreapp3.1\WinUSBNet.pdb source: is-HP6R9.tmp.2.dr
Source:	Binary string: C:\GitLab-Runner\builds\WzT4ZGRf\1\ac\secured-card-tool\src\Shared\Rfid.Encryption\obj\x86\Release\net6.0\Nn.Rfid.Encryption.pdb source: is-77UBH.tmp.2.dr
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpDevCtlx64.pdb source: DPInst64.exe, 00000028.00000003.2965863378.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006988043.0000026965321000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3000450737.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\native\net6.0-windows-Release-x86\System.IO.Compression.Native\System.IO.Compression.Native.pdb source: System.IO.Compression.Native.dll.11.dr
Source:	Binary string: e:\TeamBuilds\Core\DP_ENT_WS_MAIN\Binaries\Win32\Release\DPDevTS.pdb source: is-I03EA.tmp.37.dr
Source:	Binary string: DpInst.pdbH source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794901615.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, dpinst.exe, 00000021.00000000.2770689280.00007FF79B131000.00000020.00000001.01000000.00000017.sdmp, DPInst64.exe, 00000028.00000000.2933095406.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, DPInst64.exe, 00000028.00000002.3038803899.00007FF6BEA11000.00000020.00000001.01000000.0000001B.sdmp, is-AL0OI.tmp.2.dr
Source:	Binary string: E:\Workspaces\C++\zkidentify_openssl\x64\Release\fpslib.pdb source: setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdbP source: drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.AccessControl\net6.0-windows-Release\System.IO.FileSystem.AccessControl.pdb source: System.IO.FileSystem.AccessControl.dll.11.dr
Source:	Binary string: E:\Repos\deployment-tools\fork\deployment-tools\artifacts\obj\win-x86.Release\native\projects\NetCoreCheck\Release\NetCoreCheck.pdbiiiGCTL source: netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\agent\_work\138\s\build\ship\x86\burn.pdb/ source: dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: G:\fingerpr\Mars\Run64\Release\dpi00701x64.pdb source: DPInst64.exe, 00000028.00000003.2963704354.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.2997861422.0000026964E8B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000029.00000003.3006443858.0000026965321000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\NightBuild\Installer\obj\checkout\IDKit\bin\x64\IDKit (Release)\IDKit64.pdb \( source: setup.tmp, 00000025.00000003.3058605092.0000000005C0C000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Binary contains a suspicious time stamp

Source: is-N07MR.tmp.2.dr

Static PE information: 0xB7DA1635 [Thu Sep 29 11:57:41 2067 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_010063B3 __EH_prolog3_GS,LoadLibraryA,GetProcAddress,_invalid_parameter_noinfo_noreturn,

3_2_010063B3

PE file contains sections with non-standard names

Source: 2N Driver for External USB Readers.exe	Static PE information: section name: .didata
Source: 2N Driver for External USB Readers.tmp.0.dr	Static PE information: section name: .didata
Source: is-JBLBK.tmp.2.dr	Static PE information: section name: .wixburn
Source: is-0DRB9.tmp.2.dr	Static PE information: section name: .didata
Source: is-6H63V.tmp.2.dr	Static PE information: section name: .eh_fram
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: .rodata
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /4
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /14
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /29
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /41
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /55
Source: is-P6L7J.tmp.2.dr	Static PE information: section name: /67
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /4
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /14
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /29
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /41
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /55
Source: is-00NGS.tmp.2.dr	Static PE information: section name: /67
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /4
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /14
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /29
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /41
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /55
Source: is-JBSJJ.tmp.2.dr	Static PE information: section name: /67
Source: is-SBU6E.tmp.2.dr	Static PE information: section name: /4
Source: is-K2MUR.tmp.2.dr	Static PE information: section name: /4
Source: is-18QUK.tmp.2.dr	Static PE information: section name: .eh_fram

Registers a DLL

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll"

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100E13C push ecx; ret	3_2_0100E14F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100A3E4 push ecx; ret	3_2_0100A3F6
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDE916 push ecx; ret	8_2_00DDE929
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4E916 push ecx; ret	9_2_00B4E929
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8E916 push ecx; ret	10_2_00E8E929
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFE916 push ecx; ret	15_2_00CFE929
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A8B99 push ecx; ret	29_2_004A8BAC
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_004065C8 push 00406605h; ret	36_2_004065FD
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_004040B5 push eax; ret	36_2_004040F1
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00408104 push ecx; mov dword ptr [esp], eax	36_2_00408109
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00404185 push 00404391h; ret	36_2_00404389
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00404206 push 00404391h; ret	36_2_00404389
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_0040C218 push eax; ret	36_2_0040C219
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_004042E8 push 00404391h; ret	36_2_00404389
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00404283 push 00404391h; ret	36_2_00404389
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: 36_2_00408F38 push 00408F6Bh; ret	36_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004849F4 push 00484B02h; ret	37_2_00484AFA
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0040995C push 00409999h; ret	37_2_00409991
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00458060 push 00458098h; ret	37_2_00458090
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004860E4 push ecx; mov dword ptr [esp], ecx	37_2_004860E9
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004062C4 push ecx; mov dword ptr [esp], eax	37_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004783C8 push ecx; mov dword ptr [esp], edx	37_2_004783C9
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004104F0 push ecx; mov dword ptr [esp], edx	37_2_004104F5
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00412938 push 0041299Bh; ret	37_2_00412993
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0049AD44 pushad ; retf	37_2_0049AD53
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0040CE48 push ecx; mov dword ptr [esp], edx	37_2_0040CE4A
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00459378 push 004593BCh; ret	37_2_004593B4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0040F3A8 push ecx; mov dword ptr [esp], edx	37_2_0040F3AA
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0040546D push eax; ret	37_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004434B4 push ecx; mov dword ptr [esp], ecx	37_2_004434B8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0040553D push 00405749h; ret	37_2_00405741

Source: is-SD9NL.tmp.2.dr

Static PE information: section name: .text entropy: 7.409859269142881

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Executable created and started: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Executable created and started: C:\Windows\DPDrv\DPInst64.exe
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Executable created and started: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Jump to behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8C18F347CF57959E4DD189A7D79464ED795064D6 Blob
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8C18F347CF57959E4DD189A7D79464ED795064D6 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 Blob

Creates processes with suspicious names

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	File created: \2n driver for external usb readers.exe
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	File created: \2n driver for external usb readers.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: \2n driver for external usb readers.tmp	Jump to behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.VisualBasic.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore_x86_x86_6.0.422.16404.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Transactions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Design.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-VLAJN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.ILGeneration.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-2J23P.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-H9DJS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-1MLIS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Design.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-ELJA9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ReachFramework.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-G5MOI.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\dfutool.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-13VD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-5KKTG.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-0DRB9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-NEGFN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.Forms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-F7ES3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Presentation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Xml.Linq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\Qt5Core.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-18QUK.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.AeroLite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXmlLinq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\wpfgfx_cor3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ServiceModel.Web.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-AL0OI.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationCore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-9GLPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-P6L7J.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Classic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.Brotli.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Accessibility.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscorrc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\vcruntime140_cor3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\coreclr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\D3DCompiler_47_cor3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\NLog.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\WindowsBase.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Quic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationTypes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Web.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-00NGS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemDrawing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-5RQKA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-77UBH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.Lightweight.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\flash.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.DiaSymReader.Native.x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.DirectoryServices.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-1B30B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.Linq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\dotnet.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-JBLBK.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-T8KB1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI16AE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\dbgshim.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Formats.Asn1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\WindowsBase.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Royale.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Console.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Permissions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationUI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Luna.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscorlib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\is-98D8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-PU0A1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-6MAU7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.Management.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\DirectWriteForwarder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icuin53.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\API-MS-Win-core-xstate-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Metadata.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemCore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationNative_cor3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	File created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.Design.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.Native.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Uri.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icudt53.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-SD9NL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libstdc++-6.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icuuc53.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.DispatchProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Loader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.HttpListener.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\clrjit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\WindowsFormsIntegration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-V72H2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-HP6R9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\WinUSBNet.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.DataAnnotations.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Xaml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-SBU6E.tmp	Jump to dropped file
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\hostpolicy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\is-H5954.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\is-BQ92G.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Resources.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PenImc_cor3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Controls.Ribbon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Design.Editors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\winusbcoinstaller2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordbi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI69A9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\host\fxr\6.0.4\hostfxr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Mail.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-JBSJJ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Input.Manipulations.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.IO.Ports.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-6H63V.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	File created: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationClientSideProviders.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Hardcodet.NotifyIcon.Wpf.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\winusbcoinstaller2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Aero2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Printing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1C5D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-K2MUR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI563E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ServiceProcess.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Numerics.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.IO.Packaging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-N07MR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe

File created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\zkfinger10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\libcorrect.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\dpfj.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\fpslib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-5B4KM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\fppswsk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\libzkfpcsharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\libdpcap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-NTD91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-RD0A7.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD70.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\dpuvc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-LV194.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\DpClback.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-TGQ65.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-LRLHQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\DPFPApi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\dpuvc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\libcorrect.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-A1JBL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\ZKFPSensors\is-4L7MR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\libdpcap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-8VQ00.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI69A9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-IGODE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\usbdpfp.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-AP1V0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-E9LLE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\DPFPApi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\match.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpDevDat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-1GES6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-8NF8V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpDevCtlx64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\ZKFPSensors\is-0I0LF.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\usbdpfp.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-OHV6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpi00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\libusb0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-S6M9U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	File created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\libzkfp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpi00701x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\dpfpdd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-ECSVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-1KSCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-4C9RD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpd00701x64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpD00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\ZKFPSensors\is-43LAD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-52V98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\libusb0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\libzkfpcsharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-59OUT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\libusb0.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-8O2DU.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\DPInst64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\is-702MI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-1C0V4.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA004.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-S4LL1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-APUGU.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-591T5.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDC1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPCap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\DPClback.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpK00701.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-HAADG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-JDKR1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-EL1CK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\dpfpdd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-PR4RR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-DQHA8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\libusb0_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpDevCtl.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevctlx64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\dpfpdd5000.dll (copy)	Jump to dropped file
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-DG1QU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpk00701.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCC82.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-H2VJ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-NEUSB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\fppswsk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-IPKM0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\dpfpdd5000.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-0V5J0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-FDOTF.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevctl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\libsilkid.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-GVF50.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI16AE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\libzklibcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD00.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-OJSTD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\zkfpslibLow.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701x64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpD00701x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpDevDatx64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-MEAI8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPSensors\libsilkidcap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-RULKA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1C5D.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD41.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-J3PKB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SET9FC3.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\zkfinger10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-7O1AC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-U28V6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\libsilkid.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI563E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\syswow64\dpfj.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\zkfinger10-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\libusb0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-US67P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-JPCD5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-DSTA3.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\matchdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\ZKFPCap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevdat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-FVSOJ.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\is-5NC7F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\DPDrv\dpd00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-KMSK2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\libsilkidcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE7F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\is-N97T5.tmp	Jump to dropped file
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\zkfpslibLow.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\system32\ZKFPSensors\libzklibcap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\fpslib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-NR955.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevdatx64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\libzkfp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\libusb0_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\System32\is-C1CQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\SysWOW64\FPCom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	File created: C:\Windows\zkdrv\is-C6HAI.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA025.tmp	Jump to dropped file

Creates license or readme file

Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	File created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\eula.rtf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\dotnet\LICENSE.txt	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	File created: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\eula.rtf

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2N TELEKOMUNIKACE			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2N TELEKOMUNIKACE\2N USB Driver.lnk			Jump to behavior

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {ff0d7b6b-8624-42f0-b961-69e6cbf896c1}	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {ff0d7b6b-8624-42f0-b961-69e6cbf896c1}	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {ff0d7b6b-8624-42f0-b961-69e6cbf896c1}	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {ff0d7b6b-8624-42f0-b961-69e6cbf896c1}	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	37_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	37_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004241EC IsIconic,SetActiveWindow,SetFocus,	37_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004241A4 IsIconic,SetActiveWindow,	37_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	37_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004843A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	37_2_004843A8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	37_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0042F2F0 IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	37_2_0042F2F0
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004175A8 IsIconic,GetCapture,	37_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00417CDE IsIconic,SetWindowPos,	37_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	37_2_00417CE0

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_0100B050 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_0100B050

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\2N Driver for External USB Readers.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DPDrv\DPInst64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DPDrv\DPInst64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DPDrv\DPInst64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Memory allocated: 1827F060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Memory allocated: 1827F7F0000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

Thread delayed: delay time: 922337203685477

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-JSTVD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\fpslib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\bin\iZHost.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\msquic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore_x86_x86_6.0.422.16404.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.VisualBasic.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DpHostW.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ja\is-8OPPC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Transactions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\en-US\is-B5VTT.tmp	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC063.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\ZKFPSensors\is-4L7MR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\ZKFPSensors\libdpcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-8VQ00.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-67MM5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-7FPM7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\match.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-VLAJN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.ILGeneration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-8NF8V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-OHV6A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Design.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-ELJA9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E3UT2.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-ECSVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-0DRB9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.Forms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPCOper2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-J12JI.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDC1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-JDKR1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\libsilkid.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpDevCtl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\dpfpdd5000.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-H2VJ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-NEUSB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-F7ES3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpI00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-5ERSO.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ja\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-0P6R4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Xml.Linq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-I03EA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPDevice2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-18QUK.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.AeroLite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXmlLinq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\wpfgfx_cor3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-U28V6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationCore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-DSTA3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.OpenSsl.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpdevdat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\ZKFPSensors\libsilkidcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Classic.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\es\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\fpslib.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\libzkfp.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA025.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Accessibility.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscorrc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\usb_dll.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Configuration.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-NTD91.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\coreclr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\D3DCompiler_47_cor3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\WindowsBase.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Quic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\zkdrv\is-1GES6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpDevCtlx64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\ZKFPSensors\is-0I0LF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.TypeExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemDrawing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-5RQKA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-GVGJE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpi00701x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\de\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.Lightweight.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-52V98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPFstCon.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-EL1CK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\is-LSDUN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-DQHA8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\is-SPF5F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\pt-BR\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.Linq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\wd_utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-IPKM0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-0V5J0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-T8KB1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI16AE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-UU74L.tmp	Jump to dropped file
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-OEOP9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\zkfinger10-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\dpfj.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpd00701.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Console.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\ZKFPSensors\libzklibcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBFF2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\FPCom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\zkdrv\is-C6HAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\fr\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI21ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\ZKFPCap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-DN8K5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Luna.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-7A44I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-6MAU7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\en-US\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icuin53.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\API-MS-Win-core-xstate-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Metadata.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\ZKFPSensors\is-E9LLE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\de\is-ET7KT.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\es\is-36K99.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPMux.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpi00701.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\libzkfp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-9FD24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\dpfpdd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPDevTS.dll (copy)	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBEF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Uri.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDF0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA004.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Transactions.Local.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-591T5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\biokey.ocx (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icudt53.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-SD9NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ko\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-PR4RR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\pt-BR\is-AICLH.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libstdc++-6.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.DispatchProxy.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevctl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-9VQTH.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\mi.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\ZKFPSensors\libsilkidcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-KCOJ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-V72H2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\is-IO0QL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-HP6R9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\WinUSBNet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ko\is-FJUTH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-KMSK2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\zkfpslibLow.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\dpfj.dll (copy)	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpK00701.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PenImc_cor3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Controls.Ribbon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-LV194.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\libcorrect.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordbi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI69A9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DpSvInfo2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.DataContractSerialization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\libsilkidcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\host\fxr\6.0.4\hostfxr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-FCT4U.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Input.Manipulations.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\usbdpfp.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\zkfputil.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-VSTNL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\usbdpfp.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-6H63V.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-1KSCE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Intrinsics.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpD00701.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\dpd00701x64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.Serialization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebClient.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hans\DpHostW.exe.mui (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-J8TFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\winusbcoinstaller2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-G6VA9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E3UT2.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPTSClnt.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.AppContext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hant\is-VJQOH.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\ZKFPSensors\libzklibcap.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1C5D.tmp	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9D66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\zkfinger10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-K2MUR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ServiceProcess.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.DataSetExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE20.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-FVSOJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-ENNLB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-NR955.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\zkdrv\libusb0_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\fppswsk.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\is-RD0A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\dpuvc.dll (copy)	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpI00701x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\DpClback.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-TGQ65.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\DPFPApi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\syswow64\dpuvc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-A1JBL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC0A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\DPDrv\usbdpfp.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPAppSyn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\system32\DPFPApi.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Design.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-2J23P.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-1MLIS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ReachFramework.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPJasPer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-G5MOI.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\createdump.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\libcorrect.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\dfutool.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\libzklibcap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-5KKTG.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-NEGFN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hans\is-O6TTQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\zkdrv\libusb0.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-1C0V4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FPSensor\support\u.are.u\win64\fr\is-DO8PA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\zkdrv\libusb0_x64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-FDOTF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Presentation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Web.HttpUtility.dll	Jump to dropped file
Source: C:\Windows\DPDrv\DPInst64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC033.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701x64.dll (copy)	Jump to dropped file

Found evaded block containing many API calls

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Evaded block: after key decision

Found evasive API chain (date check)

Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Evasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Evasive API call chain: GetSystemTime,DecisionNodes

Found evasive API chain checking for process token information

Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Found large amount of non-executed APIs

Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	API coverage: 9.0 %
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	API coverage: 9.4 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp TID: 2884	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe TID: 760	Thread sleep time: -922337203685477s >= -30000s

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DF02DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00DF0378h	8_2_00DF02DD
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DF02DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00DF0371h	8_2_00DF02DD
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B602DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00B60378h	9_2_00B602DD
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B602DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00B60371h	9_2_00B602DD
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00EA02DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00EA0378h	10_2_00EA02DD
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00EA02DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00EA0371h	10_2_00EA02DD
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D102DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00D10378h	15_2_00D102DD
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D102DD GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00D10371h	15_2_00D102DD

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100698F __EH_prolog3_GS,FindFirstFileExW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,__EH_prolog3_GS,_invalid_parameter_noinfo_noreturn,	3_2_0100698F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DB3D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	8_2_00DB3D89
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DF488B FindFirstFileW,FindClose,	8_2_00DF488B
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE7857 FindFirstFileExW,	8_2_00DE7857
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DC9B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	8_2_00DC9B24
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B6488B FindFirstFileW,FindClose,	9_2_00B6488B
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B39B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	9_2_00B39B24
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B23D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	9_2_00B23D89
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B57857 FindFirstFileExW,	9_2_00B57857
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00EA488B FindFirstFileW,FindClose,	10_2_00EA488B
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E79B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	10_2_00E79B24
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E63D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	10_2_00E63D89
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E97857 FindFirstFileExW,	10_2_00E97857
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D1488B FindFirstFileW,FindClose,	15_2_00D1488B
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D07857 FindFirstFileExW,	15_2_00D07857
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CE9B24 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	15_2_00CE9B24
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CD3D89 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	15_2_00CD3D89
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00452AD4 FindFirstFileA,GetLastError,	37_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	37_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	37_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	37_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	37_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: 37_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	37_2_00498FDC

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DF9B11 VirtualQuery,GetSystemInfo,

8_2_00DF9B11

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3175444140.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3191090059.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.2712304320.0000000000871000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.tmp, 00000025.00000003.3058605092.0000000005B8E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\\.\PhysicalDrive%d\\.\IDE21201.VXDERROR: Could not open IDE21201.VXD fileDiskId32\\.\Scsi%d:SCSIDISK%uDrive%dModelNumberDrive%dSerialNumberDrive%dControllerRevisionNumberDrive%dControllerBufferSizeDrive%dTypeRemovableFixedUnknownHardDriveSerialNumberWD-WTAP-WinVirtualVMwareTeamViewer
Source: 2N Driver for External USB Readers.tmp, 00000002.00000003.3177553492.0000000000848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_0100A1D1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0100A1D1

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_010063B3 __EH_prolog3_GS,LoadLibraryA,GetProcAddress,_invalid_parameter_noinfo_noreturn,

3_2_010063B3

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE8581 mov eax, dword ptr fs:[00000030h]	8_2_00DE8581
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE4503 mov eax, dword ptr fs:[00000030h]	8_2_00DE4503
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B58581 mov eax, dword ptr fs:[00000030h]	9_2_00B58581
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B54503 mov eax, dword ptr fs:[00000030h]	9_2_00B54503
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E98581 mov eax, dword ptr fs:[00000030h]	10_2_00E98581
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E94503 mov eax, dword ptr fs:[00000030h]	10_2_00E94503
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D08581 mov eax, dword ptr fs:[00000030h]	15_2_00D08581
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D04503 mov eax, dword ptr fs:[00000030h]	15_2_00D04503

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DB3ADF GetProcessHeap,RtlFreeHeap,GetLastError,

8_2_00DB3ADF

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100A1D1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0100A1D1
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_0100A333 SetUnhandledExceptionFilter,	3_2_0100A333
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe	Code function: 3_2_01009E98 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_01009E98
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDE1B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00DDE1B8
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDE684 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00DDE684
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DE389A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00DE389A
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Code function: 8_2_00DDE817 SetUnhandledExceptionFilter,	8_2_00DDE817
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4E1B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00B4E1B8
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4E684 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B4E684
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B5389A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B5389A
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Code function: 9_2_00B4E817 SetUnhandledExceptionFilter,	9_2_00B4E817
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8E1B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00E8E1B8
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8E684 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00E8E684
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E9389A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00E9389A
Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 10_2_00E8E817 SetUnhandledExceptionFilter,	10_2_00E8E817
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFE1B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00CFE1B8
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFE684 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00CFE684
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00D0389A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00D0389A
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Code function: 15_2_00CFE817 SetUnhandledExceptionFilter,	15_2_00CFE817
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A8A1F SetUnhandledExceptionFilter,	29_2_004A8A1F
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe	Code function: 29_2_004A86C7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_004A86C7

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

File written: C:\Windows\System32\drivers\etc\hosts

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Code function: 37_2_00478DC4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

37_2_00478DC4

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 6.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Process created: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{4C86AD50-ECFF-4E0C-8859-69C2F732A1B6} {4190C1E9-DF0B-4777-B67E-25C22799E37B} 6884	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "c:\windows\temp\{833d38b6-ef1e-40e4-8c3b-08bef0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="c:\users\user\appdata\local\temp\is-clj4h.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "c:\users\user\appdata\local\temp\microsoft_windows_desktop_runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "c:\users\user\appdata\local\temp\microsoft_windows_desktop_runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "c:\windows\temp\{833d38b6-ef1e-40e4-8c3b-08bef0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="c:\users\user\appdata\local\temp\is-clj4h.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe	Process created: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe "c:\windows\temp\{833d38b6-ef1e-40e4-8c3b-08bef0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="c:\users\user\appdata\local\temp\is-clj4h.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "c:\users\user\appdata\local\temp\microsoft_windows_desktop_runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Process created: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe "c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="c:\programdata\package cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "c:\users\user\appdata\local\temp\microsoft_windows_desktop_runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DF1BB9 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

8_2_00DF1BB9

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DF3ED2 AllocateAndInitializeSid,CheckTokenMembership,

8_2_00DF3ED2

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_01009FF1 cpuid

3_2_01009FF1

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: GetLocaleInfoA,	36_2_0040520C
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe	Code function: GetLocaleInfoA,	36_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: GetLocaleInfoA,	37_2_00408578
Source: C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp	Code function: GetLocaleInfoA,	37_2_004085C4

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe	Queries volume information: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\twn4cdc.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\twn4cdc.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\zkfp.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpersona_x64.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DC4F5A ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

8_2_00DC4F5A

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Code function: 3_2_0100A3FD GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_0100A3FD

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DB623E GetUserNameW,GetLastError,

8_2_00DB623E

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DF8C56 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

8_2_00DF8C56

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe

Code function: 8_2_00DB520D GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

8_2_00DB520D

Source: C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe

File written: C:\Windows\System32\drivers\etc\hosts

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe" "2N USB Driver" DISABLE ALL

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8C18F347CF57959E4DD189A7D79464ED795064D6 Blob

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	4 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 File and Directory Permissions Modification	OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	2 Windows Service	1 DLL Side-Loading	211 Disable or Modify Tools	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Windows Service	3 Obfuscated Files or Information	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Install Root Certificate	LSA Secrets	37 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	3 Software Packing	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	21 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	31 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	132 Masquerading	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	31 Virtualization/Sandbox Evasion	Input Capture	3 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	12 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Regsvr32	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Rundll32	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2N Driver for External USB Readers.exe	0%	ReversingLabs
2N Driver for External USB Readers.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Hardcodet.NotifyIcon.Wpf.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Hardcodet.NotifyIcon.Wpf.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\NLog.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\NLog.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.IO.Ports.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.IO.Ports.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.Management.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.Management.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\WinUSBNet.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\WinUSBNet.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\Qt5Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\Qt5Core.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\dfutool.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\dfutool.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icudt53.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icudt53.dll (copy)	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://appsyndication.org/2006/appsynapplicationc:	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.globalsign.net/repository/03	0%	URL Reputation	safe
http://appsyndication.org/2006/appsyn	0%	URL Reputation	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://www.2n.cz1RZ	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository/0	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository09	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository/0	0%	Virustotal		Browse
http://www.2n.cz32	0%	Avira URL Cloud	safe
http://www.2n.cziRZ	0%	Avira URL Cloud	safe
http://crl.microsoft.	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository09	0%	Virustotal		Browse
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	Virustotal		Browse
http://secure.globalsign.net/cacert/PrimObject.crt0	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse
http://libusb-win32.sourceforge.netb	0%	Avira URL Cloud	safe
https://www.innosetup.com/	1%	Virustotal		Browse
http://libusb-win32.sourceforge.netN	0%	Avira URL Cloud	safe
http://crl.microsoft.	0%	Virustotal		Browse
http://secure.globalsign.net/cacert/PrimObject.crt0	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	System.IO.Compression.Native.dll.11.dr	false	Avira URL Cloud: safe	low
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	2N Driver for External USB Readers.exe	false		high
http://secure.globalsign.net/cacert/ObjectSign.crt09	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.2n.cz1RZ	2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010	dotnet60desktop.exe, 00000009.00000002.2708076898.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761380592.0000000003860000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	setup.exe, 00000024.00000002.3063856766.0000000000401000.00000020.00000001.01000000.00000018.sdmp	false		high
https://aka.ms/20-p2-rel-notes	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
https://aka.ms/dev-privacy	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=5.0	netcorecheck.exe, 00000003.00000002.2135554084.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-license-windows	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761380592.0000000003860000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
http://.css	System.IO.Compression.Native.dll.11.dr	false	Avira URL Cloud: safe	low
http://www.globalsign.net/repository/0	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html.	setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-core-applaunch?	netcorecheck.exe	false		high
http://www.openssl.org/support/faq.html	setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime	System.IO.FileSystem.AccessControl.dll.11.dr	false		high
https://aka.ms/dotnet-docs	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
https://aka.ms/vs/17/release/vc_redist.x64.exe	2N Driver for External USB Readers.exe, 00000000.00000003.3193501314.0000000002260000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2125775570.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000024F7000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.0000000003862000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.00000000038E4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crm.innovatrics.com	setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsynapplicationc:	dotnet60desktop.exe, 00000008.00000000.2400540946.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmp, dotnet60desktop.exe, 00000009.00000000.2402564744.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, dotnet60desktop.exe, 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000000.2408799844.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2428045478.000000000070B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2706196116.0000000000EAB000.00000002.00000001.01000000.0000000F.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000000.2555007939.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000F.00000002.2562073815.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000000.2556098265.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000002.2763904316.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000000.2560776999.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759042141.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000000.2659402740.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2753814866.0000000000D1B000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	false		high
http://standards.iso.org/iso/19770/-2/2015/sc0	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	2N Driver for External USB Readers.exe, 00000000.00000003.2127173120.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2127593853.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000000.2128996068.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.innosetup.com/	2N Driver for External USB Readers.exe, 00000000.00000003.2127173120.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2127593853.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000000.2128996068.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.globalsign.net/repository09	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=hXReading	netcorecheck.exe, 00000003.00000000.2134110976.0000000001010000.00000002.00000001.01000000.00000008.sdmp, netcorecheck.exe, 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmp	false		high
http://.jpg	System.IO.Compression.Native.dll.11.dr	false	Avira URL Cloud: safe	low
http://www.innosetup.com/	setup.tmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	false	URL Reputation: safe	unknown
http://www.2n.cz32	2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	dpinst.exe, 00000021.00000003.2778350520.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000003.2792320215.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2793695970.0000000000602000.00000004.00000020.00020000.00000000.sdmp, dpinst.exe, 00000021.00000002.2794625288.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005D01000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000003.3058605092.0000000005740000.00000004.00001000.00020000.00000000.sdmp, is-I03EA.tmp.37.dr	false	URL Reputation: safe	unknown
http://www.2n.cziRZ	2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000025A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	setup.exe, setup.exe, 00000024.00000002.3063856766.0000000000401000.00000020.00000001.01000000.00000018.sdmp	false		high
http://crl.microsoft.	drvinst.exe, 00000027.00000002.2892572494.00000240A8850000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2891246833.00000240A8850000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://standards.iso.org/iso/19770/-2/2015/schema.xsd	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760897614.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2562791382.000000000110D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752977068.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2754280071.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2660004896.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2753298811.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2660004896.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752630825.0000000003510000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	false	URL Reputation: safe	unknown
http://secure.globalsign.net/cacert/PrimObject.crt0	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dot.net/core7	windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000003.2704627944.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 0000000A.00000002.2705444131.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/psU	setup.exe, 00000024.00000003.2797211868.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000024.00000003.2797392558.00000000021BC000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	2N Driver for External USB Readers.tmp, 00000002.00000003.3171515255.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000002.3188302279.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-77UBH.tmp.2.dr	false	URL Reputation: safe	unknown
http://www.2n.cz	2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://libusb-win32.sourceforge.netb	drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/vs/17/release/vc_redist.x86.exe	2N Driver for External USB Readers.exe, 00000000.00000003.3193501314.0000000002260000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.exe, 00000000.00000003.2125775570.0000000002530000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3183334708.00000000024F7000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.2130779171.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.0000000003862000.00000004.00001000.00020000.00000000.sdmp, 2N Driver for External USB Readers.tmp, 00000002.00000003.3181172089.00000000038E4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/20-p2-rel-notesi	dotnet60desktop.exe, 00000009.00000002.2708114386.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-tutorials	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
https://dot.net/core	windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000003.2763134408.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000010.00000003.2761955887.000000000350A000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2753072927.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752283030.00000000038EA000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000003.2752630825.0000000003510000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000015.00000002.2754157109.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010Hd	dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	setup.exe, 00000024.00000003.2797211868.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000024.00000003.2797392558.00000000021BC000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, setup.tmp, 00000025.00000000.2797910641.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false	URL Reputation: safe	unknown
http://crm.innovatrics.com/	setup.tmp, 00000025.00000003.3058605092.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://libusb-win32.sourceforge.netN	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-cli-telemetry	dotnet60desktop.exe, 00000009.00000002.2708340549.0000000000709000.00000004.00000020.00020000.00000000.sdmp, dotnet60desktop.exe, 00000009.00000002.2709413064.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2761197407.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000112B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758490285.000000000110D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758490285.000000000112B000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2759309905.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758004763.0000000001142000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.0000000001142000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000002.2760318936.000000000111D000.00000004.00000020.00020000.00000000.sdmp, windowsdesktop-runtime-6.0.4-win-x86.exe, 00000011.00000003.2758696473.000000000111C000.00000004.00000020.00020000.00000000.sdmp, thm.wxl13.17.dr	false		high
https://dot.net/core2	dotnet60desktop.exe, 00000009.00000002.2708114386.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.globalsign.net/repository/03	rundll32.exe, 00000026.00000003.2894277733.000002CF4272E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882947095.00000240A87FE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886636864.00000240A87CC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886584676.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2886532790.00000240A8859000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000027.00000003.2882990701.00000240A87AD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://appsyndication.org/2006/appsyn	windowsdesktop-runtime-6.0.4-win-x86.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432058
Start date and time:	2024-04-26 11:12:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2N Driver for External USB Readers.exe
Detection:	SUS
Classification:	sus32.troj.adwa.evad.winEXE@95/1072@0/0
EGA Information:	Successful, ratio: 72.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 131 Number of non-executed functions: 290
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.215.201
Excluded domains from analysis (whitelisted): visualstudio.download.prss.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, download.visualstudio.microsoft.com, 4316b.wpc.azureedge.net, cs10.wpc.v0cdn.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, crt.sectigo.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target HostsHelper.exe, PID 4020 because it is empty
Execution Graph export aborted for target dpinst.exe, PID 5292 because there are no executed function
Execution Graph export aborted for target windowsdesktop-runtime-6.0.4-win-x86.exe, PID 5820 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:13:42	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {ff0d7b6b-8624-42f0-b961-69e6cbf896c1} "C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /burn.runonce
11:14:53	API Interceptor	1x Sleep call for process: 2N Driver for External USB Readers.tmp modified
11:14:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2N USBDrv "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe"
11:15:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2N USBDrv "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)	Salary and Benefits of Director & Digital Marketing position at Toshiba 2023.exe	Get hash	malicious	Unknown	Browse
	Salary and Benefits of Director & Digital Marketing position at Toshiba 2023.exe	Get hash	malicious	Unknown	Browse
	Income and Welfare - UNIQLO 2023.exe	Get hash	malicious	Unknown	Browse
	ist_2023.exe	Get hash	malicious	Unknown	Browse
	latest _ product _ list _ and _ digital _ development _ campaigns _ 2023. _ Exclusive_list_2023.exe	Get hash	malicious	Unknown	Browse
	ist_2023.exe	Get hash	malicious	Unknown	Browse
	latest _ product _ list _ and _ digital _ development _ campaigns _ 2023. _ Exclusive_list_2023.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\6df02c.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	58794
Entropy (8bit):	5.881918943380162
Encrypted:	false
SSDEEP:	384:WrG6UPkXyWS5MZG+nIIq+z5gKkcWl0JfMe7NaAXxaXLb2HYw26jkay8ECptDlAPG:WC1qyJkU+i7bL2z2cfabK2vdBO
MD5:	C68B8386E7460357A7C270E1D8B05C60
SHA1:	D168917AAB3CB8289D64641FB72F94434F232EB3
SHA-256:	95CDA00A5A6B1AAD4F4E79349561E7F201CFE2ADF91FC85CC1A09FC44B53212B
SHA-512:	DC244D56CF051D28409C57A357D8B086B54A3EFBDFB09644B0BEF1487C89574915FBB338E68470079F21BEEF9A4095D91E30040B68E9C71A9659A41364D54868
Malicious:	false
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}$.Microsoft .NET Runtime - 6.0.4 (x86) .dotnet-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{25B8B5B6-686E-443A-93DD-4A03FC1447F9}.....@.....@.....@.....@.......@.....@.....@.......@....$.Microsoft .NET Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E6B00585-4D7B-5E7C-8378-587BA69CA51D}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}.@......&.{E48FBEE2-D006-58C8-A411-AD76137F9680}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}.@......&.{6FB67732-B0AE-50FC-AE6A-9948E48725BC}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}.@......&.{09F06046-47D7-5314-A456-7B6A4B095B68}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}.@......&.{8D0D02F7-60B8-5591-ADFB-17C040DCB2A9}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}.@......&.{AC3F288D-3CD9-5062-99D7-5F763570C2CF}&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}

C:\Config.Msi\6df030.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9053
Entropy (8bit):	5.572653095824389
Encrypted:	false
SSDEEP:	96:SCwZaWGgHrzu1eSEjEkPUCxYeD20rCsThqZUCxYeD20rC6j/DElEXcueThq+HZuw:SVUKkef8CDWIHCDWb1E7A6NMpPO5M
MD5:	00D8EF315CEAA2B92CD1EA86CE0D2310
SHA1:	818214424AA8356C4909626DC1CEB8A4D47E0296
SHA-256:	A42C22E5F588B0271B3A6CBF4C028564B4F91BDC8D5586940F96D3995FF026D1
SHA-512:	7BB624C5F0DC31347FAE17AD4F47CB192303236FBB5F036B8A4A589302DBF720508EFE4B8FA1EFCC87B31761DBD5F92136651E57B24B28C8DCC88C245BB7A166
Malicious:	false
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{61373008-0285-40B8-93C2-26C8110BC4ED}-.Microsoft .NET Host FX Resolver - 6.0.4 (x86) .dotnet-hostfxr-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}.....@.....@.....@.....@.......@.....@.....@.......@....-.Microsoft .NET Host FX Resolver - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{8410E72E-06C1-5982-BC18-60D5E54D80E1}&.{61373008-0285-40B8-93C2-26C8110BC4ED}.@......&.{27E08BF7-EBE0-5965-9FA8-979FC11CF4DA}&.{61373008-0285-40B8-93C2-26C8110BC4ED}.@......&.{1D82A7DD-9994-5FAD-B0B5-FA93D2A54031}&.{61373008-0285-40B8-93C2-26C8110BC4ED}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..-.C:\Program Files (x86)\dotnet\host\fxr\6.0.4\....8.C:\Program Files (x86)\dotnet\host\fxr\6.0.4\hostfxr.dll....WriteRegistryValues..Writing system registry value

C:\Config.Msi\6df034.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10316
Entropy (8bit):	5.654802638524516
Encrypted:	false
SSDEEP:	96://JooI4Yc1tDbRkseirwPU/VeD2lrCsThqAU/VeD2lrC6jgZTReThqPH0woggE5k:/RnY68sen8DWIuDWeqgE0IoF6MpVp
MD5:	142F3EA230BE64615C9C1845D8EA86F6
SHA1:	CF284B87777E47A8B7A19EBAA374F0573CCA518F
SHA-256:	7D35ACF87EDF53F342C5A9858309A944AF7BB2D030593D30A865074FFB3C72A4
SHA-512:	0A314AE0F620E1C79005558C34D725D8D198E661BDC5EEE3657CB375F94D7221DE38102EB46E67310EADA04A825E5EC0B8A0B30D8D882632212CEF4445F4F00A
Malicious:	false
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}!.Microsoft .NET Host - 6.0.4 (x86)..dotnet-host-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}.....@.....@.....@.....@.......@.....@.....@.......@....!.Microsoft .NET Host - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3255E0B8-D6AE-5877-90FE-F3E586EF9630}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@......&.{45399BBB-DDA5-4386-A2E9-618FB3C54A18}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@......&.{152B8915-2DC8-5382-8A34-8078B67AF049}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@......&.{9687936A-DBE9-5D1A-9273-D5F54BA78702}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@......&.{ED78B8A3-BAC6-5230-B5D7-6015EBC9DD8B}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@......&.{A61CBE5B-1282-4F29-90AD-63597AA2372E}&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}.@.......

C:\Config.Msi\6df038.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	92778
Entropy (8bit):	5.759820310018754
Encrypted:	false
SSDEEP:	1536:Jo3TRV9t9bLjuHvKMzSKvvjZNKugndJc2:JgVf93juHvKMzSKjZNKX
MD5:	5840D3E15FA6694E7EA42F46BA4CE697
SHA1:	6024EA67D45B61147401FCF5CC4613F1609C0896
SHA-256:	5E4E4ECDC6003B2F6CD829942C22E9F945463DB9D9A8D30BB2EBFBDE4A6B44C9
SHA-512:	D0950635E3280D2176B02B727197E815EBC444CB47243EADFBAB917A2A8357DD971E128BDB5E5B9E1F9237B752E98927758A2204B72B566597329055468CBBE1
Malicious:	false
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{28F5CA46-286A-4C61-A86E-525F06E456DD}/.Microsoft Windows Desktop Runtime - 6.0.4 (x86)(.windowsdesktop-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{951FC065-6FC2-4A32-9FB6-99EEDC7A8096}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Windows Desktop Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E4B9D2D6-B557-5F11-BD49-C6B7B383D40E}&.{28F5CA46-286A-4C61-A86E-525F06E456DD}.@......&.{9D9C7ACF-CBD3-5C49-B11B-728FF6923F63}&.{28F5CA46-286A-4C61-A86E-525F06E456DD}.@......&.{4139925B-D4C4-592F-A382-33888E016212}&.{28F5CA46-286A-4C61-A86E-525F06E456DD}.@......&.{121F57F5-49B6-5F3A-ADB4-393E67972A38}&.{28F5CA46-286A-4C61-A86E-525F06E456DD}.@......&.{B34E1E14-3FD5-54E1-A1BA-C5BCBB44BB37}&.{28F5CA46-286A-4C61-A86E-525F06E456DD}.@......&.{F33B9112-46E1-5AC6-93A7-F8E1F619B4C3}&.{28F5CA4

C:\Config.Msi\6df03b.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3881
Entropy (8bit):	5.05933158318848
Encrypted:	false
SSDEEP:	96:G1ZvmEYe4JtThqF2JL/aThqFi/DWJiFQly:GHmle+87z
MD5:	F23642223DE082EB7BC3F48F37282193
SHA1:	FF646AC385EDD3FA3B3B9980DF195E3842ED6AC3
SHA-256:	02D909CD9C966F4DDF907B5BDEE21A356500FD35A7EB380E016251521CC1B6CA
SHA-512:	95D15DE826934FBCFBD65CD9CEFE0B322AFD0AAA5C162A9973616504608EC2E3FE71AB832A4EA2132396F714547A013E7E31E6D6EA63ACFA711F2E139B0E7718
Malicious:	false
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{28F5CA46-286A-4C61-A86E-525F06E456DD}/.Microsoft Windows Desktop Runtime - 6.0.4 (x86)(.windowsdesktop-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{951FC065-6FC2-4A32-9FB6-99EEDC7A8096}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Windows Desktop Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\64AC5F82A68216C48AE625F5604E65DD\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!................... ...!.......?........... ... ................... ... .......?.......................................?..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96416
Entropy (8bit):	5.814764412132972
Encrypted:	false
SSDEEP:	1536:6p/h5hiWhKqUknSxQLwSAYGBHOtGtu9wiD+/f+53m0zzGCuvAfwg21WjMAFSIrtl:q/h5hiWhK5QLwSAY7tGtuSiD+/f+53m+
MD5:	A3DED3E465EE66638583C397951153DA
SHA1:	CA0BCCFC25059ED231F5A9E08EFDD86B43E5A5B2
SHA-256:	7A0B766551344070D45DC7557C45CD6786B35B23562E215C32186014ABDE6420
SHA-512:	F745062F7D631D73D051788119F0310374A5592069ED5F68454063D66D3AF8E6DFEB1B6E1DE4455DBDB5D7DF2EC938D4FE1E9B0FFAB020111D7D5330F46DDBC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.............!..0..L...........k... ........... ...............................Q....`.................................2k..O.......@............V..."...........j..T............................................ ............... ..H............text....K... ...L.................. ..`.rsrc...@............N..............@..@.reloc...............T..............@..B................fk......H.......t.................................................................{...."..}......b.(......(.........(........0..?........(............+....(..........r...p(.......X....i2.r...p.(....Z.{....,..{....o.......{...."..}....*..0...........s....% ....r...po....% ....rI..po....% ....r\|..po....% ....r-..po....% ....rg..po....% ....r...po....% ....r...po....% ....r...po....% ....rf..po....% ....r...po....% "...r ..po....% (...r...po....% :...r...po....% <...r...po....%

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3318504
Entropy (8bit):	6.537564216608803
Encrypted:	false
SSDEEP:	49152:C50b59Aj1ZLCpTT2TzAOeJ+KaGxHIkMNqo5wW0DlI6eujzc3:y0b3AjaFZE5WIR3
MD5:	9FE1A31FDC7B67F5480E936D359EF6C3
SHA1:	576269A42C0991E90F5E83C8205EB808D7B4D3BA
SHA-256:	F42B8609854D80D7F81F276340504AA5E82BBE4D73D05080FEF1FCCA2444B4D5
SHA-512:	7B7CAE9FC0AFCCEE7533971F97AF11E5DEDB54775BBFE45AD94B82BFDA6122E65FB378BD27B2390BFE45AF89438DBB550171F6939FEBCF742034A405B49339A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Salary and Benefits of Director & Digital Marketing position at Toshiba 2023.exe, Detection: malicious, Browse Filename: Salary and Benefits of Director & Digital Marketing position at Toshiba 2023.exe, Detection: malicious, Browse Filename: Income and Welfare - UNIQLO 2023.exe, Detection: malicious, Browse Filename: ist_2023.exe, Detection: malicious, Browse Filename: latest _ product _ list _ and _ digital _ development _ campaigns _ 2023. _ Exclusive_list_2023.exe, Detection: malicious, Browse Filename: ist_2023.exe, Detection: malicious, Browse Filename: latest _ product _ list _ and _ digital _ development _ campaigns _ 2023. _ Exclusive_list_2023.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..x2..........-1.. ....2...... ........................2......H3...`.................................G-1.O.....2...............2.. ....2.....\|.(.p............................................ ............... ..H............text....w2.. ...x2................. ..`.rsrc.........2......z2.............@..@.reloc........2.......2.............@..B................{-1.....H.......T.........................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s',..%..(.... ....o.....o.0...Zo....t....o5(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............R....r...p.(L....o$....(......0..I.......sD...s?)..s.(..s.(...(....s3(....,..o%....2...(....sS(....+.....%..ou.....( .....( ...*n .....S...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52384
Entropy (8bit):	6.11801318556494
Encrypted:	false
SSDEEP:	1536:AQQdCBc12gy6/5X20qI0YyYYYJuh51oa34ikD:KIS2gpBzYoa34f
MD5:	FEB4F49C614DBAD708CC956B065F4E4B
SHA1:	8ABD030854FAFB30583924449BBA7871F0D2F7A5
SHA-256:	C1C92EC40D704C37E501F33434E2C8946851FAD49719FBD32551D0AC1BF03E98
SHA-512:	F3628FB1938FAC05689B124F8CA9446C619BA86C0B85307F0FD8E0F20BDA8A26E559AC25C9381C33D4D8B2D85B4AEDA431CA4927CB15DE1F8F446A48248085B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...RG.............!..0.............~.... ........... ....................... .......Y....`.................................)...O........................"..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................].......H........J..\t............................................................(...."..(....&...(....:~.......o....:~.......o....:~.......o....:~.......o......(....r......~g.........s..........0..r........(......r...p(....-6.r...p(....-1.r...p(....-$.r...p(....-..r...p(....-.+...(............(.....(.... ....s....z...0..o........o....r=..p..o....,...o....ri..p..o....,...o....r...po....,.r...p.o....,..o....o....r...po....,.r...pr...p..(......(...."..(....&...(...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Hardcodet.NotifyIcon.Wpf.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	112288
Entropy (8bit):	7.3744416208676125
Encrypted:	false
SSDEEP:	3072:hoy+75OQW4pg9xXsGQTckaX4kGsdO5UInM34J4W:h+75ON4pg9xX7kzsTInM0d
MD5:	CE14C1C067D2FF50E477B93C98F91617
SHA1:	B3F5E796B259CF716D4D2B0F639B1C624F7F9F5B
SHA-256:	38158D385A361D9C2C7CD02C37D4B394E975952D3B5259349257A882CA095E33
SHA-512:	C133E34A29478F15AC4A5C9CBCF970CC3D2E40DFCA70D3BBA0F0A6E695A89F268EAB779A27B72010CC622581C1C4073F160A1FB57283B60D8CBD4942A2B9FFF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k9..........." ..0.................. ........... ..............................".....`....................................O........................"..........8...p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........O...y..........................................................V!.)1......s............0..$........u......,...o ....u......,...o!....0..&........u......,....o"....u......,....o#......0..&........u......,....o$....u......,....o%...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....(&.....(......,..o'...-..,..o(...-..,..o'.........0...........s)...}.....(*....(....-..s....+.(....}......{....o....(....}.....(!....{...........s+...o.....{....

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38048
Entropy (8bit):	6.0349304307729446
Encrypted:	false
SSDEEP:	768:1vMZWLY1CHsUy65HWiND4VTt/cQT8iRIflEl:1vMZWLY1CHsg5HW5Tt/cQ4ikY
MD5:	7BC94837D5A084F87F4F9DC139DEE02E
SHA1:	F45C15F779635C380E2A91378E85D0DFB2443F34
SHA-256:	426A2FACBE8BAD30D8DCF99407928EE21D0826988E7A983C2F5D25B1320E11E1
SHA-512:	8802420C0BD27F42BFA2E607C60919CCAC098671A129BC8453D54596D7157CE271774F66433509DFC2B9ACC0A373F8BC39A84DC8C403FAF30A5AA04B410F2852
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X.e...........!.....j.............. ........@.. ..............................m.....@.....................................K....................r..."........................................................... ............... ..H............text....h... ...j.................. ..`.rsrc................l..............@..@.reloc...............p..............@..B........................H........5...R...........................................................0.."...........{....9........{........o-......0.."...........{....9........{........o/......0..&...........{....9........{............o1......0..&...........{....9........{............o3......0.."...........{....9........{........o5......0.."...........{....9........{........o7......0..............{....9........{....o9......0..............{....9........{....o;......0.."...........{....9..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\NLog.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832160
Entropy (8bit):	6.054900928427106
Encrypted:	false
SSDEEP:	24576:VlXVFlXtxdndFtkWKEMGP1Cx567XjNXEHfUsQD:VlXVFlXtxdndFtvK69sCNEHM
MD5:	69E48091D117F2DF5AE913F028A34FDF
SHA1:	556A8DCA36CA234349DB0A6D37755738594E5005
SHA-256:	79419D9F45A4A46569F5D1E7126E0EE0BF0E5C411FB79F0F94CCB8EA2AE92D91
SHA-512:	0D2FD68C48381458C2E200BA54E5AC4EFD156F1ED4C13EDF67DD84CBDD533221B1DAD598E621E4C71AF8263B8A88B453EEB951D9F82BEE648C3EC5669FFC86BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0.............2.... ........... ....................................@....................................O.......$................"..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H.......,.............................................................."..(......(...."..(......(......(......(.....(...."..(.......0..B.......~..........(T...~....,.~.....oU......+...(......oV......,..(W............../7......"..(....6.(.....(S.....0..........(.......oX...&..(....oY...2(.....oU.......0..?.......~..........(T...~....,.~.....oU...+...(.....oZ...&...,..(W....*.........,4.......0..?.......~..........(T...~....,.~....o[......+...(....o\......,..(W..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	696480
Entropy (8bit):	5.95766682005451
Encrypted:	false
SSDEEP:	12288:oeos/POdGV5jfWrV/9Yeh9eRcyLfLYtT5mWxTZ/B7jW5JMtRRpKzQWFE:o0/POdGV5jfW5VnhFyvOB7jW5JMth
MD5:	87A168A7304002ED2A6B70063973BD96
SHA1:	650B2A599AACE164F8412CD47E4C5CE834C5F556
SHA-256:	A22DCFCBBCB0B939464658CD2CDF745B724D7C0C6E0A6E19C600A7110EAF67CC
SHA-512:	36D6AC0AAFD929C27F9EB21B894F50E4DFF1EF4F4D1A51333A31C3CD62AAAED459EFFA23F12B3C3878A74B6D79C9B704C07D88C1B2A4185A5FC19ECC6206C9A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..t..........N.... ........... ....................................`.....................................O....................~...".......... ...T............................................ ............... ..H............text....s... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................-.......H........p................................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{Z....3...{Y......(....,...{Y.....{[.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36000
Entropy (8bit):	6.388090425137777
Encrypted:	false
SSDEEP:	768:YIenkEitPUUTsh2YKI7yR+VBYdf3T8iRIflEQYlZI:incRUUfU2eBYdf34ikZYXI
MD5:	BC390A46DB77DB14EE09537D474BDA67
SHA1:	EC4EC0AD44471B6C81A380CCB3A50B9608A46E06
SHA-256:	8CA0C48E0B3EB8B4BCF6483E21A30C94F4BCA86784963B61ADFFF5E9A9539A8C
SHA-512:	DAD7C4FB1D9FAC3888DE3CD354696B779ABF85847A7808BD94B65B8D93ED084E7BE6FA9D5CBD17C213E65FA5FE04A3512C7C218C4BE96218DACF7B31344CB2FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.z............!..0..b............... ........... ...............................P....`.................................<...O....................j..."..........0...T............................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............h..............@..B................p.......H.......P4...K..................................................................("....s.........~r...p(#........~....s$..........{...."..}......{...."..}.....s....%.(....(....o....%.(....(....o.....s....%.o....(....o....%.o....(....o....F.(%...o&...o'...F.((...o&...o'...j.()...u....%-.r...ps...zj.(+...u....%-.rk..ps...z..0..<........o,...o-...o.....[..o/...o0...o1....o/...o2...o1......(....*.0..;........o3.....o3......Z.G..........iY..i(4..........iYX..i(4..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33440
Entropy (8bit):	6.3806463027161575
Encrypted:	false
SSDEEP:	768:qZbQYJtpyQm9ebRZ6UyeSPpXf2zoWT8iRIflEolc:q6YJtpyQm9edwDeuhkoW4iknc
MD5:	B36561B05981CF8CAED8264942CE02D7
SHA1:	72ABB3E7AFD04857925F471B850906001315CE88
SHA-256:	5DE2777B0044A6D5658279A324578EC9933ABD884093B92096ED043B39FCE7B0
SHA-512:	6429B9D8690629321B16EB2DCE548D77FEA3D3456DA40E42B37A8F98672CA20E63C22E64454E0D3F70A6E346C3A74233D969C94CCBEA9C95777B025DFBC4DB87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}v.............!..0..X...........u... ........... ....................................`..................................u..O....................`..."...........t..T............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................u......H........9...:..........................................................j.(......}......(....}....V.(......}......}........0..Q........(......~....o....-+.....(......r...p(.......(...+..(....s....z.....(....%.o........0............i.h..rA..ps....zs .......(...+.(...+(...+o$.....(...+(...+..{........o%.....o&...(....%..(...+(...+...(...+(...+.....(....(...+....{.......(....o'.....(.........o.......o(...o)......o...o+....N.o,....(...+.(...+.0.............(....-.rQ..ps/...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124576
Entropy (8bit):	6.118428590777471
Encrypted:	false
SSDEEP:	3072:bDmG4Rq9heQzRAcHQwc/LF7K9gl22rabKc0hYxqB465p4A:fmkaxL09/2rabx0hNPnv
MD5:	C67D961EC6B42CC9D651C8CF79E1447A
SHA1:	1FE52853A6D1801E7423968647FBFE547FE53423
SHA-256:	055379D4407903B2869399818ACF1E6C802939E5CBA1431C89B6C8768A760D7E
SHA-512:	A0BD076CD1B52618D00B9CE9712A53C406019FE310F71EEE2DB611DDDB0ACF7A34FB26FC21A96392FBE52E03E5058C7A070379DEAF5EFA4E97CEB8409C619BB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....z............!..0.................. ........... ....................... ......&.....`.................................\...O.......l................"..........T...T............................................ ............... ..H............text....... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.........................................................................{....:.(#.....}....:.($.....}.......0..7.........(%...}.......}.......}......\|......(...+..\|....('....((........V.($.....}......}........0..?.........()...}.......}.......}.......}......\|......(...+..\|....(+.....0..7.........(,...} ......}!......}......\| .....(...+..\| ...(......0..7.........(/...}4......}5......}3.....\|4.....(...+..\|4...(1...*..0..?.........(2...}.......}.......}.......}......\|.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\ServerSSL.pfx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	3205
Entropy (8bit):	7.924304525326202
Encrypted:	false
SSDEEP:	96:QCmEKblDHNBC/WXlDXT3nFObolTX0tPQYjk:QCPKJpUuXl0bIbyYGk
MD5:	EEDDD3BCA0DEFF0EECDA991B7CCA3583
SHA1:	C0A06C1D2010FA03C2D32E13FAB48D4AA527FDB0
SHA-256:	5AE14C55931772FDEA3E9E569969FCC7FF7B4B14C63135FD85953160481889D2
SHA-512:	1EF419DFB47C73049BC6B35CC9C74CAA434E04CB62623AB1A5B2137CB98119DFD928A51E194440F0A7FEF68A252B667C43121ED091DF5C27DE109FB9FA862078
Malicious:	false
Preview:	0......0..G...H.........8...40..00......H..........0......0......H......0....H.......0...C\ju............m)K..;.s.R.MC..t}.Y..."a..V!.Tz..h...0$..Ah.3\|.b...W....a...O..x.E;r.?.....v8...N..U....U..)..:...A...V9.v..?..vl.........X.L.&...t..E.IX.........m.+...3H#.c.....m .D..B..."...M.a._j>.....<J8.R#...\.B..I..q.....P...v@c<Z.....x..W<...nR...U.W..%..~....N..e....g...d....PPy.9....}...._X.m.W\.....O<.\#....^.^.kgs.h....o...R...2h.!x.Z.../p..?..c.I.#.r.mU~..RTu.i.q.\.{q.V{......"i...}.p......1..b.R....bo.Do....mLE...e...y.+.....?q....W<...+..8...\|........,G.b\|.'}.y6.:. .7...H.-......K#V.W....J.Z.&.-..g..:t.....c..m..v.].._Y.s.:..2.......Z...........QX...E1.2zl..m.6...3..C{.......D.KE.......C.H"._....4M..+E.E.(./.~l,=..cc}O...T.:B.6.s,.D.M.X.l....ZG...,..._....9V....vy..A.[,IC..'.W....e%w..x...}#.....P?.......^...AwM....TcIe&`.8.N12.-..q.......Q.%\|.1...1....p.'0.\Sl...........N.i....~@...3f!..Q.?..&7..~V.w.xR5.....x.._....q.-Z.+...F.{.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.IO.Ports.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75368
Entropy (8bit):	6.120190176890648
Encrypted:	false
SSDEEP:	1536:K8MCfU7Zal7pxs6qPS/YdMM9pGtxNmdBzy/ILn1gtUcMaY:TMCfU7ZaFpdYKtvm7n2tUcr
MD5:	D11BE1055DE8BA1EB6243E886BFD40EA
SHA1:	FF9B64D077634424EE20F0C6066DB79904964015
SHA-256:	D78E036AED15D626E19EA492E5DEDBF71063BB7086B05AD5954D358D2868B0DA
SHA-512:	6120F48AA8CEF6AC88CD4232692792540B2DA26ECD388CB5045BB30333DB323E546115EB7B29172A4D971D5363F9BF43E8C43216BC268736CF66FFF3CAA8420B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ... ....... .......................`...........`.....................................O.... ..................h$...@..........T............................................ ............... ..H............text... .... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......$d.................X...h.........................................(....^.(.......C...%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&.................'....0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........( .....,&(....,..r...pr...p.(....(!.....(".....(....,.r...p......%...%...(.......(#...*.(...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\System.Management.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294560
Entropy (8bit):	6.029783979142562
Encrypted:	false
SSDEEP:	6144:8v02WtKbuJp7Ki4vZW02XcEYBkODqxK+vZc3TaPod+HMMAcdvcXU:8v02EKbuJci4vZWZXSBkODqA+vZc3cjH
MD5:	300903D6AB684DF82494FCC366C13CBE
SHA1:	B869EF3612C820E44D07EC12311A0624D3D63CFC
SHA-256:	28751F0717AE3A187C008AE8954C355CB58BDE968514578B69B6E5D6468F7C4B
SHA-512:	4FE4FB5864AAC06314D04C415775573E85DCDBA86DFDE84E74B1DC1C76ABC5386D939BE8AF8C0C891C5FBCDF6FABCCCD8B152AFC0794790DDA97FE006133C125
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..R..........6p... ........... ....................................`..................................o..O.......d............\..."...........n..T............................................ ............... ..H............text...<P... ...R.................. ..`.rsrc...d............T..............@..@.reloc...............Z..............@..B.................p......H........'...............D...)..tn.......................................~......0..1.......(....,..%-.&...(.....o$......&...,...o%...,.......................(....,.r...p......%...%...(&.....('....(....,.r...p......%...%...%...(&......((....(....,!r...p......%...%...%...%...(&.......().....,&(....,..r...pr...p.(&...(.....(+.....(....,.r...p......%...%...(&......(,....(....,.r...p......%...%...%...(&.......(-....(....,"r...p......%...%...%...%....(&...*......(

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.deps.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	13083
Entropy (8bit):	5.116159540606374
Encrypted:	false
SSDEEP:	96:aD+R8/yM3SM+F9fpE4yn31sF13A+9PHh7hgpCfudFod7HLcfXfEKfdSRAYQdQSn7:aSRwi9RksT3T1HhtgvCs7zqfue5W
MD5:	A36EBC6DA1EC79E78E8776AB4DDB0854
SHA1:	9297394C656FA8B2DF5C62DEACC662D4D6E54931
SHA-256:	B1430BC89035E378481186CB09FF4BC41E078BCD66B3675DAB9D3D4A67D99B4C
SHA-512:	C741A7EC966AE0165105FE92FB8E78F2F191A1833DFE53D978D0FADF6E0481EB35A108CD5CB5B37C8A9DBBED9055EBFF48C3BA2CD2E7FAB84261F88285F11020
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x86",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x86": {.. "Usbdrv/1.2.3": {.. "dependencies": {.. "BgApiDriver": "1.0.0",.. "Fleck": "1.0.0",.. "Hardcodet.NotifyIcon.Wpf": "1.1.0",.. "Microsoft.CSharp": "4.7.0",.. "NLog": "4.7.15",.. "Newtonsoft.Json": "13.0.1",.. "Nn.Rfid.Encryption": "1.1.0",.. "Nn.Rfid.Twn4": "1.0.0",.. "WinUSBNet": "2.1.0",.. "Interop.ZKFPEngXControl": "4.0.0.0".. },.. "runtime": {.. "Usbdrv.dll": {}.. }.. },.. "Hardcodet.NotifyIcon.Wpf/1.1.0": {.. "runtime": {.. "lib/net5.0-windows7.0/Hardcodet.NotifyIcon.Wpf.dll": {.. "assemblyVersion": "1.1.0.0",.. "fileVersion": "1.1.0.17".. }.. }.. },.. "Micr

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	552448
Entropy (8bit):	6.381340141867444
Encrypted:	false
SSDEEP:	6144:0LmQbWbq4HNhmSZ1jGtZv7IF9LouF9LNzSZ1LGtVvn:NNXnGtZvWoYNO3GtVv
MD5:	525FCF89423D881E317A42269FA90810
SHA1:	12A0ABDF9EBF3490DF6B5877B1AC2EB393D27F51
SHA-256:	21B36D57B52B6A667C6B137624B48858828744725841459FB512D27A97925CFF
SHA-512:	567ECA06F111611FEB68C6337D9C9601970556F8DB3AB684223F894FA08724E9D54B4CB2C854E2473A60A1BE3A921334593AEA9EE57CE0F49F52AA37FBEF373B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h.T...............0.................. ........@.. ....................................`.................................7...O...................................$...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............l..............@..B................k.......H.......T....!..............H.............................................("...^.("..........%...}....:.(".....}....:.(".....}......(#......0..`.......~....~@...%-.&~?.....,...s$...%.@...o%...(&..........s'...o(.....r...p..s)...}.....-:..}....~....rK..po...r...pr...p(+...r...p...(,...&.(-...*..(......r...p(/...t....}.....r...pr...pr...p(+...(.....st...}.....{...........s0...op....{...........s0...on....{...........s1...or....{....o......{....o2...t ...}.....{...........

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.007806094869997
Encrypted:	false
SSDEEP:	6:TMVLcIjkfVymRMT4/0xvFM7VJdfEyFRLeSDuACQIjn:TMV9ofVymhsvF+rLeSD9Cxj
MD5:	670DEFF21BAD1E5A1AF349B8ED395D68
SHA1:	B8A686E0F05683357DF61007D3CF0E719DBFDEF1
SHA-256:	CC3E314D9B4B8C9D3F82A223D52B001627C84A1E74B444915B133B7772753C53
SHA-512:	9C3701C5744DD4477DEDFD53A56268AAF6D44638EEB61436AD0234E11F30614FF52BEAAE626AEDB43D2366A5E29663B1A759CD5F1A963C448915C6332F2642C0
Malicious:	false
Preview:	<?xml version="1.0"?>.<configuration>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1"/>. </startup>.</configuration>.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296096
Entropy (8bit):	6.307116291559023
Encrypted:	false
SSDEEP:	3072:6z6SAVyxY+XWso4LQyMBPyWv6lSER9lSDOS1oO894CEJVGsSScueTSHLXyd7aU4J:6IVyJ/El94EEdSZ1EGtZv7E7aU6
MD5:	013C1C676A26176DFBBB788518970351
SHA1:	7759D0A79894A868E3D6631DA2C1EE97A83FB3FB
SHA-256:	15A1224C71D46FC68C791276DB65E2A03B61FD239F676BD1929BB89A3EA24A69
SHA-512:	AC8A0FB1DECC751AE7C78244B872951FABD7F2CFEF0C330307170C912F21EC6E38A1477DEF818DBCE8DED381EB57339F5B6076C423D056D30FA119EC3254DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{.....................................U.............:......:......Rich............PE..L...}.wc.................0...................@....@.......................................@.................................@........................b..."...p..p...`...T...............................@............@...............................text..../.......0.................. ..`.rdata..vj...@...l...4..............@..@.data...x...........................@....rsrc...............................@..@.reloc..p....p.......P..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.runtimeconfig.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.427922197527517
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkI/X5BXmJe5S1sHRvXmJbJccVHdS1sHNAQ6NOCUo+K8EkNTy:dFk2BEe01sxvEbJc11slex+K8Es2
MD5:	D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA1:	04855D8B7A76B7EC74633043EF9986D4500CA63C
SHA-256:	1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
SHA-512:	09A9667D4F4622817116C8BC27D3D481D5D160380A2E19B8944BDD1271A83F718415CE5E6D66E82E36819E575EC1B55F19C45213E0013B877B8D61E6FEB9D998
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "frameworks": [.. {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.0".. },.. {.. "name": "Microsoft.WindowsDesktop.App",.. "version": "6.0.0".. }.. ],.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\WinUSBNet.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.5337274220648895
Encrypted:	false
SSDEEP:	768:rjmxwdovXxJgAp2oEm65v+atLdrVxFpq5CrYv18iJ45:rjKwdovd2omBrVxFp8CrYvWi25
MD5:	B4A30BB2AE2E0A1B6A9BF6C0DFA40C53
SHA1:	5DF6CBEFB8988C593F3B1D54F1F00F9B263299E5
SHA-256:	A394CAD8E366BA080DB69AD7A630D456796E6FED4FE0F94DA30E2895BE884707
SHA-512:	EF7A738D50547A88D4EFFDF23F8FE21C2DD46964E4E55552BC0D7C8C091B68046D6ECE354F8969B8EBE90D2035D368CF24523C90F5E8A153F9784B933B7B77D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D..........." ..0.................. ........... ....................... ............`.....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......hI..d~............................................................(......}............s....o............s....o......}....r.(......}......(......}......0............o.......(.........................0..#........t....o.......(.......r...p.s_...z..................0...........(.......r}..p.s_...z...................0..B.........(.....{....~....(....,..{....(.....~....}......{.....\|....(......{....~....(....,..{....(.....~....}....*.0..8........(...... ....... ....3..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\Qt5Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4849024
Entropy (8bit):	6.686967701781233
Encrypted:	false
SSDEEP:	98304:8h4ARXH2lONSEHe5PoNHrddSDrkY/pJcCyd6H3dIUcwvY65CEJsv6tWKFdu9C3z:ExWgoEYgFykYx+x69Y65CEJsv6tWKFdl
MD5:	CCC123CF19CA3653727A23D0F65B70B7
SHA1:	3FB31C1D7235D526B6C03C04330F26020D926112
SHA-256:	3CCACF492BA09DDCB732BBEF67176C2E03185AEE68975B984ACFD06564406E81
SHA-512:	04D3AA40E72FA8AA262CDA6B1DE403DE9F8CFAEFA3DA2CA9EA414668A3A97258EA7D22F9488A174538FBC019F2196E1744EB64121765B9FA1B90B6389969F99E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._gzw...........#.....x...I..@.. .............h.........................`J.......J....... .......................D.4.....H. +... I.\|.............I..I...0I..'............................I.......................H..............................text....w......x.................`.P`.data... ...........\|.............@.p..rdata..d.........................@.p@.eh_fram.....p=......H=.............@.0@.bss....p>....D.......................p..edata..4.....D......fD.............@.0@.idata.. +....H..,...XH.............@.0..CRT....,.....I.......H.............@.0..tls.... .....I.......H.............@.0..rsrc...\|.... I.......H.............@.0..reloc...'...0I..(....H.............@.0B........................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\dfutool.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	184192
Entropy (8bit):	6.564857648865079
Encrypted:	false
SSDEEP:	3072:lpvm7+Lwyop9sa7SwQBzLFCVVce67F+n2wAeNb3Px:7vi+Lwyop9IxBgclQJ
MD5:	5537F2A0EE708E2F3DB0D04AD4E27A6B
SHA1:	F0EE354EFB9621DDF8D917D71BA81ADEA043FFA9
SHA-256:	9BF0A51293C5A154D6BEC8B63C2C48986819BEC6A8B3DAAC28C9A9739A8BA5AD
SHA-512:	4B003E7A7AD133C613C3BF2AF23268EB3E4E3BB33128A09D045CACB87AC3DCD6D622280C7A1B4505E92F8E62A0E22402556DA8B78B0E44B745DC8B5724BCDC5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................................L................@.......................... ................ .................................`........................I..............................................................\|............................text...............................`.P`.data...............................@.`..rdata...h.......j..................@.`@.eh_framt....p.......N..............@.0@.bss.....J............................p..idata..`............l..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\fw.hex (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	360492
Entropy (8bit):	3.709402931530518
Encrypted:	false
SSDEEP:	1536:Zkvfa2Cg04eg/IZrfxTmDQRSjowGTVWLMRf07GnA8f/xgX5PYsNUh//55o0+VYYJ:WzqgAG0sMhbvsMweGPT67nRCQ2FbyGh
MD5:	C26743E3AB4435DE51411A27F44DBE87
SHA1:	9010ADC3C3B4DFAD3760CA73169BF507B9A2BE9A
SHA-256:	AE7001224FED87F4F7EF879F117688523B463374A7CCEF5500ED0055D8432A0B
SHA-512:	F2D6D0BEB4F18806C927D6668B6C12A14755B05876FD2187F46A76A62BC29262385C7CB5DA4B62B461B7563E20E5E6182D3A280A539797277CCA08C942887B1F
Malicious:	false
Preview:	:020000040000fa.:100000000200d2021003000000000002100b0000ea.:10001000000000021013000000000002101b00008e.:10002000000000021023000000000002102b00005e.:10003000000000021033000000000002103b00002e.:10004000000000021043000000000002104b0000fe.:10005000000000021053000000000002105b0000ce.:10006000000000021063000000000002106b00009e.:10007000000000021073000000000002107b00006e.:10008000000000021083000000000002108b00003e.:10009000000000020da7e490000278a4790180021c.:1000a000f0a3d8fcd9fa7aa57b009000e47809790e.:1000b000018015e493a3ad82ae838a828b83f0a383.:1000c000aa82ab838d828e83d8e9d9e71203b1125d.:1000d0000dc675d00075813f751c8075931e5392b7.:1000e000fe0200960010000000000200bb0102e7c3.:1000f00022c0925392fec082c08389828a83bb0051.:1001000003e08002e493d083d082d09222bb00151a.:10011000c0925392fec082c0838a838982f0d083ca.:10012000d082d09222bb0101f722cac0e0e6f309d7.:1001300008dafad0e0fa22cac0e0e0f208a3dafa5c.:10014000d0e0fa22600c08c6c313c618c613c6d581.:10015000e0f422700422600d18c6c333c608c6330b.:10016000c6d5e0f

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icudt53.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21584688
Entropy (8bit):	6.003313130158807
Encrypted:	false
SSDEEP:	393216:DcxR9BSqChVx7jMsPO2GHr//7PiI27gY4L+h9qU4u6Byw6:YhG3
MD5:	26C494DD41BA009DD5F8718FC4EDD3FF
SHA1:	9C02E13C1D581CC96162E778324794048BBA1144
SHA-256:	2FF5624AEBE6596390A6CE38F01D0ED2AC43701A29D6375B0E26613CCA96ACDF
SHA-512:	AC2CE616D18589E016C5C0FD83BB6154FCA7AB591AAF259334CFEF924A409E5D9EB4C591DAEEE0B2CEFCAE04BC4ECB666CD80C378C96D4E19041AA4508017130
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....EJ...H.M......!..........H..... ........0....Pf..........................I.....+fI....... .......................H.J.....I.......................I.xI...0I.............................. I.......................I..............................text...4...........................`.P`.data........0......................@.0..rodata..uH..@...vH.................@.P..rdata........H.......H.............@.0@/4......8.....H.......H.............@.0@.bss..........H.......................`..edata..J.....H.......H.............@.0@.idata........I.......H.............@.0..CRT....,.....I.......H.............@.0..tls.... .... I.......H.............@.0..reloc.......0I.......H.............@.0B/14.....8....@I.......H.............@.@B/29.....r....PI.......H.............@..B/41..........`I.......H.............@..B/55..........pI.......H.............@..B/67.....8.....I.......H.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icuin53.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3777624
Entropy (8bit):	6.462153902775358
Encrypted:	false
SSDEEP:	49152:GCIfS372mRH1lf4jN11dyBSqN/YOt2fsAgudMpSGmDaJazpNq:MfSLtH1lfEN1ewOAfszuOMDsSpo
MD5:	33A6EEACCB5F71AC2DBC68712191F83A
SHA1:	186A0D150D5C952681018959A5F9E62119675F7D
SHA-256:	9AE998F9BE96EA618EF3D66EAEDFBC0C1B7A3D0AC35DDE2237FC10E92843CFB6
SHA-512:	A754CD8C1BC60F5ED0E7956AECA05873F7E23F40D80159265D7E4F4231A6E4ADE519225CBDBBF636C20F485D6D39C2EAAC9AFF7800E27E081ABA7CFABB88A839
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........j_.....!.....$....)..... ........@.....a...............................e.9....... ......................0#.......).\|....................Z9.xI....)...............................).....................$.)..............................text...h".......$..................`.P`.data...4....@.......(..............@.@..rdata..\|V...P...X.................@.p@/4.......Z.......Z..................@.0@.bss..........#.......................p..edata.......0#.......".............@.0@.idata..\|.....).......(.............@.0..CRT....,.....)......4).............@.0..tls.... .....)......6).............@.0..reloc........)......8).............@.0B/14.....8............).............@.@B/29.....r............).............@..B/41..................).............@..B/55..................).............@..B/67.....8............*.............@.0B........................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\icuuc53.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2112712
Entropy (8bit):	6.448211711121834
Encrypted:	false
SSDEEP:	49152:n4Y2B3+pPtCdUSrxFi/XWa70kYEhnWAN/BIlcE/X2l:n4YO3+htMUA/in
MD5:	5688538AE7A5AC98090D756020728FD4
SHA1:	DAA3E28708757FB85ED1F1574FEC94C3841A2314
SHA-256:	3D9C8D6AE60274CFCB8186320DC428CA7A7989114F02FC69E46ED7CF8F8655E1
SHA-512:	005546DF11324DF4036484ED1D7A5DEAD26D21F6A63B804DEAF0724823C14BA5F75524F64785E998D3426C57B9ABEC3D9DEFD333892799E038ADB8EA1D5FE272
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P..s'.....!.....z...6...8.. ..............h.........................0.......R ....... .........................EB...@......................P...xI...p..d`...........................`......................LB...............................text....x.......z..................`.P`.data...\............~..............@.0..rdata...J.......L..................@.p@/4......X...........................@.0@.bss....`7............................p..edata..EB.......D..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..d`...p...b..................@.0B/14.....8............:..............@.@B/29.....r............<..............@..B/41..................J..............@..B/55..................L..............@..B/67.....8.... .......N..............@.0B........................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-00NGS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3777624
Entropy (8bit):	6.462153902775358
Encrypted:	false
SSDEEP:	49152:GCIfS372mRH1lf4jN11dyBSqN/YOt2fsAgudMpSGmDaJazpNq:MfSLtH1lfEN1ewOAfszuOMDsSpo
MD5:	33A6EEACCB5F71AC2DBC68712191F83A
SHA1:	186A0D150D5C952681018959A5F9E62119675F7D
SHA-256:	9AE998F9BE96EA618EF3D66EAEDFBC0C1B7A3D0AC35DDE2237FC10E92843CFB6
SHA-512:	A754CD8C1BC60F5ED0E7956AECA05873F7E23F40D80159265D7E4F4231A6E4ADE519225CBDBBF636C20F485D6D39C2EAAC9AFF7800E27E081ABA7CFABB88A839
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........j_.....!.....$....)..... ........@.....a...............................e.9....... ......................0#.......).\|....................Z9.xI....)...............................).....................$.)..............................text...h".......$..................`.P`.data...4....@.......(..............@.@..rdata..\|V...P...X.................@.p@/4.......Z.......Z..................@.0@.bss..........#.......................p..edata.......0#.......".............@.0@.idata..\|.....).......(.............@.0..CRT....,.....)......4).............@.0..tls.... .....)......6).............@.0..reloc........)......8).............@.0B/14.....8............).............@.@B/29.....r............).............@..B/41..................).............@..B/55..................).............@..B/67.....8............*.............@.0B........................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-18QUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4849024
Entropy (8bit):	6.686967701781233
Encrypted:	false
SSDEEP:	98304:8h4ARXH2lONSEHe5PoNHrddSDrkY/pJcCyd6H3dIUcwvY65CEJsv6tWKFdu9C3z:ExWgoEYgFykYx+x69Y65CEJsv6tWKFdl
MD5:	CCC123CF19CA3653727A23D0F65B70B7
SHA1:	3FB31C1D7235D526B6C03C04330F26020D926112
SHA-256:	3CCACF492BA09DDCB732BBEF67176C2E03185AEE68975B984ACFD06564406E81
SHA-512:	04D3AA40E72FA8AA262CDA6B1DE403DE9F8CFAEFA3DA2CA9EA414668A3A97258EA7D22F9488A174538FBC019F2196E1744EB64121765B9FA1B90B6389969F99E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._gzw...........#.....x...I..@.. .............h.........................`J.......J....... .......................D.4.....H. +... I.\|.............I..I...0I..'............................I.......................H..............................text....w......x.................`.P`.data... ...........\|.............@.p..rdata..d.........................@.p@.eh_fram.....p=......H=.............@.0@.bss....p>....D.......................p..edata..4.....D......fD.............@.0@.idata.. +....H..,...XH.............@.0..CRT....,.....I.......H.............@.0..tls.... .....I.......H.............@.0..rsrc...\|.... I.......H.............@.0..reloc...'...0I..(....H.............@.0B........................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-6H63V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	184192
Entropy (8bit):	6.564857648865079
Encrypted:	false
SSDEEP:	3072:lpvm7+Lwyop9sa7SwQBzLFCVVce67F+n2wAeNb3Px:7vi+Lwyop9IxBgclQJ
MD5:	5537F2A0EE708E2F3DB0D04AD4E27A6B
SHA1:	F0EE354EFB9621DDF8D917D71BA81ADEA043FFA9
SHA-256:	9BF0A51293C5A154D6BEC8B63C2C48986819BEC6A8B3DAAC28C9A9739A8BA5AD
SHA-512:	4B003E7A7AD133C613C3BF2AF23268EB3E4E3BB33128A09D045CACB87AC3DCD6D622280C7A1B4505E92F8E62A0E22402556DA8B78B0E44B745DC8B5724BCDC5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................................L................@.......................... ................ .................................`........................I..............................................................\|............................text...............................`.P`.data...............................@.`..rdata...h.......j..................@.`@.eh_framt....p.......N..............@.0@.bss.....J............................p..idata..`............l..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-F7ES3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	67968
Entropy (8bit):	6.777099151654637
Encrypted:	false
SSDEEP:	1536:EE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHimcYoVed:EEgfXi/uDITxZ237jR+imcYoVg
MD5:	F08702CF86D6CC7E0FDEA34F4775044C
SHA1:	C3FAEC5FB8E01FB5EE88954EDD4CAEA46C360C09
SHA-256:	8EEAAB926E157B9994E8611E66F686F99BA0B6372C515617F1A9BAAD516F5F55
SHA-512:	9E2418A17A7D7C64EB20ADEA4F6B02695B520AF4843AE89CC62EA8E644F5859F682793A507A2A14A0809B33A8EF6147C4213F4AB0F0603617765F95C43735E19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............d.........................@................ .................................P.... ..P................I...0..........................................................D............................text...............................`.P`.data...T...........................@.0..rdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..P...........................@.0..CRT....0...........................@.0..tls.... ...........................@.0..rsrc...P.... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-JBSJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2112712
Entropy (8bit):	6.448211711121834
Encrypted:	false
SSDEEP:	49152:n4Y2B3+pPtCdUSrxFi/XWa70kYEhnWAN/BIlcE/X2l:n4YO3+htMUA/in
MD5:	5688538AE7A5AC98090D756020728FD4
SHA1:	DAA3E28708757FB85ED1F1574FEC94C3841A2314
SHA-256:	3D9C8D6AE60274CFCB8186320DC428CA7A7989114F02FC69E46ED7CF8F8655E1
SHA-512:	005546DF11324DF4036484ED1D7A5DEAD26D21F6A63B804DEAF0724823C14BA5F75524F64785E998D3426C57B9ABEC3D9DEFD333892799E038ADB8EA1D5FE272
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P..s'.....!.....z...6...8.. ..............h.........................0.......R ....... .........................EB...@......................P...xI...p..d`...........................`......................LB...............................text....x.......z..................`.P`.data...\............~..............@.0..rdata...J.......L..................@.p@/4......X...........................@.0@.bss....`7............................p..edata..EB.......D..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..d`...p...b..................@.0B/14.....8............:..............@.@B/29.....r............<..............@..B/41..................J..............@..B/55..................L..............@..B/67.....8.... .......N..............@.0B........................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-K2MUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1045384
Entropy (8bit):	6.466765467531014
Encrypted:	false
SSDEEP:	24576:50DNLOuQAKcs2ZPd5567TwEVhpT9dSPChI0v4Z:CZAcs77TVhpTOCi
MD5:	4A83DAE712EC808D48C89EC1D6E66B1F
SHA1:	5B884136553ADEA4D171A3008644FF323D9E6123
SHA-256:	9CD5D78F55957AAC9766BB761EA5CD5567647E433089D9255107626D80A462BC
SHA-512:	87D80C0EE7ECDDDDAB73EE397BAA10CDF48D35B093DACE2BBD8E82910E2FC1F9EA14CCB81EA120155A8761BD6F9E2AF8821C1FB4D6AEFB9EC2B9BC6BA9274FF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............o.................................<........ ..........................f...... .......................xI.......O......................................................H............................text...............................`.P`.data....i.......j..................@.p..rdata.......`.......D..............@.p@/4......T....@......................@.0@.bss..................................`..edata...f.......h..................@.0@.idata.. ............D..............@.0..CRT....,............V..............@.0..tls.... ............X..............@.0..reloc...O.......P...Z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-NO5SJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	360492
Entropy (8bit):	3.709402931530518
Encrypted:	false
SSDEEP:	1536:Zkvfa2Cg04eg/IZrfxTmDQRSjowGTVWLMRf07GnA8f/xgX5PYsNUh//55o0+VYYJ:WzqgAG0sMhbvsMweGPT67nRCQ2FbyGh
MD5:	C26743E3AB4435DE51411A27F44DBE87
SHA1:	9010ADC3C3B4DFAD3760CA73169BF507B9A2BE9A
SHA-256:	AE7001224FED87F4F7EF879F117688523B463374A7CCEF5500ED0055D8432A0B
SHA-512:	F2D6D0BEB4F18806C927D6668B6C12A14755B05876FD2187F46A76A62BC29262385C7CB5DA4B62B461B7563E20E5E6182D3A280A539797277CCA08C942887B1F
Malicious:	false
Preview:	:020000040000fa.:100000000200d2021003000000000002100b0000ea.:10001000000000021013000000000002101b00008e.:10002000000000021023000000000002102b00005e.:10003000000000021033000000000002103b00002e.:10004000000000021043000000000002104b0000fe.:10005000000000021053000000000002105b0000ce.:10006000000000021063000000000002106b00009e.:10007000000000021073000000000002107b00006e.:10008000000000021083000000000002108b00003e.:10009000000000020da7e490000278a4790180021c.:1000a000f0a3d8fcd9fa7aa57b009000e47809790e.:1000b000018015e493a3ad82ae838a828b83f0a383.:1000c000aa82ab838d828e83d8e9d9e71203b1125d.:1000d0000dc675d00075813f751c8075931e5392b7.:1000e000fe0200960010000000000200bb0102e7c3.:1000f00022c0925392fec082c08389828a83bb0051.:1001000003e08002e493d083d082d09222bb00151a.:10011000c0925392fec082c0838a838982f0d083ca.:10012000d082d09222bb0101f722cac0e0e6f309d7.:1001300008dafad0e0fa22cac0e0e0f208a3dafa5c.:10014000d0e0fa22600c08c6c313c618c613c6d581.:10015000e0f422700422600d18c6c333c608c6330b.:10016000c6d5e0f

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-P6L7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21584688
Entropy (8bit):	6.003313130158807
Encrypted:	false
SSDEEP:	393216:DcxR9BSqChVx7jMsPO2GHr//7PiI27gY4L+h9qU4u6Byw6:YhG3
MD5:	26C494DD41BA009DD5F8718FC4EDD3FF
SHA1:	9C02E13C1D581CC96162E778324794048BBA1144
SHA-256:	2FF5624AEBE6596390A6CE38F01D0ED2AC43701A29D6375B0E26613CCA96ACDF
SHA-512:	AC2CE616D18589E016C5C0FD83BB6154FCA7AB591AAF259334CFEF924A409E5D9EB4C591DAEEE0B2CEFCAE04BC4ECB666CD80C378C96D4E19041AA4508017130
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....EJ...H.M......!..........H..... ........0....Pf..........................I.....+fI....... .......................H.J.....I.......................I.xI...0I.............................. I.......................I..............................text...4...........................`.P`.data........0......................@.0..rodata..uH..@...vH.................@.P..rdata........H.......H.............@.0@/4......8.....H.......H.............@.0@.bss..........H.......................`..edata..J.....H.......H.............@.0@.idata........I.......H.............@.0..CRT....,.....I.......H.............@.0..tls.... .... I.......H.............@.0..reloc.......0I.......H.............@.0B/14.....8....@I.......H.............@.@B/29.....r....PI.......H.............@..B/41..........`I.......H.............@..B/55..........pI.......H.............@..B/67.....8.....I.......H.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\is-SBU6E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	138640
Entropy (8bit):	6.68221822804157
Encrypted:	false
SSDEEP:	1536:6mFS7sA82z+4ILr8av36Dy7z4bIzrkYk0j9t1Lcx2vCjy2:6p7+4ILMDorwYk0z1o2vCjy
MD5:	2BCC177EA7B740D6E32B4D94CDF20B00
SHA1:	C2162777D15D292EE6879A73BD26826EDF06D6B1
SHA-256:	EE652D01FB781A5A1F83AE9F06831A7564269B693F2059CC0A097529843F02B5
SHA-512:	360783C236515F10208DF6EC2AE9E36DEA7311C5C399240576B938201B481D0CE78BFFE48188DC8A5F839A377F6F2BBCA55BA79300ED9F19BB8B46B6476A6E39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....V.......... ........p.....n.........................@................ ........................._................................I...0............................... .......................................................text...HT.......V..................`.P`.data........p.......Z..............@.0..rdata...).......*...\..............@.p@/4......D........0..................@.0@.bss....8.............................`..edata.._...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libgcc_s_dw2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	138640
Entropy (8bit):	6.68221822804157
Encrypted:	false
SSDEEP:	1536:6mFS7sA82z+4ILr8av36Dy7z4bIzrkYk0j9t1Lcx2vCjy2:6p7+4ILMDorwYk0z1o2vCjy
MD5:	2BCC177EA7B740D6E32B4D94CDF20B00
SHA1:	C2162777D15D292EE6879A73BD26826EDF06D6B1
SHA-256:	EE652D01FB781A5A1F83AE9F06831A7564269B693F2059CC0A097529843F02B5
SHA-512:	360783C236515F10208DF6EC2AE9E36DEA7311C5C399240576B938201B481D0CE78BFFE48188DC8A5F839A377F6F2BBCA55BA79300ED9F19BB8B46B6476A6E39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....V.......... ........p.....n.........................@................ ........................._................................I...0............................... .......................................................text...HT.......V..................`.P`.data........p.......Z..............@.0..rdata...).......*...\..............@.p@/4......D........0..................@.0@.bss....8.............................`..edata.._...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libstdc++-6.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1045384
Entropy (8bit):	6.466765467531014
Encrypted:	false
SSDEEP:	24576:50DNLOuQAKcs2ZPd5567TwEVhpT9dSPChI0v4Z:CZAcs77TVhpTOCi
MD5:	4A83DAE712EC808D48C89EC1D6E66B1F
SHA1:	5B884136553ADEA4D171A3008644FF323D9E6123
SHA-256:	9CD5D78F55957AAC9766BB761EA5CD5567647E433089D9255107626D80A462BC
SHA-512:	87D80C0EE7ECDDDDAB73EE397BAA10CDF48D35B093DACE2BBD8E82910E2FC1F9EA14CCB81EA120155A8761BD6F9E2AF8821C1FB4D6AEFB9EC2B9BC6BA9274FF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............o.................................<........ ..........................f...... .......................xI.......O......................................................H............................text...............................`.P`.data....i.......j..................@.p..rdata.......`.......D..............@.p@/4......T....@......................@.0@.bss..................................`..edata...f.......h..................@.0@.idata.. ............D..............@.0..CRT....,............V..............@.0..tls.... ............X..............@.0..reloc...O.......P...Z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\dfu\libwinpthread-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	67968
Entropy (8bit):	6.777099151654637
Encrypted:	false
SSDEEP:	1536:EE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHimcYoVed:EEgfXi/uDITxZ237jR+imcYoVg
MD5:	F08702CF86D6CC7E0FDEA34F4775044C
SHA1:	C3FAEC5FB8E01FB5EE88954EDD4CAEA46C360C09
SHA-256:	8EEAAB926E157B9994E8611E66F686F99BA0B6372C515617F1A9BAAD516F5F55
SHA-512:	9E2418A17A7D7C64EB20ADEA4F6B02695B520AF4843AE89CC62EA8E644F5859F682793A507A2A14A0809B33A8EF6147C4213F4AB0F0603617765F95C43735E19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............d.........................@................ .................................P.... ..P................I...0..........................................................D............................text...............................`.P`.data...T...........................@.0..rdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..P...........................@.0..CRT....0...........................@.0..tls.... ...........................@.0..rsrc...P.... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-0DRB9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3304509
Entropy (8bit):	6.3779939789652325
Encrypted:	false
SSDEEP:	49152:/dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEj/333s8+S:kHDYsqiPRhINnq95FoHVB/333zN
MD5:	BB922B90BCAAEB27241529FD6D1EED6B
SHA1:	BAC3219B3648575FB4FD3B09214A190FC4CA0494
SHA-256:	C841BCD21E9A2EC4B511EF3D09DDD1E5303DB2D45D4AE0C51763327BC8803F46
SHA-512:	1427663391A0D0C9DF53B634BC8FB42FBD4694A0AE8E5BDB9260A188DC7FEA51FFBB2C35114691F2BEEBD249C9B6808FEF215E30D417C4FB24E81C6D9031709D
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................2...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-1B30B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124576
Entropy (8bit):	6.118428590777471
Encrypted:	false
SSDEEP:	3072:bDmG4Rq9heQzRAcHQwc/LF7K9gl22rabKc0hYxqB465p4A:fmkaxL09/2rabx0hNPnv
MD5:	C67D961EC6B42CC9D651C8CF79E1447A
SHA1:	1FE52853A6D1801E7423968647FBFE547FE53423
SHA-256:	055379D4407903B2869399818ACF1E6C802939E5CBA1431C89B6C8768A760D7E
SHA-512:	A0BD076CD1B52618D00B9CE9712A53C406019FE310F71EEE2DB611DDDB0ACF7A34FB26FC21A96392FBE52E03E5058C7A070379DEAF5EFA4E97CEB8409C619BB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....z............!..0.................. ........... ....................... ......&.....`.................................\...O.......l................"..........T...T............................................ ............... ..H............text....... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.........................................................................{....:.(#.....}....:.($.....}.......0..7.........(%...}.......}.......}......\|......(...+..\|....('....((........V.($.....}......}........0..?.........()...}.......}.......}.......}......\|......(...+..\|....(+.....0..7.........(,...} ......}!......}......\| .....(...+..\| ...(......0..7.........(/...}4......}5......}3.....\|4.....(...+..\|4...(1...*..0..?.........(2...}.......}.......}.......}......\|.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-1MLIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3318504
Entropy (8bit):	6.537564216608803
Encrypted:	false
SSDEEP:	49152:C50b59Aj1ZLCpTT2TzAOeJ+KaGxHIkMNqo5wW0DlI6eujzc3:y0b3AjaFZE5WIR3
MD5:	9FE1A31FDC7B67F5480E936D359EF6C3
SHA1:	576269A42C0991E90F5E83C8205EB808D7B4D3BA
SHA-256:	F42B8609854D80D7F81F276340504AA5E82BBE4D73D05080FEF1FCCA2444B4D5
SHA-512:	7B7CAE9FC0AFCCEE7533971F97AF11E5DEDB54775BBFE45AD94B82BFDA6122E65FB378BD27B2390BFE45AF89438DBB550171F6939FEBCF742034A405B49339A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..x2..........-1.. ....2...... ........................2......H3...`.................................G-1.O.....2...............2.. ....2.....\|.(.p............................................ ............... ..H............text....w2.. ...x2................. ..`.rsrc.........2......z2.............@..@.reloc........2.......2.............@..B................{-1.....H.......T.........................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s',..%..(.... ....o.....o.0...Zo....t....o5(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............R....r...p.(L....o$....(......0..I.......sD...s?)..s.(..s.(...(....s3(....,..o%....2...(....sS(....+.....%..ou.....( .....( ...*n .....S...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-2J23P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	552448
Entropy (8bit):	6.381340141867444
Encrypted:	false
SSDEEP:	6144:0LmQbWbq4HNhmSZ1jGtZv7IF9LouF9LNzSZ1LGtVvn:NNXnGtZvWoYNO3GtVv
MD5:	525FCF89423D881E317A42269FA90810
SHA1:	12A0ABDF9EBF3490DF6B5877B1AC2EB393D27F51
SHA-256:	21B36D57B52B6A667C6B137624B48858828744725841459FB512D27A97925CFF
SHA-512:	567ECA06F111611FEB68C6337D9C9601970556F8DB3AB684223F894FA08724E9D54B4CB2C854E2473A60A1BE3A921334593AEA9EE57CE0F49F52AA37FBEF373B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h.T...............0.................. ........@.. ....................................`.................................7...O...................................$...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc...............l..............@..B................k.......H.......T....!..............H.............................................("...^.("..........%...}....:.(".....}....:.(".....}......(#......0..`.......~....~@...%-.&~?.....,...s$...%.@...o%...(&..........s'...o(.....r...p..s)...}.....-:..}....~....rK..po...r...pr...p(+...r...p...(,...&.(-...*..(......r...p(/...t....}.....r...pr...pr...p(+...(.....st...}.....{...........s0...op....{...........s0...on....{...........s1...or....{....o......{....o2...t ...}.....{...........

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-46CG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.007806094869997
Encrypted:	false
SSDEEP:	6:TMVLcIjkfVymRMT4/0xvFM7VJdfEyFRLeSDuACQIjn:TMV9ofVymhsvF+rLeSD9Cxj
MD5:	670DEFF21BAD1E5A1AF349B8ED395D68
SHA1:	B8A686E0F05683357DF61007D3CF0E719DBFDEF1
SHA-256:	CC3E314D9B4B8C9D3F82A223D52B001627C84A1E74B444915B133B7772753C53
SHA-512:	9C3701C5744DD4477DEDFD53A56268AAF6D44638EEB61436AD0234E11F30614FF52BEAAE626AEDB43D2366A5E29663B1A759CD5F1A963C448915C6332F2642C0
Malicious:	false
Preview:	<?xml version="1.0"?>.<configuration>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1"/>. </startup>.</configuration>.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-5RQKA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75368
Entropy (8bit):	6.120190176890648
Encrypted:	false
SSDEEP:	1536:K8MCfU7Zal7pxs6qPS/YdMM9pGtxNmdBzy/ILn1gtUcMaY:TMCfU7ZaFpdYKtvm7n2tUcr
MD5:	D11BE1055DE8BA1EB6243E886BFD40EA
SHA1:	FF9B64D077634424EE20F0C6066DB79904964015
SHA-256:	D78E036AED15D626E19EA492E5DEDBF71063BB7086B05AD5954D358D2868B0DA
SHA-512:	6120F48AA8CEF6AC88CD4232692792540B2DA26ECD388CB5045BB30333DB323E546115EB7B29172A4D971D5363F9BF43E8C43216BC268736CF66FFF3CAA8420B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ... ....... .......................`...........`.....................................O.... ..................h$...@..........T............................................ ............... ..H............text... .... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......$d.................X...h.........................................(....^.(.......C...%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&.................'....0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........( .....,&(....,..r...pr...p.(....(!.....(".....(....,.r...p......%...%...(.......(#...*.(...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-6MAU7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	696480
Entropy (8bit):	5.95766682005451
Encrypted:	false
SSDEEP:	12288:oeos/POdGV5jfWrV/9Yeh9eRcyLfLYtT5mWxTZ/B7jW5JMtRRpKzQWFE:o0/POdGV5jfW5VnhFyvOB7jW5JMth
MD5:	87A168A7304002ED2A6B70063973BD96
SHA1:	650B2A599AACE164F8412CD47E4C5CE834C5F556
SHA-256:	A22DCFCBBCB0B939464658CD2CDF745B724D7C0C6E0A6E19C600A7110EAF67CC
SHA-512:	36D6AC0AAFD929C27F9EB21B894F50E4DFF1EF4F4D1A51333A31C3CD62AAAED459EFFA23F12B3C3878A74B6D79C9B704C07D88C1B2A4185A5FC19ECC6206C9A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..t..........N.... ........... ....................................`.....................................O....................~...".......... ...T............................................ ............... ..H............text....s... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................-.......H........p................................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{Z....3...{Y......(....,...{Y.....{[.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-77UBH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33440
Entropy (8bit):	6.3806463027161575
Encrypted:	false
SSDEEP:	768:qZbQYJtpyQm9ebRZ6UyeSPpXf2zoWT8iRIflEolc:q6YJtpyQm9edwDeuhkoW4iknc
MD5:	B36561B05981CF8CAED8264942CE02D7
SHA1:	72ABB3E7AFD04857925F471B850906001315CE88
SHA-256:	5DE2777B0044A6D5658279A324578EC9933ABD884093B92096ED043B39FCE7B0
SHA-512:	6429B9D8690629321B16EB2DCE548D77FEA3D3456DA40E42B37A8F98672CA20E63C22E64454E0D3F70A6E346C3A74233D969C94CCBEA9C95777B025DFBC4DB87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}v.............!..0..X...........u... ........... ....................................`..................................u..O....................`..."...........t..T............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................u......H........9...:..........................................................j.(......}......(....}....V.(......}......}........0..Q........(......~....o....-+.....(......r...p(.......(...+..(....s....z.....(....%.o........0............i.h..rA..ps....zs .......(...+.(...+(...+o$.....(...+(...+..{........o%.....o&...(....%..(...+(...+...(...+(...+.....(....(...+....{.......(....o'.....(.........o.......o(...o)......o...o+....N.o,....(...+.(...+.0.............(....-.rQ..ps/...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-7AJMV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	13083
Entropy (8bit):	5.116159540606374
Encrypted:	false
SSDEEP:	96:aD+R8/yM3SM+F9fpE4yn31sF13A+9PHh7hgpCfudFod7HLcfXfEKfdSRAYQdQSn7:aSRwi9RksT3T1HhtgvCs7zqfue5W
MD5:	A36EBC6DA1EC79E78E8776AB4DDB0854
SHA1:	9297394C656FA8B2DF5C62DEACC662D4D6E54931
SHA-256:	B1430BC89035E378481186CB09FF4BC41E078BCD66B3675DAB9D3D4A67D99B4C
SHA-512:	C741A7EC966AE0165105FE92FB8E78F2F191A1833DFE53D978D0FADF6E0481EB35A108CD5CB5B37C8A9DBBED9055EBFF48C3BA2CD2E7FAB84261F88285F11020
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x86",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x86": {.. "Usbdrv/1.2.3": {.. "dependencies": {.. "BgApiDriver": "1.0.0",.. "Fleck": "1.0.0",.. "Hardcodet.NotifyIcon.Wpf": "1.1.0",.. "Microsoft.CSharp": "4.7.0",.. "NLog": "4.7.15",.. "Newtonsoft.Json": "13.0.1",.. "Nn.Rfid.Encryption": "1.1.0",.. "Nn.Rfid.Twn4": "1.0.0",.. "WinUSBNet": "2.1.0",.. "Interop.ZKFPEngXControl": "4.0.0.0".. },.. "runtime": {.. "Usbdrv.dll": {}.. }.. },.. "Hardcodet.NotifyIcon.Wpf/1.1.0": {.. "runtime": {.. "lib/net5.0-windows7.0/Hardcodet.NotifyIcon.Wpf.dll": {.. "assemblyVersion": "1.1.0.0",.. "fileVersion": "1.1.0.17".. }.. }.. },.. "Micr

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-9GLPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36000
Entropy (8bit):	6.388090425137777
Encrypted:	false
SSDEEP:	768:YIenkEitPUUTsh2YKI7yR+VBYdf3T8iRIflEQYlZI:incRUUfU2eBYdf34ikZYXI
MD5:	BC390A46DB77DB14EE09537D474BDA67
SHA1:	EC4EC0AD44471B6C81A380CCB3A50B9608A46E06
SHA-256:	8CA0C48E0B3EB8B4BCF6483E21A30C94F4BCA86784963B61ADFFF5E9A9539A8C
SHA-512:	DAD7C4FB1D9FAC3888DE3CD354696B779ABF85847A7808BD94B65B8D93ED084E7BE6FA9D5CBD17C213E65FA5FE04A3512C7C218C4BE96218DACF7B31344CB2FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.z............!..0..b............... ........... ...............................P....`.................................<...O....................j..."..........0...T............................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............h..............@..B................p.......H.......P4...K..................................................................("....s.........~r...p(#........~....s$..........{...."..}......{...."..}.....s....%.(....(....o....%.(....(....o.....s....%.o....(....o....%.o....(....o....F.(%...o&...o'...F.((...o&...o'...j.()...u....%-.r...ps...zj.(+...u....%-.rk..ps...z..0..<........o,...o-...o.....[..o/...o0...o1....o/...o2...o1......(....*.0..;........o3.....o3......Z.G..........iY..i(4..........iYX..i(4..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-ELJA9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52384
Entropy (8bit):	6.11801318556494
Encrypted:	false
SSDEEP:	1536:AQQdCBc12gy6/5X20qI0YyYYYJuh51oa34ikD:KIS2gpBzYoa34f
MD5:	FEB4F49C614DBAD708CC956B065F4E4B
SHA1:	8ABD030854FAFB30583924449BBA7871F0D2F7A5
SHA-256:	C1C92EC40D704C37E501F33434E2C8946851FAD49719FBD32551D0AC1BF03E98
SHA-512:	F3628FB1938FAC05689B124F8CA9446C619BA86C0B85307F0FD8E0F20BDA8A26E559AC25C9381C33D4D8B2D85B4AEDA431CA4927CB15DE1F8F446A48248085B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...RG.............!..0.............~.... ........... ....................... .......Y....`.................................)...O........................"..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................].......H........J..\t............................................................(...."..(....&...(....:~.......o....:~.......o....:~.......o....:~.......o......(....r......~g.........s..........0..r........(......r...p(....-6.r...p(....-1.r...p(....-$.r...p(....-..r...p(....-.+...(............(.....(.... ....s....z...0..o........o....r=..p..o....,...o....ri..p..o....,...o....r...po....,.r...p.o....,..o....o....r...po....,.r...pr...p..(......(...."..(....&...(...

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-HP6R9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.5337274220648895
Encrypted:	false
SSDEEP:	768:rjmxwdovXxJgAp2oEm65v+atLdrVxFpq5CrYv18iJ45:rjKwdovd2omBrVxFp8CrYvWi25
MD5:	B4A30BB2AE2E0A1B6A9BF6C0DFA40C53
SHA1:	5DF6CBEFB8988C593F3B1D54F1F00F9B263299E5
SHA-256:	A394CAD8E366BA080DB69AD7A630D456796E6FED4FE0F94DA30E2895BE884707
SHA-512:	EF7A738D50547A88D4EFFDF23F8FE21C2DD46964E4E55552BC0D7C8C091B68046D6ECE354F8969B8EBE90D2035D368CF24523C90F5E8A153F9784B933B7B77D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D..........." ..0.................. ........... ....................... ............`.....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......hI..d~............................................................(......}............s....o............s....o......}....r.(......}......(......}......0............o.......(.........................0..#........t....o.......(.......r...p.s_...z..................0...........(.......r}..p.s_...z...................0..B.........(.....{....~....(....,..{....(.....~....}......{.....\|....(......{....~....(....,..{....(.....~....}....*.0..8........(...... ....... ....3..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-L173S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.427922197527517
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkI/X5BXmJe5S1sHRvXmJbJccVHdS1sHNAQ6NOCUo+K8EkNTy:dFk2BEe01sxvEbJc11slex+K8Es2
MD5:	D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA1:	04855D8B7A76B7EC74633043EF9986D4500CA63C
SHA-256:	1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
SHA-512:	09A9667D4F4622817116C8BC27D3D481D5D160380A2E19B8944BDD1271A83F718415CE5E6D66E82E36819E575EC1B55F19C45213E0013B877B8D61E6FEB9D998
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "frameworks": [.. {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.0".. },.. {.. "name": "Microsoft.WindowsDesktop.App",.. "version": "6.0.0".. }.. ],.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-N07MR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96416
Entropy (8bit):	5.814764412132972
Encrypted:	false
SSDEEP:	1536:6p/h5hiWhKqUknSxQLwSAYGBHOtGtu9wiD+/f+53m0zzGCuvAfwg21WjMAFSIrtl:q/h5hiWhK5QLwSAY7tGtuSiD+/f+53m+
MD5:	A3DED3E465EE66638583C397951153DA
SHA1:	CA0BCCFC25059ED231F5A9E08EFDD86B43E5A5B2
SHA-256:	7A0B766551344070D45DC7557C45CD6786B35B23562E215C32186014ABDE6420
SHA-512:	F745062F7D631D73D051788119F0310374A5592069ED5F68454063D66D3AF8E6DFEB1B6E1DE4455DBDB5D7DF2EC938D4FE1E9B0FFAB020111D7D5330F46DDBC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.............!..0..L...........k... ........... ...............................Q....`.................................2k..O.......@............V..."...........j..T............................................ ............... ..H............text....K... ...L.................. ..`.rsrc...@............N..............@..@.reloc...............T..............@..B................fk......H.......t.................................................................{...."..}......b.(......(.........(........0..?........(............+....(..........r...p(.......X....i2.r...p.(....Z.{....,..{....o.......{...."..}....*..0...........s....% ....r...po....% ....rI..po....% ....r\|..po....% ....r-..po....% ....rg..po....% ....r...po....% ....r...po....% ....r...po....% ....rf..po....% ....r...po....% "...r ..po....% (...r...po....% :...r...po....% <...r...po....%

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-N73BK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	3205
Entropy (8bit):	7.924304525326202
Encrypted:	false
SSDEEP:	96:QCmEKblDHNBC/WXlDXT3nFObolTX0tPQYjk:QCPKJpUuXl0bIbyYGk
MD5:	EEDDD3BCA0DEFF0EECDA991B7CCA3583
SHA1:	C0A06C1D2010FA03C2D32E13FAB48D4AA527FDB0
SHA-256:	5AE14C55931772FDEA3E9E569969FCC7FF7B4B14C63135FD85953160481889D2
SHA-512:	1EF419DFB47C73049BC6B35CC9C74CAA434E04CB62623AB1A5B2137CB98119DFD928A51E194440F0A7FEF68A252B667C43121ED091DF5C27DE109FB9FA862078
Malicious:	false
Preview:	0......0..G...H.........8...40..00......H..........0......0......H......0....H.......0...C\ju............m)K..;.s.R.MC..t}.Y..."a..V!.Tz..h...0$..Ah.3\|.b...W....a...O..x.E;r.?.....v8...N..U....U..)..:...A...V9.v..?..vl.........X.L.&...t..E.IX.........m.+...3H#.c.....m .D..B..."...M.a._j>.....<J8.R#...\.B..I..q.....P...v@c<Z.....x..W<...nR...U.W..%..~....N..e....g...d....PPy.9....}...._X.m.W\.....O<.\#....^.^.kgs.h....o...R...2h.!x.Z.../p..?..c.I.#.r.mU~..RTu.i.q.\.{q.V{......"i...}.p......1..b.R....bo.Do....mLE...e...y.+.....?q....W<...+..8...\|........,G.b\|.'}.y6.:. .7...H.-......K#V.W....J.Z.&.-..g..:t.....c..m..v.].._Y.s.:..2.......Z...........QX...E1.2zl..m.6...3..C{.......D.KE.......C.H"._....4M..+E.E.(./.~l,=..cc}O...T.:B.6.s,.D.M.X.l....ZG...,..._....9V....vy..A.[,IC..'.W....e%w..x...}#.....P?.......^...AwM....TcIe&`.8.N12.-..q.......Q.%\|.1...1....p.'0.\Sl...........N.i....~@...3f!..Q.?..&7..~V.w.xR5.....x.._....q.-Z.+...F.{.

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-PU0A1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832160
Entropy (8bit):	6.054900928427106
Encrypted:	false
SSDEEP:	24576:VlXVFlXtxdndFtkWKEMGP1Cx567XjNXEHfUsQD:VlXVFlXtxdndFtvK69sCNEHM
MD5:	69E48091D117F2DF5AE913F028A34FDF
SHA1:	556A8DCA36CA234349DB0A6D37755738594E5005
SHA-256:	79419D9F45A4A46569F5D1E7126E0EE0BF0E5C411FB79F0F94CCB8EA2AE92D91
SHA-512:	0D2FD68C48381458C2E200BA54E5AC4EFD156F1ED4C13EDF67DD84CBDD533221B1DAD598E621E4C71AF8263B8A88B453EEB951D9F82BEE648C3EC5669FFC86BC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0.............2.... ........... ....................................@....................................O.......$................"..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H.......,.............................................................."..(......(...."..(......(......(......(.....(...."..(.......0..B.......~..........(T...~....,.~.....oU......+...(......oV......,..(W............../7......"..(....6.(.....(S.....0..........(.......oX...&..(....oY...2(.....oU.......0..?.......~..........(T...~....,.~.....oU...+...(.....oZ...&...,..(W....*.........,4.......0..?.......~..........(T...~....,.~....o[......+...(....o\......,..(W..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-SD9NL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	112288
Entropy (8bit):	7.3744416208676125
Encrypted:	false
SSDEEP:	3072:hoy+75OQW4pg9xXsGQTckaX4kGsdO5UInM34J4W:h+75ON4pg9xX7kzsTInM0d
MD5:	CE14C1C067D2FF50E477B93C98F91617
SHA1:	B3F5E796B259CF716D4D2B0F639B1C624F7F9F5B
SHA-256:	38158D385A361D9C2C7CD02C37D4B394E975952D3B5259349257A882CA095E33
SHA-512:	C133E34A29478F15AC4A5C9CBCF970CC3D2E40DFCA70D3BBA0F0A6E695A89F268EAB779A27B72010CC622581C1C4073F160A1FB57283B60D8CBD4942A2B9FFF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k9..........." ..0.................. ........... ..............................".....`....................................O........................"..........8...p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........O...y..........................................................V!.)1......s............0..$........u......,...o ....u......,...o!....0..&........u......,....o"....u......,....o#......0..&........u......,....o$....u......,....o%...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....(&.....(......,..o'...-..,..o(...-..,..o'.........0...........s)...}.....(*....(....-..s....+.(....}......{....o....(....}.....(!....{...........s+...o.....{....

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-T8KB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296096
Entropy (8bit):	6.307116291559023
Encrypted:	false
SSDEEP:	3072:6z6SAVyxY+XWso4LQyMBPyWv6lSER9lSDOS1oO894CEJVGsSScueTSHLXyd7aU4J:6IVyJ/El94EEdSZ1EGtZv7E7aU6
MD5:	013C1C676A26176DFBBB788518970351
SHA1:	7759D0A79894A868E3D6631DA2C1EE97A83FB3FB
SHA-256:	15A1224C71D46FC68C791276DB65E2A03B61FD239F676BD1929BB89A3EA24A69
SHA-512:	AC8A0FB1DECC751AE7C78244B872951FABD7F2CFEF0C330307170C912F21EC6E38A1477DEF818DBCE8DED381EB57339F5B6076C423D056D30FA119EC3254DDEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{.....................................U.............:......:......Rich............PE..L...}.wc.................0...................@....@.......................................@.................................@........................b..."...p..p...`...T...............................@............@...............................text..../.......0.................. ..`.rdata..vj...@...l...4..............@..@.data...x...........................@....rsrc...............................@..@.reloc..p....p.......P..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-V72H2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294560
Entropy (8bit):	6.029783979142562
Encrypted:	false
SSDEEP:	6144:8v02WtKbuJp7Ki4vZW02XcEYBkODqxK+vZc3TaPod+HMMAcdvcXU:8v02EKbuJci4vZWZXSBkODqA+vZc3cjH
MD5:	300903D6AB684DF82494FCC366C13CBE
SHA1:	B869EF3612C820E44D07EC12311A0624D3D63CFC
SHA-256:	28751F0717AE3A187C008AE8954C355CB58BDE968514578B69B6E5D6468F7C4B
SHA-512:	4FE4FB5864AAC06314D04C415775573E85DCDBA86DFDE84E74B1DC1C76ABC5386D939BE8AF8C0C891C5FBCDF6FABCCCD8B152AFC0794790DDA97FE006133C125
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..R..........6p... ........... ....................................`..................................o..O.......d............\..."...........n..T............................................ ............... ..H............text...<P... ...R.................. ..`.rsrc...d............T..............@..@.reloc...............Z..............@..B.................p......H........'...............D...)..tn.......................................~......0..1.......(....,..%-.&...(.....o$......&...,...o%...,.......................(....,.r...p......%...%...(&.....('....(....,.r...p......%...%...%...(&......((....(....,!r...p......%...%...%...%...(&.......().....,&(....,..r...pr...p.(&...(.....(+.....(....,.r...p......%...%...(&......(,....(....,.r...p......%...%...%...(&.......(-....(....,"r...p......%...%...%...%....(&...*......(

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\is-VLAJN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38048
Entropy (8bit):	6.0349304307729446
Encrypted:	false
SSDEEP:	768:1vMZWLY1CHsUy65HWiND4VTt/cQT8iRIflEl:1vMZWLY1CHsg5HW5Tt/cQ4ikY
MD5:	7BC94837D5A084F87F4F9DC139DEE02E
SHA1:	F45C15F779635C380E2A91378E85D0DFB2443F34
SHA-256:	426A2FACBE8BAD30D8DCF99407928EE21D0826988E7A983C2F5D25B1320E11E1
SHA-512:	8802420C0BD27F42BFA2E607C60919CCAC098671A129BC8453D54596D7157CE271774F66433509DFC2B9ACC0A373F8BC39A84DC8C403FAF30A5AA04B410F2852
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X.e...........!.....j.............. ........@.. ..............................m.....@.....................................K....................r..."........................................................... ............... ..H............text....h... ...j.................. ..`.rsrc................l..............@..@.reloc...............p..............@..B........................H........5...R...........................................................0.."...........{....9........{........o-......0.."...........{....9........{........o/......0..&...........{....9........{............o1......0..&...........{....9........{............o3......0.."...........{....9........{........o5......0.."...........{....9........{........o7......0..............{....9........{....o9......0..............{....9........{....o;......0.."...........{....9..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\TWN4_3.22.bix (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	773028
Entropy (8bit):	2.7840994326965385
Encrypted:	false
SSDEEP:	6144:CSpCJlD0UPIGN26UX6dng1sFBLvDOMPUi5GDqixMvOR1QoL5WszJ8e4HdEKHbaNg:otvb63Mi8jwqsmxbVNtgKZ
MD5:	0D0271A2CA6A7D0359ED55DF1BB79012
SHA1:	66794F6DD8A6A404908D3BCF613D553043B4A7AB
SHA-256:	F9CA1FCB03D0EFCA310829AEAB3E46B3372B66CC4830321B2E3CB8752C1D6EF3
SHA-512:	0CDCEFDB1BF6612010EE2D4AB86DC5512DDBE4B9CEFD09B6055FE44970994B6E374970DA50F90A27B1842211A92BC3C3D6E4AAB69EAA04D2F75AAC8968F1F8DD
Malicious:	false
Preview:	........flashinfo.........................................................T...W...N...4...................,...........................code.....................@...D...1...\...U...6...........d...R...........u...>...)...~...........!.......B.......\.......;...B.......Q.......q...'...-...p.......3.......................#.......r.......................O.......!.......7...............W...........o...........................}...s...?.......+...e.......v...y.......j...Q...............i...:...W.......>...........................e...........8...8...1.......e.......i...d...#...r...........?.......l...,...........................Q.......U...........s.............../...............g...........N...{...4..."..._...C...g.......k...........y...........;.......................................(...........................l...................................o.......................r.......&...c...H.......u...........r...........................U.......q...%...J...........+...b...3...?...f...e............

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\TWN4_4.07.bix (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	564293
Entropy (8bit):	7.997207769094986
Encrypted:	true
SSDEEP:	12288:hQ5Xj+YQZe+pST1KPOVuCKQ702voiCVpN7hqjTEaBA:hWbUTO1rVuCt7Dd0N1q/EaBA
MD5:	F04A978A1C0B1A7532CDA9EF1E14AE43
SHA1:	5EEF3C74A9BEF7643E00F6A62C401C207836EB49
SHA-256:	EC06A73A3CFB2FAAF8E293C872928AFE48537D1F6FD4E101757E1A01C1253C44
SHA-512:	348220059FD5C40A3EBD2646029081E58FDD590142C2FB20B96E3C2DE14F3641DF6098F019D4472F4DD3F6A730198505CF3CAC2C8A43E28B464731CC8D2B28B4
Malicious:	false
Preview:	........flashinfo.............................................TWN4............Q.;.code.........................M..4...M4gZ.....[=....Z..C;.]a..A.f.:}..A.c~T..........K.....^5X...........O........4.)y.G.v..f...]...c..h..B...pN..Uo..."..p...}....do...\|.......M\|..x"-..}0#....m......K...I...\|.}[..+.......a.N.1....v..p..X.`....8....7ntF.jZ.@...m..P.$...........ro\|.JMO....u.z......@..q.M5..;qj.<...d...T.. .cJc.+P..).3=....k..j..I..A.^.h..(.{.n..9....CL...6.)....i./.r.7..d..d..........g..w.e..)....]9T#....<....D.{N.%q._..k.m..{02$..g.N.....+.O6..Q.`.....!.(^..5&.....=i......iG=%...}.<.V.:."..#.]..B.d5.....iN...h..f....C..J7............V.R..."e..Fb..E.B'o..,=f..0...2.1=z.>.....K.....WD.A....\L....A?..a..4..D.+..o....8^.X7X.j/?6.....buJO..v.].Q.T..]6..2`r6:r..A.Xx.S.-`...+....y8v....z.&8.....A..d.=.F.~..S..d.J.%....fx.2..0...tI0x. (0\|...:...[6.s...b;>_Ov.D*4u}...-.............E9f....s.5.....I....k.../....&...d....aJ.${?..#n..p....l.p..K..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\flash.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.477952985829629
Encrypted:	false
SSDEEP:	3072:z9ZcI3W/jkSTCY0EMp7HOBvDp2Dgxfsq+aXZejWvxgg2:zzcMW/jkSTSLNON7VsqTey5gg2
MD5:	04EE05A808F9D7E035CB727A171BCF1C
SHA1:	7EB7518E735124B17C9A6FDE5AC8F9756380BABA
SHA-256:	51C4ECA2007BBEE1A7E2AB5BFF7395CFFCE435EB349288691C40B92E7799AC38
SHA-512:	404A1FB258A03C3BD22072612BD5C8675105565E1FB0AA1D798054EEA88370E7F950D93BB3A6BBC3678EB9F0085D42DC0D86CDEF3059E246BC07018748158BF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F~....k...k...k..M....k..M....k...6...k...j.r.k.......k..M..F.k..M....k.......k.Rich..k.................PE..L....H.].................Z.........~T.......p....@.......................................@.....................................x....p..........................</......................................@............p...............................text...jY.......Z.................. ..`.rdata..t....p.......^..............@..@.data....F... ......................@....rsrc........p.......(..............@..@.reloc..</.......0.................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-5A9CP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	773028
Entropy (8bit):	2.7840994326965385
Encrypted:	false
SSDEEP:	6144:CSpCJlD0UPIGN26UX6dng1sFBLvDOMPUi5GDqixMvOR1QoL5WszJ8e4HdEKHbaNg:otvb63Mi8jwqsmxbVNtgKZ
MD5:	0D0271A2CA6A7D0359ED55DF1BB79012
SHA1:	66794F6DD8A6A404908D3BCF613D553043B4A7AB
SHA-256:	F9CA1FCB03D0EFCA310829AEAB3E46B3372B66CC4830321B2E3CB8752C1D6EF3
SHA-512:	0CDCEFDB1BF6612010EE2D4AB86DC5512DDBE4B9CEFD09B6055FE44970994B6E374970DA50F90A27B1842211A92BC3C3D6E4AAB69EAA04D2F75AAC8968F1F8DD
Malicious:	false
Preview:	........flashinfo.........................................................T...W...N...4...................,...........................code.....................@...D...1...\...U...6...........d...R...........u...>...)...~...........!.......B.......\.......;...B.......Q.......q...'...-...p.......3.......................#.......r.......................O.......!.......7...............W...........o...........................}...s...?.......+...e.......v...y.......j...Q...............i...:...W.......>...........................e...........8...8...1.......e.......i...d...#...r...........?.......l...,...........................Q.......U...........s.............../...............g...........N...{...4..."..._...C...g.......k...........y...........;.......................................(...........................l...................................o.......................r.......&...c...H.......u...........r...........................U.......q...%...J...........+...b...3...?...f...e............

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-ER4K7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.700424768234197
Encrypted:	false
SSDEEP:	6:hcPzeMBNFQvC9ANUzH/hAKFMWUWBhpQh4nfBlE2SLXYWKhv:2zeMwVNUjhATPepQOg2SLIWqv
MD5:	061F9C364E524C3F316BA9C31F5ACA4C
SHA1:	59350781308BF56FB587A86F0354F8597391B3F1
SHA-256:	E86730C240D26443F536272CD7A76EEE3658995261522A2C09B149DE21DC1B5B
SHA-512:	3CEED1DAFA84F00435773BA8BFC3056487DA330BBBFE1FC300D079DBA2D8BFDD8ECEDADB4A85D70F03FEADD8AF6EA79C20DFC233A51780741BD4EE6AA46B9EEA
Malicious:	false
Preview:	@echo off....echo Connect RFID USB Reader to PC...echo Note: Only one reader may be upgraded at a time, so please ensure only one is connected during upgrade...echo...pause..echo.....flash.exe USB TWN4_4.07.bix....echo...echo Upgrade finished...echo...pause..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-G5MOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.477952985829629
Encrypted:	false
SSDEEP:	3072:z9ZcI3W/jkSTCY0EMp7HOBvDp2Dgxfsq+aXZejWvxgg2:zzcMW/jkSTSLNON7VsqTey5gg2
MD5:	04EE05A808F9D7E035CB727A171BCF1C
SHA1:	7EB7518E735124B17C9A6FDE5AC8F9756380BABA
SHA-256:	51C4ECA2007BBEE1A7E2AB5BFF7395CFFCE435EB349288691C40B92E7799AC38
SHA-512:	404A1FB258A03C3BD22072612BD5C8675105565E1FB0AA1D798054EEA88370E7F950D93BB3A6BBC3678EB9F0085D42DC0D86CDEF3059E246BC07018748158BF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F~....k...k...k..M....k..M....k...6...k...j.r.k.......k..M..F.k..M....k.......k.Rich..k.................PE..L....H.].................Z.........~T.......p....@.......................................@.....................................x....p..........................</......................................@............p...............................text...jY.......Z.................. ..`.rdata..t....p.......^..............@..@.data....F... ......................@....rsrc........p.......(..............@..@.reloc..</.......0.................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\is-P06ER.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	564293
Entropy (8bit):	7.997207769094986
Encrypted:	true
SSDEEP:	12288:hQ5Xj+YQZe+pST1KPOVuCKQ702voiCVpN7hqjTEaBA:hWbUTO1rVuCt7Dd0N1q/EaBA
MD5:	F04A978A1C0B1A7532CDA9EF1E14AE43
SHA1:	5EEF3C74A9BEF7643E00F6A62C401C207836EB49
SHA-256:	EC06A73A3CFB2FAAF8E293C872928AFE48537D1F6FD4E101757E1A01C1253C44
SHA-512:	348220059FD5C40A3EBD2646029081E58FDD590142C2FB20B96E3C2DE14F3641DF6098F019D4472F4DD3F6A730198505CF3CAC2C8A43E28B464731CC8D2B28B4
Malicious:	false
Preview:	........flashinfo.............................................TWN4............Q.;.code.........................M..4...M4gZ.....[=....Z..C;.]a..A.f.:}..A.c~T..........K.....^5X...........O........4.)y.G.v..f...]...c..h..B...pN..Uo..."..p...}....do...\|.......M\|..x"-..}0#....m......K...I...\|.}[..+.......a.N.1....v..p..X.`....8....7ntF.jZ.@...m..P.$...........ro\|.JMO....u.z......@..q.M5..;qj.<...d...T.. .cJc.+P..).3=....k..j..I..A.^.h..(.{.n..9....CL...6.)....i./.r.7..d..d..........g..w.e..)....]9T#....<....D.{N.%q._..k.m..{02$..g.N.....+.O6..Q.`.....!.(^..5&.....=i......iG=%...}.<.V.:."..#.]..B.d5.....iN...h..f....C..J7............V.R..."e..Fb..E.B'o..,=f..0...2.1=z.>.....K.....WD.A....\L....A?..a..4..D.+..o....8^.X7X.j/?6.....buJO..v.].Q.T..]6..2`r6:r..A.Xx.S.-`...+....y8v....z.&8.....A..d.=.F.~..S..d.J.%....fx.2..0...tI0x. (0\|...:...[6.s...b;>_Ov.D*4u}...-.............E9f....s.5.....I....k.../....&...d....aJ.${?..#n..p....l.p..K..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\twn4\run_upgrade.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.700424768234197
Encrypted:	false
SSDEEP:	6:hcPzeMBNFQvC9ANUzH/hAKFMWUWBhpQh4nfBlE2SLXYWKhv:2zeMwVNUjhATPepQOg2SLIWqv
MD5:	061F9C364E524C3F316BA9C31F5ACA4C
SHA1:	59350781308BF56FB587A86F0354F8597391B3F1
SHA-256:	E86730C240D26443F536272CD7A76EEE3658995261522A2C09B149DE21DC1B5B
SHA-512:	3CEED1DAFA84F00435773BA8BFC3056487DA330BBBFE1FC300D079DBA2D8BFDD8ECEDADB4A85D70F03FEADD8AF6EA79C20DFC233A51780741BD4EE6AA46B9EEA
Malicious:	false
Preview:	@echo off....echo Connect RFID USB Reader to PC...echo Note: Only one reader may be upgraded at a time, so please ensure only one is connected during upgrade...echo...pause..echo.....flash.exe USB TWN4_4.07.bix....echo...echo Upgrade finished...echo...pause..

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	InnoSetup Log \0012N\302\256 USB Driver {5fda30b3-2910-4b09-afc2-7316f56d94d3}, version 0x418, 58621 bytes, 506013\37\user\, C:\Program Files (x86)\2N TELEKOMUNIKACE\2
Category:	dropped
Size (bytes):	58621
Entropy (8bit):	4.041606356652017
Encrypted:	false
SSDEEP:	384:xvYN5B8pWfkz4YisF18rtBiMEyOkWwKXzhm+a7ASX4w7E2w+jb3b0TggOaYKDdN/:BMtBiM/mhmfAfn2HLakqbLo2
MD5:	ADED706F85D83F7C12EFBCC43EEF4928
SHA1:	E924113115840D3DA6CB4332C5F65E127DC896E8
SHA-256:	C927FD164B05B7DECFE8B7E692A7F6F225E64CBC90B3D663F3A48C89F44C58C4
SHA-512:	92422C6207FF115B91A410B7B39E54C38F096860BA41E6ADC04D544BC0CA92DAB9EF70C5B8C214D7936D7A9CE1D4C44A99F32879688C64368CC359153716D9B2
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{5fda30b3-2910-4b09-afc2-7316f56d94d3}...........................................................................................2N. USB Driver....................................................................................................................E........................................................................................................................."..........U.................5.0.6.0.1.3......e.n.g.i.n.e.e.r......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.\.2.N. .U.S.B. .D.r.i.v.e.r....................... .....V.....P..IFPS....,...[....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM................

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3304509
Entropy (8bit):	6.3779939789652325
Encrypted:	false
SSDEEP:	49152:/dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEj/333s8+S:kHDYsqiPRhINnq95FoHVB/333zN
MD5:	BB922B90BCAAEB27241529FD6D1EED6B
SHA1:	BAC3219B3648575FB4FD3B09214A190FC4CA0494
SHA-256:	C841BCD21E9A2EC4B511EF3D09DDD1E5303DB2D45D4AE0C51763327BC8803F46
SHA-512:	1427663391A0D0C9DF53B634BC8FB42FBD4694A0AE8E5BDB9260A188DC7FEA51FFBB2C35114691F2BEEBD249C9B6808FEF215E30D417C4FB24E81C6D9031709D
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................2...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\FPSensor\Biokey\USB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57040
Entropy (8bit):	5.23554881490606
Encrypted:	false
SSDEEP:	768:F7+X29xEGx3YTns8MExkVbTo9V7nIEGXSEmXMocAhaN:F7+X29asITns1E2poX7BYL4M/AhaN
MD5:	D5928A9198D8E813141A5D94C67141B5
SHA1:	C00F50691B77A658866E84737BC038D6D7EBD076
SHA-256:	9FD683F7A7460106DCE831575FCD02980FC678D8FD4B0C5596950866200BB264
SHA-512:	61C44DBDEF85C0587C5845DD0A2BD53E6BDEF36E5634A02FCA52F92528503877DF22094D33B25C249127481FD7FAF630B845B6837984BE76A5DEE873B219E292
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h.o.5...h.D.b...h./.f...h..{...h...i..h.D.c...h...n...h.D.l...h.Rich..h.........PE..L......J...........!.....@...P......W........P......................................d................................Z......tT..d........................>......`....................................................P...............................text....6.......@.................. ..`.rdata.......P.......P..............@..@.data...\....`.......`..............@...shared.......p.......p..............@....rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPCap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.3357109355158245
Encrypted:	false
SSDEEP:	1536:2MTAKOzlB4baQXEHRtxoDNZn7yXLkzDqlVsrqybP0l6eo335WKp2MW/K:21zHd2ZDDtmyIFoH5Wk2M8K
MD5:	8AD4E99751E9281262D30EEAE22EE358
SHA1:	3D8BF1A0BE4A7FD9064D6217F96F3AF4F486920B
SHA-256:	0770DB70040F2327EE8646B73AD33BF33E7D5A9F1C5C89034AEFB8BA236EF16C
SHA-512:	0DF2E95A34F9A857F1756E689B1F2C2C2438193006E8B1494F36B9BAD554B8AE84F30690F110C22518321700B79CF8650A02C8C77DD5EBEB5DD8F023C600C817
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............f.......f.......f........l..............f.......f.......L.......f......Rich....................PE..L...Px.W...........!................9F..............................................$.....@..........................0.......(..<...............................H...................................( ..@...............`............................text...F........................... ..`.rdata..QU.......V..................@..@.data...\|2...@......................@....rsrc................4..............@..@.reloc...............:..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\is-6789O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	6.355626141676483
Encrypted:	false
SSDEEP:	1536:ZjPXhenY/+D4OrxvBPo+Svf92dqr9veJkYlnzBPRfcm9dr:RXhD/44MpPo+2fwqrctZkm9
MD5:	DD6A826FC7EEEAF60EADED99E5336337
SHA1:	205C4758050A49E42C4874E240D5CC3CB372707B
SHA-256:	83C7A058D60966445360B45B6BB0B7491982BED6F32DBE40CB301957A7837CFD
SHA-512:	1F7F807FC21F7568D4BA6EE1566B7F28169EBD71E65376A82DCB8B2F06AB377D64FC59021117FD4F528FF08DE4AE19DB2877C7D708C176D144145A376F4A6739
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z.e.).e.).e.)...).e.)..1).e.)...).e.)...).e.)..<).e.).e.).e.)...).e.)..4).e.)..2).e.)Rich.e.)........................PE..L...O..W...........!.........n......K]....... ......................................4(....@..........................Y.......Q..P....................................!...............................H..@............ ..\............................text...-........................... ..`.rdata.. ;... ...<..................@..@.data....2...`.......P..............@....rsrc................d..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\is-IQ2A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.606697027164951
Encrypted:	false
SSDEEP:	3072:koXMFtFmwr5KjXniSzUKSX0id92iaq93Qv34cCwukfU4xbShdxyKH7AbOI5Zp+L:kocDj1FKxiqq93Qv3fCJ4djp+
MD5:	C2FE3529B22E51386978C1B4B6963CC8
SHA1:	0B3178295C9A9AB7394993C9B4C37739E46A4217
SHA-256:	89924EAFE7657530C2B73C44EA2A8B6964B7E0B9DB35B6EBF5A631CEE33F32B6
SHA-512:	BC3777ED6446BDB662573CD64A6108917C12F1E3F9F16EE189A3855D39FF8C15596ABAA987D1C663A7FE4767280F2342641AD6D4FAE8D04243547568706BC455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H(4f.IZ5.IZ5.IZ5.1.5=IZ5.1.5.IZ5.1.5.IZ5+.!5.IZ5.I[5fIZ5.1.5.IZ5.1.5.IZ5.1.5.IZ5Rich.IZ5........PE..L...kx.W...........!................ v..............................................-b....@..........................?.......6..<...............................\...................................8+..@...............h............................text...?........................... ..`.rdata...@.......B..................@..@.data...\D...P...(...(..............@....rsrc................P..............@..@.reloc........... ...R..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\is-LSDUN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.358233973445306
Encrypted:	false
SSDEEP:	1536:iGl5rIeL2xcqzOGqaTUvkCtcWDAgD3Xp3uwTl5SO:im5rIF7KkCh+wB5S
MD5:	9F9F1387FFBD8CC7B69BF45AAB812237
SHA1:	9AFAA08B37A8A94A92B9C416F62058CFEFC7FFB4
SHA-256:	4225264E7E015BFB2A2D76EE529C7C38B2ACA81C9E83BE858FE11342DA4948E3
SHA-512:	34832DC1D74D7A68835C7C571E68D5230021DE503BE2CD60318116D5C8E26F3F97B9574D772C0F647A561F3D7B7D0437584F7BEAEC9EA7672CD6417E40EFC124
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Q.Y.Q.Y.Q.Y.J\|.S.Y.X..\|.Y.X..C.Y.X..!.Y.v'".R.Y.Q.X.2.Y.X..V.Y.X..P.Y.X..P.Y.RichQ.Y.........PE..L...jx.W...........!.........`......]L....................................................@........................../.......(..<....p..................................................................@...............H............................text...?........................... ..`.rdata...1.......2..................@..@.data....-...@.......&..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\libdpcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.358233973445306
Encrypted:	false
SSDEEP:	1536:iGl5rIeL2xcqzOGqaTUvkCtcWDAgD3Xp3uwTl5SO:im5rIF7KkCh+wB5S
MD5:	9F9F1387FFBD8CC7B69BF45AAB812237
SHA1:	9AFAA08B37A8A94A92B9C416F62058CFEFC7FFB4
SHA-256:	4225264E7E015BFB2A2D76EE529C7C38B2ACA81C9E83BE858FE11342DA4948E3
SHA-512:	34832DC1D74D7A68835C7C571E68D5230021DE503BE2CD60318116D5C8E26F3F97B9574D772C0F647A561F3D7B7D0437584F7BEAEC9EA7672CD6417E40EFC124
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Q.Y.Q.Y.Q.Y.J\|.S.Y.X..\|.Y.X..C.Y.X..!.Y.v'".R.Y.Q.X.2.Y.X..V.Y.X..P.Y.X..P.Y.RichQ.Y.........PE..L...jx.W...........!.........`......]L....................................................@........................../.......(..<....p..................................................................@...............H............................text...?........................... ..`.rdata...1.......2..................@..@.data....-...@.......&..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\libsilkidcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	6.355626141676483
Encrypted:	false
SSDEEP:	1536:ZjPXhenY/+D4OrxvBPo+Svf92dqr9veJkYlnzBPRfcm9dr:RXhD/44MpPo+2fwqrctZkm9
MD5:	DD6A826FC7EEEAF60EADED99E5336337
SHA1:	205C4758050A49E42C4874E240D5CC3CB372707B
SHA-256:	83C7A058D60966445360B45B6BB0B7491982BED6F32DBE40CB301957A7837CFD
SHA-512:	1F7F807FC21F7568D4BA6EE1566B7F28169EBD71E65376A82DCB8B2F06AB377D64FC59021117FD4F528FF08DE4AE19DB2877C7D708C176D144145A376F4A6739
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z.e.).e.).e.)...).e.)..1).e.)...).e.)...).e.)..<).e.).e.).e.)...).e.)..4).e.)..2).e.)Rich.e.)........................PE..L...O..W...........!.........n......K]....... ......................................4(....@..........................Y.......Q..P....................................!...............................H..@............ ..\............................text...-........................... ..`.rdata.. ;... ...<..................@..@.data....2...`.......P..............@....rsrc................d..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\ZKFPSensors\libzklibcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.606697027164951
Encrypted:	false
SSDEEP:	3072:koXMFtFmwr5KjXniSzUKSX0id92iaq93Qv34cCwukfU4xbShdxyKH7AbOI5Zp+L:kocDj1FKxiqq93Qv3fCJ4djp+
MD5:	C2FE3529B22E51386978C1B4B6963CC8
SHA1:	0B3178295C9A9AB7394993C9B4C37739E46A4217
SHA-256:	89924EAFE7657530C2B73C44EA2A8B6964B7E0B9DB35B6EBF5A631CEE33F32B6
SHA-512:	BC3777ED6446BDB662573CD64A6108917C12F1E3F9F16EE189A3855D39FF8C15596ABAA987D1C663A7FE4767280F2342641AD6D4FAE8D04243547568706BC455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H(4f.IZ5.IZ5.IZ5.1.5=IZ5.1.5.IZ5.1.5.IZ5+.!5.IZ5.I[5fIZ5.1.5.IZ5.1.5.IZ5.1.5.IZ5Rich.IZ5........PE..L...kx.W...........!................ v..............................................-b....@..........................?.......6..<...............................\...................................8+..@...............h............................text...?........................... ..`.rdata...@.......B..................@..@.data...\D...P...(...(..............@....rsrc................P..............@..@.reloc........... ...R..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\biokey.ocx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	879616
Entropy (8bit):	6.536958536200347
Encrypted:	false
SSDEEP:	12288:3XfB7x1QjmRZU7XWSorSUaz9olqgvYNmd0/a9M6GYb2UvAEZwL3:3v9PnUZ0JFvYNmC/amdnUvAE6L
MD5:	453CBBC7F58FC864FFAE72E208AE1C3A
SHA1:	77C9A11551DAF1F4CE99BBBF6965228E8CC38EDE
SHA-256:	43992FAE86CD2F800FD2162488DED16F5624044FAFAD8B898BA9C5783E5650B3
SHA-512:	E642E6874068236B6D1226EF9254CB23ED8130689B0C920F7898D65696E20888E7DCA00D56DA17822C251BEA4D997BDE982BE64F67101B826B3605169C5A0A06
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................,.............@..................................................................`.......0..6(...........................p.....................................................................................CODE....D........................... ..`DATA.....=.......>..................@...BSS.......... ...........................idata..6(...0.....................@....edata.......`.......4..............@..P.reloc......p.......6..............@..P.rsrc...............................@..P.....................l..............@..P................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\genpcid10.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437968
Entropy (8bit):	6.43779802951788
Encrypted:	false
SSDEEP:	6144:FMsVFZMgV9ZwBK104hP9QjSjl0lD7jEUtafuISFfOxjXRpIVvY:FM8MgV9ZYXjfD7jEUafufGBh3
MD5:	67FF5120AF0C66C8CDA13976DBBD30A7
SHA1:	9893906F8A662EC09781B2246F5B513400EC1A3D
SHA-256:	07B0A983D8A87C0645E3D30D08DA68864D12982B61DC73A5851706CA92CEBD83
SHA-512:	DFC7ACEEEE8C12806317A66AF4122952E211037B5AB6EE7EA21F2A2F08815822398636A9635BBAAD9C5BB9961C7F6EAD661C32DD2052A15474D61DE87AD574BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............@...@...@a..@...@a..@...@...@...@5w.@...@.u.@...@.u.@...@,..@...@...@...@.u.@...@.u.@...@.u.@...@Rich...@................PE..L......I.............................n............@........................................................................h........@..bm...........p...>......................................................................@....................text............................... ..`.rdata..............................@..@.data...x}.......@..................@...mx_api.......0......................@....v-lizerbm...@...p..................`...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-67MM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57040
Entropy (8bit):	5.23554881490606
Encrypted:	false
SSDEEP:	768:F7+X29xEGx3YTns8MExkVbTo9V7nIEGXSEmXMocAhaN:F7+X29asITns1E2poX7BYL4M/AhaN
MD5:	D5928A9198D8E813141A5D94C67141B5
SHA1:	C00F50691B77A658866E84737BC038D6D7EBD076
SHA-256:	9FD683F7A7460106DCE831575FCD02980FC678D8FD4B0C5596950866200BB264
SHA-512:	61C44DBDEF85C0587C5845DD0A2BD53E6BDEF36E5634A02FCA52F92528503877DF22094D33B25C249127481FD7FAF630B845B6837984BE76A5DEE873B219E292
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h.o.5...h.D.b...h./.f...h..{...h...i..h.D.c...h...n...h.D.l...h.Rich..h.........PE..L......J...........!.....@...P......W........P......................................d................................Z......tT..d........................>......`....................................................P...............................text....6.......@.................. ..`.rdata.......P.......P..............@..@.data...\....`.......`..............@...shared.......p.......p..............@....rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-7A44I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.557869243384565
Encrypted:	false
SSDEEP:	1536:RgyebjsN4t+7B+2bNKbULJ55N3sv5Oqw:Ky9qtUXV2v5a
MD5:	128CC65B72B7453C61E944127F273B3F
SHA1:	85C66DC2FC167FDCE429A3B8956335E6121A1827
SHA-256:	538091707189F6471B5C6C6E31F3D4D47AACAD368A976F3B30E17EE625DC08CE
SHA-512:	E81533F09ACAAFC9E887F364454601A24E8B0446D8D5CBB141CA719D14A50DEC4152615C2DCCAECCB5C6FD29C973D7C14C41982A75429E42D2C2ACDA21B5313C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0J4#t+Zpt+Zpt+Zp}S.pj+Zp}S.ph+Zp}S.p.+Zp}S.pv+ZpS.!pq+Zpt+[p"+Zp}S.pv+Zp}S.pu+Zpjy.pu+Zp}S.pu+ZpRicht+Zp................PE..L...ex.W...........!.........\.......=.......................................p............@.......................... ......,...<....P.......................`.. ...P...................................@............................................text............................... ..`.rdata..^3.......4..................@..@.data........0......................@....rsrc........P......................@..@.reloc.......`.......$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-7FPM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4061184
Entropy (8bit):	6.583690589412483
Encrypted:	false
SSDEEP:	49152:oApSXa5dZPhyTmggNF7ipHtQY1Iz5JVCJUHfJIrCUElTwzagUYhglePaL:DSXabhh6mggPirZCJ7
MD5:	14EC3CEEEB5E381F661CD4282BD38E1E
SHA1:	33BA515062EA96173C889F5F798E13A29FB6DA88
SHA-256:	5D2D606DBA73DCB97F225FFDA3B12AF7A076F7106722F08D846B609DC2E03689
SHA-512:	BCFFAB3D285D2A8BE95020A770576EEBB74307EEABF280F1580892F13760A9CBB782341CC12C5B83C856502E954CD5C0AA6F1218A761F728ED7537C0E419F8EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tM.R.#FR.#FR.#F.Z.F[.#F[m.F}.#Fu.NFV.#Fu.XF].#FR."F..#F[m.F..#F[m.F..#F[m.FQ.#F[m.FS.#F[m.FS.#FRichR.#F........................PE..L....RV...........!......)...........%......................................>.......>...@..........................]:..'...P:...... =......................0=.\|H..P..............................H:8.@..............p............................text.....).......)................. ..`.rdata...u......v....).............@..@.data...(.....;......r;.............@....rsrc........ =......B<.............@..@.reloc..r....0=......D<.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-7VJVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118480
Entropy (8bit):	6.372537026847084
Encrypted:	false
SSDEEP:	1536:2T1/SwCmAkVzzSC1I/VvEEipaNEnGHVepk2kpWJ5rWLPDgGMYZEYPojbEVYx4O/1:2T1/s+zzlh9IcLjSLPDgGMRYAvEOKC
MD5:	26559E926545A52BDBE28722F843D7E7
SHA1:	770457D154EAAC37AE40EC5F42D27988DD59B9CA
SHA-256:	E23D0D08CFFE013CC0F1BA9B48E3F21475EFD2B2F97ACA34D5F6724BC309E359
SHA-512:	D6CB93200F50725556F7576D7886A5AA78D6E49EE939A0BCE8D10DA2EED41E16EB366C715505720F8FFA91BEF71CD033E7D1C1FCB684C10798C6FBD68976CD0F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+H.HJ&WHJ&WHJ&W[BOWIJ&W.])W^J&W.j"WJJ&W.]yW.J&W[B{WJJ&W.B{WKJ&WHJ'W.J&W.]FW^J&W.]zWIJ&W.AxWIJ&W.]\|WIJ&WRichHJ&W................PE..L....t{F...........!.................r......................................................................................0...P....`...-...............>.......................................... ...@...............l............................text............................... ..`.rdata...$.......0..................@..@.data...,8... ... ... ..............@....rsrc....-...`...0...@..............@..@.reloc..B........ ...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-DMGCA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.3357109355158245
Encrypted:	false
SSDEEP:	1536:2MTAKOzlB4baQXEHRtxoDNZn7yXLkzDqlVsrqybP0l6eo335WKp2MW/K:21zHd2ZDDtmyIFoH5Wk2M8K
MD5:	8AD4E99751E9281262D30EEAE22EE358
SHA1:	3D8BF1A0BE4A7FD9064D6217F96F3AF4F486920B
SHA-256:	0770DB70040F2327EE8646B73AD33BF33E7D5A9F1C5C89034AEFB8BA236EF16C
SHA-512:	0DF2E95A34F9A857F1756E689B1F2C2C2438193006E8B1494F36B9BAD554B8AE84F30690F110C22518321700B79CF8650A02C8C77DD5EBEB5DD8F023C600C817
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............f.......f.......f........l..............f.......f.......L.......f......Rich....................PE..L...Px.W...........!................9F..............................................$.....@..........................0.......(..<...............................H...................................( ..@...............`............................text...F........................... ..`.rdata..QU.......V..................@..@.data...\|2...@......................@....rsrc................4..............@..@.reloc...............:..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-DN8K5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126672
Entropy (8bit):	6.323876746202713
Encrypted:	false
SSDEEP:	3072:Ejz8XPtrS9VwZcN5Qo3aUMKtEdxiMXuol+9:6cVW9VwZpdxiD
MD5:	C02556D91370B2324E4605AF60F271F1
SHA1:	72C1C1266C69A7DCCD89D2E88126F75998098CA4
SHA-256:	FA256217079D7A8794513A24D19DCC9524B4EECC9EE7BCC59E885645C61FC59B
SHA-512:	A9318C820AE3F5B4D6044BBF7BE5A054A4CBB3F9A9058301F027249273592C3BA003D7EE9DD4FF186FA1E028F76A19F3555A42EF6BF05086855097F286B33672
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+U.MJ;.MJ;.MJ;.6V7.OJ;.U0.EJ;..V5.XJ;.U1.!J;..U(.NJ;./U(.HJ;.MJ:.*J;.j1.BJ;.j0.OJ;.L=.LJ;.j?.LJ;.RichMJ;.........................PE..L....>B...........!...................................................................................................._.......P....... ................>......d.......................................................x............................text............................... ..`.rdata..O........ ..................@..@.data...L_...0...P...0..............@....rsrc... ...........................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-FRDNV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.511252255263352
Encrypted:	false
SSDEEP:	1536:V78V52TE0K60GeKCwy/OV+8lmYQukZRMF:K57v6VhASmYX0RMF
MD5:	ACAEADA6A9B28DCE66AA50893E1962A0
SHA1:	7D241B540D6268F317941F9E0151304EFE9E4FCC
SHA-256:	EDD764C562628ECB2FDB4C8B5C48827C8221278333F632ADACB82C3644CC9B42
SHA-512:	0FEA0D6D5CC8DF6A015AF41E6764E3C885D6634D8EC4320B5C747C3E11B745B25806A0D22F8B21C115BE897BA1CE51BE788F322CE6B3825EDEC0AEE109AC0DD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..^..I^..I^..IWpYIE..IWpHIE..IWp^I...Iy.I]..I^..I...IWpTI\..IWpOI_..I@ZII_..IWpLI_..IRich^..I........PE..L...bx.W...........!.........l.......5.......................................p...........@.........................@ ..........(....P.......................`..p...0...............................8...@............................................text............................... ..`.rdata..6B.......D..................@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..,....`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-IO0QL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	879616
Entropy (8bit):	6.536958536200347
Encrypted:	false
SSDEEP:	12288:3XfB7x1QjmRZU7XWSorSUaz9olqgvYNmd0/a9M6GYb2UvAEZwL3:3v9PnUZ0JFvYNmC/amdnUvAE6L
MD5:	453CBBC7F58FC864FFAE72E208AE1C3A
SHA1:	77C9A11551DAF1F4CE99BBBF6965228E8CC38EDE
SHA-256:	43992FAE86CD2F800FD2162488DED16F5624044FAFAD8B898BA9C5783E5650B3
SHA-512:	E642E6874068236B6D1226EF9254CB23ED8130689B0C920F7898D65696E20888E7DCA00D56DA17822C251BEA4D997BDE982BE64F67101B826B3605169C5A0A06
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\FPSensor\Biokey\is-IO0QL.tmp, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................,.............@..................................................................`.......0..6(...........................p.....................................................................................CODE....D........................... ..`DATA.....=.......>..................@...BSS.......... ...........................idata..6(...0.....................@....edata.......`.......4..............@..P.reloc......p.......6..............@..P.rsrc...............................@..P.....................l..............@..P................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\is-OEOP9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	207568
Entropy (8bit):	6.682655587433739
Encrypted:	false
SSDEEP:	3072:8aUES0lTUv8lx0cdv/NSdg9+zVv+WAj/vPZU5hkjgqFUTDHYr2:8b+Ta8l42gzVv+W+PZU5hqp2
MD5:	2C0CDD4B1DD270B2223F79C35F4F960B
SHA1:	4F95DC05362C3F5FD751B6F4DCC83521872EEBE7
SHA-256:	5D28889014CA8124E5346B7CBE2F25BE734F703EEFF101680CD8E6194594D708
SHA-512:	C7AB0483DFD411BECBF91467FBA60648913F2618E01B1F5BC7C23FF870C72CA063B88AD1C3EB905B59D3A97D3AE624B9CB4AE219DEB994EBD38161DA026A22B6
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....*J...........#.....P..........X........`....@..........................p..................................................t.... ...................>...@...'...................................................................................text....P.......J.................. ..`.data........`...J...P..............@....tls................................@....idata..............................@..@.edata..............................@..@.rsrc.... ... ......................@..@

C:\Program Files (x86)\FPSensor\Biokey\is-P2BL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437968
Entropy (8bit):	6.43779802951788
Encrypted:	false
SSDEEP:	6144:FMsVFZMgV9ZwBK104hP9QjSjl0lD7jEUtafuISFfOxjXRpIVvY:FM8MgV9ZYXjfD7jEUafufGBh3
MD5:	67FF5120AF0C66C8CDA13976DBBD30A7
SHA1:	9893906F8A662EC09781B2246F5B513400EC1A3D
SHA-256:	07B0A983D8A87C0645E3D30D08DA68864D12982B61DC73A5851706CA92CEBD83
SHA-512:	DFC7ACEEEE8C12806317A66AF4122952E211037B5AB6EE7EA21F2A2F08815822398636A9635BBAAD9C5BB9961C7F6EAD661C32DD2052A15474D61DE87AD574BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............@...@...@a..@...@a..@...@...@...@5w.@...@.u.@...@.u.@...@,..@...@...@...@.u.@...@.u.@...@.u.@...@Rich...@................PE..L......I.............................n............@........................................................................h........@..bm...........p...>......................................................................@....................text............................... ..`.rdata..............................@..@.data...x}.......@..................@...mx_api.......0......................@....v-lizerbm...@...p..................`...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\libcorrect.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.511252255263352
Encrypted:	false
SSDEEP:	1536:V78V52TE0K60GeKCwy/OV+8lmYQukZRMF:K57v6VhASmYX0RMF
MD5:	ACAEADA6A9B28DCE66AA50893E1962A0
SHA1:	7D241B540D6268F317941F9E0151304EFE9E4FCC
SHA-256:	EDD764C562628ECB2FDB4C8B5C48827C8221278333F632ADACB82C3644CC9B42
SHA-512:	0FEA0D6D5CC8DF6A015AF41E6764E3C885D6634D8EC4320B5C747C3E11B745B25806A0D22F8B21C115BE897BA1CE51BE788F322CE6B3825EDEC0AEE109AC0DD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..^..I^..I^..IWpYIE..IWpHIE..IWp^I...Iy.I]..I^..I...IWpTI\..IWpOI_..I@ZII_..IWpLI_..IRich^..I........PE..L...bx.W...........!.........l.......5.......................................p...........@.........................@ ..........(....P.......................`..p...0...............................8...@............................................text............................... ..`.rdata..6B.......D..................@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..,....`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\libsilkid.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.557869243384565
Encrypted:	false
SSDEEP:	1536:RgyebjsN4t+7B+2bNKbULJ55N3sv5Oqw:Ky9qtUXV2v5a
MD5:	128CC65B72B7453C61E944127F273B3F
SHA1:	85C66DC2FC167FDCE429A3B8956335E6121A1827
SHA-256:	538091707189F6471B5C6C6E31F3D4D47AACAD368A976F3B30E17EE625DC08CE
SHA-512:	E81533F09ACAAFC9E887F364454601A24E8B0446D8D5CBB141CA719D14A50DEC4152615C2DCCAECCB5C6FD29C973D7C14C41982A75429E42D2C2ACDA21B5313C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0J4#t+Zpt+Zpt+Zp}S.pj+Zp}S.ph+Zp}S.p.+Zp}S.pv+ZpS.!pq+Zpt+[p"+Zp}S.pv+Zp}S.pu+Zpjy.pu+Zp}S.pu+ZpRicht+Zp................PE..L...ex.W...........!.........\.......=.......................................p............@.......................... ......,...<....P.......................`.. ...P...................................@............................................text............................... ..`.rdata..^3.......4..................@..@.data........0......................@....rsrc........P......................@..@.reloc.......`.......$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\mi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	207568
Entropy (8bit):	6.682655587433739
Encrypted:	false
SSDEEP:	3072:8aUES0lTUv8lx0cdv/NSdg9+zVv+WAj/vPZU5hkjgqFUTDHYr2:8b+Ta8l42gzVv+W+PZU5hqp2
MD5:	2C0CDD4B1DD270B2223F79C35F4F960B
SHA1:	4F95DC05362C3F5FD751B6F4DCC83521872EEBE7
SHA-256:	5D28889014CA8124E5346B7CBE2F25BE734F703EEFF101680CD8E6194594D708
SHA-512:	C7AB0483DFD411BECBF91467FBA60648913F2618E01B1F5BC7C23FF870C72CA063B88AD1C3EB905B59D3A97D3AE624B9CB4AE219DEB994EBD38161DA026A22B6
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....*J...........#.....P..........X........`....@..........................p..................................................t.... ...................>...@...'...................................................................................text....P.......J.................. ..`.data........`...J...P..............@....tls................................@....idata..............................@..@.edata..............................@..@.rsrc.... ... ......................@..@

C:\Program Files (x86)\FPSensor\Biokey\usb_dll.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118480
Entropy (8bit):	6.372537026847084
Encrypted:	false
SSDEEP:	1536:2T1/SwCmAkVzzSC1I/VvEEipaNEnGHVepk2kpWJ5rWLPDgGMYZEYPojbEVYx4O/1:2T1/s+zzlh9IcLjSLPDgGMRYAvEOKC
MD5:	26559E926545A52BDBE28722F843D7E7
SHA1:	770457D154EAAC37AE40EC5F42D27988DD59B9CA
SHA-256:	E23D0D08CFFE013CC0F1BA9B48E3F21475EFD2B2F97ACA34D5F6724BC309E359
SHA-512:	D6CB93200F50725556F7576D7886A5AA78D6E49EE939A0BCE8D10DA2EED41E16EB366C715505720F8FFA91BEF71CD033E7D1C1FCB684C10798C6FBD68976CD0F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+H.HJ&WHJ&WHJ&W[BOWIJ&W.])W^J&W.j"WJJ&W.]yW.J&W[B{WJJ&W.B{WKJ&WHJ'W.J&W.]FW^J&W.]zWIJ&W.AxWIJ&W.]\|WIJ&WRichHJ&W................PE..L....t{F...........!.................r......................................................................................0...P....`...-...............>.......................................... ...@...............l............................text............................... ..`.rdata...$.......0..................@..@.data...,8... ... ... ..............@....rsrc....-...`...0...@..............@..@.reloc..B........ ...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\wd_utils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126672
Entropy (8bit):	6.323876746202713
Encrypted:	false
SSDEEP:	3072:Ejz8XPtrS9VwZcN5Qo3aUMKtEdxiMXuol+9:6cVW9VwZpdxiD
MD5:	C02556D91370B2324E4605AF60F271F1
SHA1:	72C1C1266C69A7DCCD89D2E88126F75998098CA4
SHA-256:	FA256217079D7A8794513A24D19DCC9524B4EECC9EE7BCC59E885645C61FC59B
SHA-512:	A9318C820AE3F5B4D6044BBF7BE5A054A4CBB3F9A9058301F027249273592C3BA003D7EE9DD4FF186FA1E028F76A19F3555A42EF6BF05086855097F286B33672
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+U.MJ;.MJ;.MJ;.6V7.OJ;.U0.EJ;..V5.XJ;.U1.!J;..U(.NJ;./U(.HJ;.MJ:.*J;.j1.BJ;.j0.OJ;.L=.LJ;.j?.LJ;.RichMJ;.........................PE..L....>B...........!...................................................................................................._.......P....... ................>......d.......................................................x............................text............................... ..`.rdata..O........ ..................@..@.data...L_...0...P...0..............@....rsrc... ...........................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\Biokey\zkfputil.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4061184
Entropy (8bit):	6.583690589412483
Encrypted:	false
SSDEEP:	49152:oApSXa5dZPhyTmggNF7ipHtQY1Iz5JVCJUHfJIrCUElTwzagUYhglePaL:DSXabhh6mggPirZCJ7
MD5:	14EC3CEEEB5E381F661CD4282BD38E1E
SHA1:	33BA515062EA96173C889F5F798E13A29FB6DA88
SHA-256:	5D2D606DBA73DCB97F225FFDA3B12AF7A076F7106722F08D846B609DC2E03689
SHA-512:	BCFFAB3D285D2A8BE95020A770576EEBB74307EEABF280F1580892F13760A9CBB782341CC12C5B83C856502E954CD5C0AA6F1218A761F728ED7537C0E419F8EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tM.R.#FR.#FR.#F.Z.F[.#F[m.F}.#Fu.NFV.#Fu.XF].#FR."F..#F[m.F..#F[m.F..#F[m.FQ.#F[m.FS.#F[m.FS.#FRichR.#F........................PE..L....RV...........!......)...........%......................................>.......>...@..........................]:..'...P:...... =......................0=.\|H..P..............................H:8.@..............p............................text.....).......)................. ..`.rdata...u......v....).............@..@.data...(.....;......r;.............@....rsrc........ =......B<.............@..@.reloc..r....0=......D<.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\UnInsDrvZ.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	133328
Entropy (8bit):	6.1005042445574
Encrypted:	false
SSDEEP:	3072:Boz0aR5MFd7lL8oZAXyMz5Zl4xHeWQ7ZE:Bq0nH7lLNZE/o
MD5:	9646E407DCED250E0722CF773472011C
SHA1:	FB19E5586DE9E3225C4B75DC0ACE608CD88E1C63
SHA-256:	301FC5B889EB2BB2EB5689057FC8223927B1510B748872905108E05EE1563BF6
SHA-512:	4BC2C7B3C45E692483A08CD6019495FAA03000D6F40A220F24E3859BF117097E7372D754189E77108500728248D3E3158DD73139A7EAE4489D99C96A9F751BBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.{.p...p...p...n...^...n...`...n.......Won.y...p......n...t...n...q...n...q...Richp...........PE..L....eJ.............................e............@.................................Ly....@.....................................d....`...................>......<...p...................................@...............,............................text............................... ..`.rdata...3.......4..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\bin\iZHost.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299728
Entropy (8bit):	6.531396123299363
Encrypted:	false
SSDEEP:	6144:NqJCTGrlyNjSyOGvbgq6seOaFdD360dBCs9SumRSo1Lcp/a2Fk:NqbrgJ956seOaX3rJ9SZs/a7
MD5:	B004D352AE83A3900A99DC7ABBAAF22B
SHA1:	A95438FCAAF352C69B379E0403A3D0C1E6165C90
SHA-256:	BE55C495775B74E3165130A86ED67C090CAEF1E87A19EE9759FC82B805565756
SHA-512:	CE76A89C712E3952C0B6527A6686127FD2D217C9C2D37EA0C5270C51466F32B1C1D52E2E6420C10B70DA3E83074860BEC84C5534F9FE8351610D8F0FB1E1E221
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Wk..Wk..Wk..I9W.vk...H..Uk..p...Sk..p...Xk..Wk...k..)I..Vk...t..Vk..I9F..k..I9A..k..I9V.Vk..I9S.Vk..RichWk..........PE..L...=..Q.................x..........2X............@...........................T......................................................pT..............T...>..........p................................................................................text...lw.......x.................. ..`.rdata..X............\|..............@..@.data...L5P..0...$..................@....rsrc........pT......>..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\bin\is-HIV50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299728
Entropy (8bit):	6.531396123299363
Encrypted:	false
SSDEEP:	6144:NqJCTGrlyNjSyOGvbgq6seOaFdD360dBCs9SumRSo1Lcp/a2Fk:NqbrgJ956seOaX3rJ9SZs/a7
MD5:	B004D352AE83A3900A99DC7ABBAAF22B
SHA1:	A95438FCAAF352C69B379E0403A3D0C1E6165C90
SHA-256:	BE55C495775B74E3165130A86ED67C090CAEF1E87A19EE9759FC82B805565756
SHA-512:	CE76A89C712E3952C0B6527A6686127FD2D217C9C2D37EA0C5270C51466F32B1C1D52E2E6420C10B70DA3E83074860BEC84C5534F9FE8351610D8F0FB1E1E221
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Wk..Wk..Wk..I9W.vk...H..Uk..p...Sk..p...Xk..Wk...k..)I..Vk...t..Vk..I9F..k..I9A..k..I9V.Vk..I9S.Vk..RichWk..........PE..L...=..Q.................x..........2X............@...........................T......................................................pT..............T...>..........p................................................................................text...lw.......x.................. ..`.rdata..X............\|..............@..@.data...L5P..0...$..................@....rsrc........pT......>..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\is-SBIBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	722593
Entropy (8bit):	6.522048396529145
Encrypted:	false
SSDEEP:	12288:jQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyRm:jQYh1yLmSKrPD37zzH2A6QD/IpqggE2A
MD5:	AE4467B01F4E37CA8A0C98EEB028C96C
SHA1:	2F102B6DCF7C1D5B562407F5203DBF24D7A21AA7
SHA-256:	FC13574D82F9FE6C006A731D04512E189AF428880A5D09796D94DBB1A788370D
SHA-512:	3F2A08D91BE0BAB32AA9426653B163AE4795DAB15F1BA29A006FEA2C9BDC62E5F2B56026AE6EF9F72A2333F31128939EFC67D414852D131024B2574976CD1C0C
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&........................................................... ......................................................CODE....$........................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls.....................................rdata....... ......................@..P.reloc......0......................@..P.rsrc...............................@..P.....................f..............@..P........................................................................................................................................

C:\Program Files (x86)\FPSensor\is-SPF5F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	133328
Entropy (8bit):	6.1005042445574
Encrypted:	false
SSDEEP:	3072:Boz0aR5MFd7lL8oZAXyMz5Zl4xHeWQ7ZE:Bq0nH7lLNZE/o
MD5:	9646E407DCED250E0722CF773472011C
SHA1:	FB19E5586DE9E3225C4B75DC0ACE608CD88E1C63
SHA-256:	301FC5B889EB2BB2EB5689057FC8223927B1510B748872905108E05EE1563BF6
SHA-512:	4BC2C7B3C45E692483A08CD6019495FAA03000D6F40A220F24E3859BF117097E7372D754189E77108500728248D3E3158DD73139A7EAE4489D99C96A9F751BBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.{.p...p...p...n...^...n...`...n.......Won.y...p......n...t...n...q...n...q...Richp...........PE..L....eJ.............................e............@.................................Ly....@.....................................d....`...................>......<...p...................................@...............,............................text............................... ..`.rdata...3.......4..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209208
Entropy (8bit):	6.396780292708982
Encrypted:	false
SSDEEP:	3072:RifjaMjlW6hV2D45zm5VTb/LBg+3pKPawrvC1cTprOv81tDxUh:RQaMhhH2D45a5xrLBgmpKPawQEnk
MD5:	01BF190D0BAEC17CE5B40F2C4AB86764
SHA1:	FA66AA337F0DE801867B5BF675EF18B58E46BBE4
SHA-256:	7668EE2829543C10300F57F1F98C33465695DEE05A02B3F680207071877FFC50
SHA-512:	0B18FAE68F25AF2D055F3D3856EDE45512020E3A812F424067108E0CDF1C8B50E924FBC98B153AC78D390F68CC7A3E4F27F6B1D8D89669B1DC04004E08F5D887
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............\...\...\.bB\...\.bv\...\..w\...\._\...\.O\...\...\j..\.bw\...\.bG\...\.bF\...\.bA\...\Rich...\........PE..L...2..R...........!....."..........SI.......@...............................`......\.....@.................................,...........................8.... ..$#...B...............................~..@............@..h.......@....................text.... .......".................. ..`.rdata.......@.......&..............@..@.data...\|?..........................@....rsrc...............................@..@.reloc...;... ...<..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPDevTS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	547640
Entropy (8bit):	6.5097445472877515
Encrypted:	false
SSDEEP:	12288:P3Cf4IAG/p3HMJykHIeJ8gkUsAWksJF5DQLXInqKk3cTgHo:yyoMXXWkseInqdcTgI
MD5:	0C2E5C1B8F81747AA00699631268769E
SHA1:	34FBF337BB5AB6A8D1203BF339782EAEDD8FEB93
SHA-256:	EF2A4C8959D24650131EC66921263049878C2A72CF0A1FCCFBE47E99AF7DDA81
SHA-512:	DC8362B6DA88BA8CEB4A896B0E6D93A49A9D9EB67BE4CB8EACB73FB38EED2DEA106685B915F2AC2D85C1D4664CCDFC6E43F7DAEA34F1A7658F9EEDEC9245CDC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_<D.>R..>R..>R......>R.....#>R..H...>R..F...>R..F...>R..>S.@>R......>R......>R......>R......>R.Rich.>R.........PE..L......R...........!.....0..........}j.......@......................................B+....@.........................@................ ..p............B..8....0..0X.. D..................................@............@...............................text..../.......0.................. ..`.rdata...r...@...t...4..............@..@.data....Y.......8..................@....rsrc...p.... ......................@..@.reloc...X...0...Z..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264504
Entropy (8bit):	6.731019076402562
Encrypted:	false
SSDEEP:	6144:AaZk7C5ezhfQ78FH7y6kns23wulhj51AO8/Bcrf:BGC5yhfHH7/kns23DlhrO/uf
MD5:	42FB249752D7E606FC292F17DFE1D507
SHA1:	BBB0E986EFC5DEB4F38A5C789D632497CC6AA2C2
SHA-256:	5E251118DB31BFB9AAC79F4008FD833B8C4A324EEF7BCBF830B6C2B4D5DE8E44
SHA-512:	56AE06C61C2F0AD8501A71D4037DEE42C1AA5663BE5E636D2913A39591EAD29587D130320DAFBD038229ECD20B2BA3A9719D7AB0994BA2D5BF0BDB0BD8352C23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........`...`...`..l....`.......`.......`...`..`....".?`....#..`.......`.......`...`...`.......`..Rich.`..................PE..L...@..R...........!.........n.......0....... ............................................@.........................`...m......(....`..................8...........p!..................................@............ ..(............................text............................... ..`.rdata...y... ...z..................@..@.data............4..................@....rsrc........`......................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPPTUtils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149840
Entropy (8bit):	6.364600099349552
Encrypted:	false
SSDEEP:	3072:7yccUtEB1oaNVulL3WfwlhDa+VILaxb5oXH:7yvUtEB1nulrVlhDYcYH
MD5:	7029DECF531B25856E564FED66B58A40
SHA1:	5B1C4F4AFF15AA733F7A76A105BFE1CCC58D0002
SHA-256:	9A1695AF60FB74AE829EDA415CC4E39203E559FE593A5CF9FA4C68973512CAE9
SHA-512:	3866700316B0124BFF04C8802A7CBCADDEDA6B4F4D3690CC30E84D1D81BA60B50145D4AE15BD7CF1C21318D554B313DD8989A9B5F371DB4342C508785B203227
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1...b...b...b.65b..b.6.b...b.m.b..b.6.b.b...b..b..8b..b...bE..b.6.b..b.60b...b.61b...b.66b...bRich...b................PE..L...'./R...........!.....l...........................................................b....@.................................$...x....@...............0..P....P..t...@...................................@............................................text...0j.......l.................. ..`.rdata..w{.......\|...p..............@..@.data...x3..........................@....rsrc........@......................@..@.reloc...&...P...(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DpFnd2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	351032
Entropy (8bit):	6.335270219824983
Encrypted:	false
SSDEEP:	6144:kskqjZYeR5+Yp/Xc//Y3mYYpq53tcalx5UKDcmNVFoRVbJ:k/qjsYp/s//Yvvlx5UK4VRV1
MD5:	B91EE14EAC7A839B4BB2C6CE011118F0
SHA1:	83222AF6061592039905302D274052CD439379F3
SHA-256:	C3C96EAA15D345B2F54B5ACB3E03BA4259B3375C98309C72E369870860A79735
SHA-512:	06CED1075DB8ECCA6E8522C49DC17DB68E57A0EBAE301A3F3A937F4DD1D72C43243F1AD3427B8829EEBCAB250595844777F88E823C2E1F66F6A70BAAA4F026A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N... ... ... ..{.... ..{.... ....... ..... ...!.2. ..... ..{.... ..{.... ..{.... ..{.... .Rich.. .........PE..L...J..R...........!.........z............................................................@.............................[............ ...............B..8....0...<..@................................2..@............................................text............................... ..`.rdata..k...........................@..@.data....>..........................@....rsrc........ ......................@..@.reloc...Y...0...Z..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-0CJK9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209208
Entropy (8bit):	6.396780292708982
Encrypted:	false
SSDEEP:	3072:RifjaMjlW6hV2D45zm5VTb/LBg+3pKPawrvC1cTprOv81tDxUh:RQaMhhH2D45a5xrLBgmpKPawQEnk
MD5:	01BF190D0BAEC17CE5B40F2C4AB86764
SHA1:	FA66AA337F0DE801867B5BF675EF18B58E46BBE4
SHA-256:	7668EE2829543C10300F57F1F98C33465695DEE05A02B3F680207071877FFC50
SHA-512:	0B18FAE68F25AF2D055F3D3856EDE45512020E3A812F424067108E0CDF1C8B50E924FBC98B153AC78D390F68CC7A3E4F27F6B1D8D89669B1DC04004E08F5D887
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............\...\...\.bB\...\.bv\...\..w\...\._\...\.O\...\...\j..\.bw\...\.bG\...\.bF\...\.bA\...\Rich...\........PE..L...2..R...........!....."..........SI.......@...............................`......\.....@.................................,...........................8.... ..$#...B...............................~..@............@..h.......@....................text.... .......".................. ..`.rdata.......@.......&..............@..@.data...\|?..........................@....rsrc...............................@..@.reloc...;... ...<..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-5ERSO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	351032
Entropy (8bit):	6.335270219824983
Encrypted:	false
SSDEEP:	6144:kskqjZYeR5+Yp/Xc//Y3mYYpq53tcalx5UKDcmNVFoRVbJ:k/qjsYp/s//Yvvlx5UK4VRV1
MD5:	B91EE14EAC7A839B4BB2C6CE011118F0
SHA1:	83222AF6061592039905302D274052CD439379F3
SHA-256:	C3C96EAA15D345B2F54B5ACB3E03BA4259B3375C98309C72E369870860A79735
SHA-512:	06CED1075DB8ECCA6E8522C49DC17DB68E57A0EBAE301A3F3A937F4DD1D72C43243F1AD3427B8829EEBCAB250595844777F88E823C2E1F66F6A70BAAA4F026A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N... ... ... ..{.... ..{.... ....... ..... ...!.2. ..... ..{.... ..{.... ..{.... ..{.... .Rich.. .........PE..L...J..R...........!.........z............................................................@.............................[............ ...............B..8....0...<..@................................2..@............................................text............................... ..`.rdata..k...........................@..@.data....>..........................@....rsrc........ ......................@..@.reloc...Y...0...Z..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-9FD24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264504
Entropy (8bit):	6.731019076402562
Encrypted:	false
SSDEEP:	6144:AaZk7C5ezhfQ78FH7y6kns23wulhj51AO8/Bcrf:BGC5yhfHH7/kns23DlhrO/uf
MD5:	42FB249752D7E606FC292F17DFE1D507
SHA1:	BBB0E986EFC5DEB4F38A5C789D632497CC6AA2C2
SHA-256:	5E251118DB31BFB9AAC79F4008FD833B8C4A324EEF7BCBF830B6C2B4D5DE8E44
SHA-512:	56AE06C61C2F0AD8501A71D4037DEE42C1AA5663BE5E636D2913A39591EAD29587D130320DAFBD038229ECD20B2BA3A9719D7AB0994BA2D5BF0BDB0BD8352C23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........`...`...`..l....`.......`.......`...`..`....".?`....#..`.......`.......`...`...`.......`..Rich.`..................PE..L...@..R...........!.........n.......0....... ............................................@.........................`...m......(....`..................8...........p!..................................@............ ..(............................text............................... ..`.rdata...y... ...z..................@..@.data............4..................@....rsrc........`......................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-I03EA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	547640
Entropy (8bit):	6.5097445472877515
Encrypted:	false
SSDEEP:	12288:P3Cf4IAG/p3HMJykHIeJ8gkUsAWksJF5DQLXInqKk3cTgHo:yyoMXXWkseInqdcTgI
MD5:	0C2E5C1B8F81747AA00699631268769E
SHA1:	34FBF337BB5AB6A8D1203BF339782EAEDD8FEB93
SHA-256:	EF2A4C8959D24650131EC66921263049878C2A72CF0A1FCCFBE47E99AF7DDA81
SHA-512:	DC8362B6DA88BA8CEB4A896B0E6D93A49A9D9EB67BE4CB8EACB73FB38EED2DEA106685B915F2AC2D85C1D4664CCDFC6E43F7DAEA34F1A7658F9EEDEC9245CDC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_<D.>R..>R..>R......>R.....#>R..H...>R..F...>R..F...>R..>S.@>R......>R......>R......>R......>R.Rich.>R.........PE..L......R...........!.....0..........}j.......@......................................B+....@.........................@................ ..p............B..8....0..0X.. D..................................@............@...............................text..../.......0.................. ..`.rdata...r...@...t...4..............@..@.data....Y.......8..................@....rsrc...p.... ......................@..@.reloc...X...0...Z..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win32\is-J8TFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149840
Entropy (8bit):	6.364600099349552
Encrypted:	false
SSDEEP:	3072:7yccUtEB1oaNVulL3WfwlhDa+VILaxb5oXH:7yvUtEB1nulrVlhDYcYH
MD5:	7029DECF531B25856E564FED66B58A40
SHA1:	5B1C4F4AFF15AA733F7A76A105BFE1CCC58D0002
SHA-256:	9A1695AF60FB74AE829EDA415CC4E39203E559FE593A5CF9FA4C68973512CAE9
SHA-512:	3866700316B0124BFF04C8802A7CBCADDEDA6B4F4D3690CC30E84D1D81BA60B50145D4AE15BD7CF1C21318D554B313DD8989A9B5F371DB4342C508785B203227
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1...b...b...b.65b..b.6.b...b.m.b..b.6.b.b...b..b..8b..b...bE..b.6.b..b.60b...b.61b...b.66b...bRich...b................PE..L...'./R...........!.....l...........................................................b....@.................................$...x....@...............0..P....P..t...@...................................@............................................text...0j.......l.................. ..`.rdata..w{.......\|...p..............@..@.data...x3..........................@....rsrc........@......................@..@.reloc...&...P...(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPAppSyn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	368440
Entropy (8bit):	6.076848656307543
Encrypted:	false
SSDEEP:	6144:C4wxsHZOs3kYsmfOv+EaSn5wH8MZCu9KOZ28sTUTHsZxe111JuJe0748JsSY:3H53DXOv+EaOW8MZCWG8sTna
MD5:	B9CAA61A8FD61B252AF2982F34B7B5B1
SHA1:	25BEAB843EF484E5A68C120E3E85566BBC1FD4CF
SHA-256:	604BF17522D2753A206C2261A3197A72F0E3DB8E7DC55D91A4D072E0DC47A546
SHA-512:	991685F4D19098D0A18F0D7E05B9F3C38A272D461DDF3B6406A2184DFAEF1B2D224917F96036120FDB88DFEA95FF07E784E95E985DE67F2B25DD97683AC5A7FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..U%..U%..U%..N.I.W%..N....%..N.K._%..:S~.Q%..\]V.W%..\]F.B%..U%...%..N.~.n%..N.N.T%..N.O.T%..N.H.T%..RichU%..........PE..d......R.........." .................V...............................................5....@.........................................@&......P...........x........2......8............................................................................................text............................... ..`.rdata...v.......x..................@..@.data....V...0...0..................@....pdata...2.......4...>..............@..@.rsrc...x............r..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPCOper2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	499512
Entropy (8bit):	6.003611090169429
Encrypted:	false
SSDEEP:	6144:HPyJycdWEY/4lUZrYbd9YVV2TfiYenhTGMHTQyR0Ycf8zN0SqpMhf9jOsJ:HK11vlUCb7yV2TfVKEMK8zcpuxJ
MD5:	34F679A12CC4AEFD9520DCB4C5BD8A44
SHA1:	C6801AB37AC3F8DE5AA0044E621FEC3FF62017D0
SHA-256:	A08FD089432FEB23CF723590BD9FA616731249DC42B620D38C2D2D5942ADC6B4
SHA-512:	A511D04D0C2D07B454775367BEF022BB68DD5C35782A88F2D624EF0B2694181C28A98C878414E5075B267650EAAC37CFE9D6EDD19042684328B34983133247B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;V...7.B.7.B.7.Bd.YB.7.Bd.mBu7.B.AXBx7.BvOpB}7.BvO`Bl7.B.7.B.7.Bd.XBC7.Bd.hB~7.Bd.iB~7.Bd.nB~7.BRich.7.B........................PE..d...s..R.........." .................a........4......................................m....@.........................................`.......H...........8....p..hC......8.......x...........................................................H........................text...B........................... ..`.rdata...3.......4..................@..@.data....m.......F..................@....pdata..hC...p...D...*..............@..@.rsrc...8............n..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPCms.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235320
Entropy (8bit):	6.104809375327942
Encrypted:	false
SSDEEP:	6144:0OVhlyfHSIpnOfiTGNeh3+RGc7VTLxohy7HPljGC8d96:xVzyfHSIpnOfqGNeh0h7k6
MD5:	252D9D77EFD1B4DB0D6BBD2CE21D9126
SHA1:	B61307CC9371FD1B2324BB779FFE671F0404D414
SHA-256:	DEFB56C6F73F31C0FDE89236DEBE317E73088ABD5AF1CF8F0B31AD2983127D71
SHA-512:	FEFB5241AAB79EFEFB4145D0B8D142C58C715FBBA7BD7A646B17EA7533BEC1C591EFCB848CAEBC66543A09E15F8862E803A71FDA77C907B27CCF754756CC9608
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\...=...=...=....E.=....q..=..KD..=...El..=...E\|..=...=..Q=....D..=....t..=....u..=....r..=..Rich.=..................PE..d......R.........." .....8...B......TJ....................................................@..........................................2......x"..................."...~..8............U...............................................P.......!..@....................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data...PM...@...&... ..............@....pdata...".......$...F..............@..@.rsrc................j..............@..@.reloc..^............t..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPDevTS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	653112
Entropy (8bit):	6.186368410182239
Encrypted:	false
SSDEEP:	12288:luZZiyMwcj6gyio8wnS1cObQy0Cn9w8qjxw1OCysoanNcFl0bJ:letbglnZ0yW8UZn0bJ
MD5:	24C767E1B413C234099A92380E7A01EB
SHA1:	E47D30EDE3CAE1E36F95748E9259491D3544D5FF
SHA-256:	9F141975F27360914DB2344BDA01A0A66F9DE6FFEC987D13DD21B7CB278A106B
SHA-512:	BBF022B25EC3BD6A99D185532B7919B6B8DF1B6B1A88F4EAAB74E17B22C96DAE780EAB88DD27FEE83588B083E97FB63163AF0DFB6A8C75F3DD9662425433D7B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~S......................................................................................Rich............................PE..d...\|..R.........." .........X..............................................0............@.............................................................p........j......8.... ......P................................................................................text.............................. ..`.rdata..............................@..@.data...Xk...0...D..................@....pdata...j.......l...Z..............@..@.rsrc...p...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPDevice2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296760
Entropy (8bit):	5.754116393473069
Encrypted:	false
SSDEEP:	6144:rQHT21KHpp//PD+ZeJuEMymETklqOdmVLzZ+xZK9E:rQHTJz/PD+EuDHDll
MD5:	6791EADC3A5DBC1271C9A07423B12E51
SHA1:	B075CC4137C53C83FA4FB53C6D9C463AE128905B
SHA-256:	2049DA5AE375425DEEE3D4130C32960E31D27D41017356EAED91CEF68E03ACBC
SHA-512:	2D22E48DB5CDDA484D8986CB87AB6D8B6A5B395B75B01976295CDD413395A7152C4EC1CF8BD548006575AC1131CA9C01F42EC2D9B98972570BD94BF2DE6500B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................qp.....qD.....q......Y......I...........qq.....qA.....q@.....qG....Rich...................PE..d......R.........." ................................................................C.....@.........................................p...........x............p...%...n..8............................................................................................text...2........................... ..`.rdata..............................@..@.data..............................@....pdata...%...p...&...4..............@..@.rsrc................Z..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPDevice5.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393016
Entropy (8bit):	5.825528276733731
Encrypted:	false
SSDEEP:	6144:CaBnU0Y2nSmEriT8aImA4aR/VL7h+9aS9G9T9LSmoXI3xrVOAzIAvi:CaKDlW8as4aR/VdS9GLLhrVxk6i
MD5:	AA8A434A9E2C4B0672258172D1609056
SHA1:	04640C7ED5910433577D59CBF7B9114A4E17415D
SHA-256:	99F0E60776EA1E90F40E99F73E40F9C6A4C10EABD26E96AA31EDFFA2485F4D20
SHA-512:	886B34E15E48A70728E4E4F830A532A220BA321A86B3E1A50D27CEE530D4F95FB2D89339A9D919FE2741B7FB91F6545A3AFEF31B2BEBFB0AC846785251EC0646
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............N!....N..... ................N ...N....N....N....Rich...........................PE..d...0..R.........." .........`......DM.......................................@............@.........................................`*......@........ .......... 4......8....0.........................................................(............................text...~........................... ..`.rdata..............................@..@.data........0......................@....pdata.. 4.......6..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPFstCon.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	188216
Entropy (8bit):	6.163984531549194
Encrypted:	false
SSDEEP:	3072:QQ+aEauFpvPOO4NnaVroD8UxTf30Zkl4X8yDVxCotd0xE/IgjDRZcN6Fmm:QSUpvPOOknX8mTfkZkl4Mw/CoDTDsw
MD5:	EEB8603FC0855F892504057F8D65D5F6
SHA1:	8B0C1CDF78A8D3057D28F25463E605567156770C
SHA-256:	761D21F4F936ECC5C94F37190DEEA03DE92E5FB9B4A1CAA11984BDB4182A3072
SHA-512:	CB088B8EBE207E1E98FD90B664FBB38D9142445A3E66A6D00D1CFF2538786B4B1F366F82791A09CDBED93EA9612CE2553885AA12B56DD3B73D63263830A89DE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U................k..b....k+......k.. ...~.........&..............k.......k.......k/......k(.....Rich............PE..d...8..R.........." .........................................................0......W?....@....................................................x.......................8.... ......P...........................................................@....................text............................... ..`.rdata..............................@..@.data...0E....... ...\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPJasPer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	317240
Entropy (8bit):	6.478263107054429
Encrypted:	false
SSDEEP:	6144:EXNd63O7T7pQjZzIrP8qE82Pe77W2nllT772emSiz58x9SrBqYXo2d:EXqmT7uj1IbnZl79IWx9Srow
MD5:	DDCFEF35C8321DE196F16DEEE85DA6B3
SHA1:	CFC7E44AB112DACF0B680B787B9829C9B51689E4
SHA-256:	8D72FB156173DE6A18EFBB74D79D5876C5127BB79BF732D756714B498560871D
SHA-512:	C0593087981C846717473F9E9E504036CC4A5D1935C3BB1E7ED337C37FD0623CA059C5E050956DB1F56525EE8844192BA1E650EB62609B726725951B3431B354
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...........iCK.....M.....u@...........y.C...x.....H.....I.....N....Rich...................PE..d......R.........." .....^...\......L}...............................................m....@.............................................m.......(....P...........3......8....p.......r...............................................p..h............................text.../].......^.................. ..`.rdata..]....p.......b..............@..@.data............F..................@....pdata...3.......4..................@..@text.................b..............@.. data.....'... ...(...n..............@..@.rsrc........P......................@..@.reloc..2....p......................@..B................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPMux.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	467256
Entropy (8bit):	6.062669616688009
Encrypted:	false
SSDEEP:	6144:gjtbotdMOGiawDQrLxBhQk+KUZIkKB2BiKDVlkT/23NggV+mOGaQEkRvpEDKXYL0:ghONGiGPhWKUZInFKJlESpEL2/Wq84
MD5:	85E67C5D9BCF4C53FC2E51180F31BDF6
SHA1:	921CC4B1F7C108749B977FFB7C9C5764E1E5C9A1
SHA-256:	600572D1AA3FBA53994CAB4389E9850B947F59446655A455292F9C65BD885D7D
SHA-512:	4D2963005C9D5CD21DF89516F3D30EC34ADB3917B9B86E7A973A4C74B26D200C3E8DBD63CA00BCA820461A95FFAD8181A713D9DD937E4E0B91B8EA5601166FC0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.................X.b.....l.....w.Y.......q.......a...............Y.%.....i.......h.......o.....Rich............................PE..d......R.........." .........x......h*.......................................`............@..................................................m.......@..T........B......8....P.........................................................(............................text............................... ..`.rdata..b...........................@..@.data...p^.......6...x..............@....pdata...B.......D..................@..@.rsrc...T....@......................@..@.reloc..J....P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPPTUtils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173904
Entropy (8bit):	6.029126206651453
Encrypted:	false
SSDEEP:	3072:mO9lFp3WW0UgMa81QywRT4A3fOLuivsnw1pXhGux9obFsNvMVq2:mO9l73W4gnyCT4A3fOCik2YUvMX
MD5:	CC62D032BA76CA4B8522B35C6090026D
SHA1:	6343EFBB3A3AD1F1DA380B13810A78AAF1A5A4E9
SHA-256:	43446EC407AEF9DD1BD85FA8A55CC5474022DA7379B0D492595AFC75B5EA5EB1
SHA-512:	52FEA85048635DBE49D4FE331192F9D483697312C1C7A087C40855A7A2F4F4BEBD9A56F2A4ABFF844AFAF8AD9A4BD41E17429FAC37C397DD54A2C704BC883CB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........zY.)Y.)Y.)Bn.)-.)Bn0)S.)~5/)[.)Bn.)i.)6..)].)P.=)R.)Y.)..)Bn.)].)Bn5)X.)Bn4)X.)Bn3)X.)RichY.)........PE..d...M./R.........." ...............................................................c.....@.........................................@]......@P..x...............h.......P.......l....................................................................................text...z........................... ..`.rdata.............................@..@.data...p>...`.......N..............@....pdata..h............f..............@..@.rsrc................z..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DPTSClnt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	240952
Entropy (8bit):	6.07457528919255
Encrypted:	false
SSDEEP:	6144:vx9WvOwqEqKpJxW8uSTgE+Qhu8GlWWFsRVyPZ:bWvOwdqKxEE+AWeix
MD5:	16C7E682BC9C255CF2EE6857D579170A
SHA1:	8E9E6A710F033C282D8409332A2D53F46FA7EC4B
SHA-256:	EE3F5ECB888A5AD2FAE002F19D7633524BEE30A58D01C404873267EEA56759EA
SHA-512:	A132D2671ADC12F8447CC4DC9D5F0D8288E41E25A043D4E76BC029D1DB7EFF1D7BDB11ED9BA121327BF5185E2E60C262A4BF8E3FE4B92CFC29D1929593CE6E5F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{n.F{n.F{n.F`.F.n.F`.Fqn.F`.FHn.F...F\|n.Fr..Fzn.Fr..Fhn.F{n.F.n.F`.Fxn.F`.Fzn.F`.Fzn.F`.Fzn.FRich{n.F........PE..d......R.........." .....P...@.......W..............................................{.....@..........................................L.......;...................!......8.......(....e...............................................`.......9..@....................text....O.......P.................. ..`.rdata.......`.......T..............@..@.data...0I...P... ...B..............@....pdata...!......."...b..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DpFnd2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422200
Entropy (8bit):	6.001326458589123
Encrypted:	false
SSDEEP:	6144:buIYu6WFFZc6dA7K7m4nqnpqzOV53aL08Tz7ZxwO/qX6ypyQfI99LlJ:buIYKFY8CnpqzOj3aLcX6yl8
MD5:	D909EC7BA07147DF2A326C2AA900C4D0
SHA1:	414840E357C4BC791D88670F07B4EEC7715F3AB5
SHA-256:	220989A5C0F6305C3B1BC99794C4B8F5AEEB73319E017EDFD6FDA2C7AD4402E8
SHA-512:	094FA1BA6DD005E106277214C245B614A1755474134F4E727D1A9BC2444CC56A465CAB8DDAB7E041B821E233352B001C0949959EEEED4CA271CA0D7489A8F276
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.E...+...+...+..t..f.+..t....+.......+.}.....+.......+.......+...*...+..t..%.+..t....+..t....+..t....+.Rich..+.................PE..d......R.........." .........<............................................................@.........................................p...[....................P...<...X..8............6...............................................0...............................text...V........................... ..`.rdata.......0......................@..@.data...XM.......&..................@....pdata...<...P...>..................@..@.rsrc................F..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DpHostW.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	472888
Entropy (8bit):	6.027299728102778
Encrypted:	false
SSDEEP:	6144:KdMFoJhbYQTvX7HXs33/N8IIMmbkOhVMNZSTQI3hqgveOddZ1UW5RFtephAs7xD:mXTsHYbk1L+veObZvcV7xD
MD5:	248323A52EA3654903D601CF07B2E487
SHA1:	7DF9C2FBCE4607D8A7FB7C2F90879B951CC9B1F3
SHA-256:	464EA2E8F89E4011850A19E578BD47DD033EBCE395E6E6218231A216DD436B2C
SHA-512:	387AEBD6815E074A0AA1CF7A9360DDED13B9E2D6FA055F78D59D0CAC6EFC9D6270752EAFF5FD78B29EE8ED3FFE4175F51FEEC6BF5BA57FA457301754A2777A9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Er.=...n...n...n..7nw..n...n...n.k.n...nne6n...n.k.n...n.k.n...n...n...n..6n=..n...n...n...n...nRich...n........................PE..d......R.........."......b..........` .........@..........................................@.........................................................`..x.......P@......8....p..l....................................................................................text...&`.......b.................. ..`.rdata..P*.......,...f..............@..@.data...8\.......4..................@....pdata..P@.......B..................@..@.rsrc...x....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\DpSvInfo2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	501560
Entropy (8bit):	6.0265930734690505
Encrypted:	false
SSDEEP:	12288:qIzLI7ESZKezxeyQw50uavA+ZUQJ4QBqA9vVw:qI3IQuKemFvAmUQJ4QBqWw
MD5:	B0253D0CBDD71653D60E5EB373DF1550
SHA1:	4C589CF3811A2B209EBABFFCF78E262EBB06A628
SHA-256:	E7D214979048057FB382C23331369E5F1C3FF37F27B72A0FD0DBB67E367699CD
SHA-512:	0F23BB234EEEEF3E33865196B616CF23FFB1B9E39EF83668E9A9F93DC218EABCC485DBA2CC885DD1DE45A6E5060B27D57226D4DC1C06CDA2C061ACA576259302
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................`D.....`p.....E.....m.....}.......>...`E.....`u.....`t.....`s....Rich...........................PE..d......R.........." ................L\..............................................M.....@.................................................P...........<........@......8...........0...................................................x............................text............................... ..`.rdata..V...........................@..@.data...xX... ...0..................@....pdata...@.......B...6..............@..@.rsrc...<............x..............@..@.reloc..D...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\de\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.804145800532195
Encrypted:	false
SSDEEP:	96:OgEy1ZF9HG1tzo1CkfE1i1J81Ko1Cv15g52XH5SRrLYIO:JEGRn3f
MD5:	814947951EF98182D68DA1B9A51EA3BB
SHA1:	6006CA467551782948BD3487A446043C6D9C363C
SHA-256:	424C70F5EB406201A2D899B0A8E086F54991C5DCB44467E888EB71BA3C4D23CD
SHA-512:	BA730C1BC1E948F43F7CB934A42B837D78EFBAB63C368AE298CDCCA74DDF1EF65F995A4E5749C103367E40DB49718B7808DA5AC6C64B3CCF7C6D5F0A6CD002DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......S.....@.............................................0............................................................................................................rsrc...0...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...............................................h.................M.U.I................."...............O.'.4.@v..1.#P0i..D.X...P.x.............................................................................M.U.I...................d.e.....'.D.i.g.i.t.a.l.P.e.r.s.o.n.a.-.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\de\is-ET7KT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.804145800532195
Encrypted:	false
SSDEEP:	96:OgEy1ZF9HG1tzo1CkfE1i1J81Ko1Cv15g52XH5SRrLYIO:JEGRn3f
MD5:	814947951EF98182D68DA1B9A51EA3BB
SHA1:	6006CA467551782948BD3487A446043C6D9C363C
SHA-256:	424C70F5EB406201A2D899B0A8E086F54991C5DCB44467E888EB71BA3C4D23CD
SHA-512:	BA730C1BC1E948F43F7CB934A42B837D78EFBAB63C368AE298CDCCA74DDF1EF65F995A4E5749C103367E40DB49718B7808DA5AC6C64B3CCF7C6D5F0A6CD002DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......S.....@.............................................0............................................................................................................rsrc...0...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...............................................h.................M.U.I................."...............O.'.4.@v..1.#P0i..D.X...P.x.............................................................................M.U.I...................d.e.....'.D.i.g.i.t.a.l.P.e.r.s.o.n.a.-.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\en-US\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.762742925951143
Encrypted:	false
SSDEEP:	48:6Ro39sAiWTAEYpLAi/ZAitxRZAiCcAiqAiRAi13AijtpjbAi0x2RBHFyAilSA/Zu:OKDpEp0U+G3+JxYdMwCg52XH5SRrLYIQ
MD5:	361DC02AC3A6D8EE48EEBF5FF63C8A18
SHA1:	72AA9D94BC3E8EDEA467E5E97EDB76519796FEE7
SHA-256:	1FB41EE09DB57658423BA670A71922B6FFC954D3A77049D872C015B4B32F15C5
SHA-512:	3B6F70D373B540259F70B971926EA0825735DD46283348CACE567622F04F87DE5C22E4BD7F36EF65D2B9734B6A5B7C3B4B3B56ADFB9127BE34F5327F0FF2A1E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@............................................. ............................................................................................................rsrc... ...........................@..@................................................H...(.......@.......h.......................................................................................................................................................................................(.......................8...P...................................,...........................X.................M.U.I.................".............^8...4.....#P0i..D.X...P.x.............................................................................M.U.I...........

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\en-US\is-B5VTT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.762742925951143
Encrypted:	false
SSDEEP:	48:6Ro39sAiWTAEYpLAi/ZAitxRZAiCcAiqAiRAi13AijtpjbAi0x2RBHFyAilSA/Zu:OKDpEp0U+G3+JxYdMwCg52XH5SRrLYIQ
MD5:	361DC02AC3A6D8EE48EEBF5FF63C8A18
SHA1:	72AA9D94BC3E8EDEA467E5E97EDB76519796FEE7
SHA-256:	1FB41EE09DB57658423BA670A71922B6FFC954D3A77049D872C015B4B32F15C5
SHA-512:	3B6F70D373B540259F70B971926EA0825735DD46283348CACE567622F04F87DE5C22E4BD7F36EF65D2B9734B6A5B7C3B4B3B56ADFB9127BE34F5327F0FF2A1E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@............................................. ............................................................................................................rsrc... ...........................@..@................................................H...(.......@.......h.......................................................................................................................................................................................(.......................8...P...................................,...........................X.................M.U.I.................".............^8...4.....#P0i..D.X...P.x.............................................................................M.U.I...........

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\es\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.697385882855048
Encrypted:	false
SSDEEP:	96:ONWGNgoHWHHNs5NqOZNSNMNXNUUN9g52XH5SRrLYI+:1Y+Den3v
MD5:	D2F019242BA8666BD27013B663FF1583
SHA1:	A21687B91C39B6963599882033DAA55709A33519
SHA-256:	72F714EEC4E44FCEE996C75EA032D967FDDC3CAAB9E70436E82DCFAC47D1001F
SHA-512:	F1F882CA3A749EB734F1C5AFDC00E9E87F9111A62237DD0CCE8F6B50FC30E8FC3DB1D10141F5115B2B14CC2F1AE8D23025C806EEE09F2F95BF27ABAE23E8FD2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......5.....@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................(.............................M.U.I................."........... F..W.~....!..#P0i..D.X...P.x.............................................................................M.U.I...................e.s.....+.S.e.r.v.i.c.i.o. .d.e. .a.u.t.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\es\is-36K99.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.697385882855048
Encrypted:	false
SSDEEP:	96:ONWGNgoHWHHNs5NqOZNSNMNXNUUN9g52XH5SRrLYI+:1Y+Den3v
MD5:	D2F019242BA8666BD27013B663FF1583
SHA1:	A21687B91C39B6963599882033DAA55709A33519
SHA-256:	72F714EEC4E44FCEE996C75EA032D967FDDC3CAAB9E70436E82DCFAC47D1001F
SHA-512:	F1F882CA3A749EB734F1C5AFDC00E9E87F9111A62237DD0CCE8F6B50FC30E8FC3DB1D10141F5115B2B14CC2F1AE8D23025C806EEE09F2F95BF27ABAE23E8FD2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......5.....@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................(.............................M.U.I................."........... F..W.~....!..#P0i..D.X...P.x.............................................................................M.U.I...................e.s.....+.S.e.r.v.i.c.i.o. .d.e. .a.u.t.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\fr\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.763680604353305
Encrypted:	false
SSDEEP:	96:OhkUEtwAsTCGdBjzuPqF9g52XH5SRrLYIX:qkUEtlijDn3e
MD5:	10D0D6832B6C9FF0E93755AFD99E8316
SHA1:	7C635F44A4262ACC7F049BB5C8ABFAB7054F302B
SHA-256:	BB9EEFA0239C0BD5C05F18B1AC3D1280195AFE566689C91AA2C51A58E35D8D0E
SHA-512:	64A323DF8288C25DD2002955A7DF6B16E3525E5D09B8DDA6D38D37E4A181B98C7E1F51507300508C7FC2E8F21BE3F63495D22C2BF774396E00B4FA60D8052314
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......`....@.............................................l............................................................................................................rsrc...l...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... .................................................................M.U.I................."...........-UwZ....b.7X...@#P0i..D.X...P.x.............................................................................M.U.I...................f.r.....).S.e.r.v.i.c.e. .d.'.a.u.t.h.e.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\fr\is-DO8PA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.763680604353305
Encrypted:	false
SSDEEP:	96:OhkUEtwAsTCGdBjzuPqF9g52XH5SRrLYIX:qkUEtlijDn3e
MD5:	10D0D6832B6C9FF0E93755AFD99E8316
SHA1:	7C635F44A4262ACC7F049BB5C8ABFAB7054F302B
SHA-256:	BB9EEFA0239C0BD5C05F18B1AC3D1280195AFE566689C91AA2C51A58E35D8D0E
SHA-512:	64A323DF8288C25DD2002955A7DF6B16E3525E5D09B8DDA6D38D37E4A181B98C7E1F51507300508C7FC2E8F21BE3F63495D22C2BF774396E00B4FA60D8052314
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......`....@.............................................l............................................................................................................rsrc...l...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... .................................................................M.U.I................."...........-UwZ....b.7X...@#P0i..D.X...P.x.............................................................................M.U.I...................f.r.....).S.e.r.v.i.c.e. .d.'.a.u.t.h.e.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-0P6R4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	188216
Entropy (8bit):	6.163984531549194
Encrypted:	false
SSDEEP:	3072:QQ+aEauFpvPOO4NnaVroD8UxTf30Zkl4X8yDVxCotd0xE/IgjDRZcN6Fmm:QSUpvPOOknX8mTfkZkl4Mw/CoDTDsw
MD5:	EEB8603FC0855F892504057F8D65D5F6
SHA1:	8B0C1CDF78A8D3057D28F25463E605567156770C
SHA-256:	761D21F4F936ECC5C94F37190DEEA03DE92E5FB9B4A1CAA11984BDB4182A3072
SHA-512:	CB088B8EBE207E1E98FD90B664FBB38D9142445A3E66A6D00D1CFF2538786B4B1F366F82791A09CDBED93EA9612CE2553885AA12B56DD3B73D63263830A89DE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U................k..b....k+......k.. ...~.........&..............k.......k.......k/......k(.....Rich............PE..d...8..R.........." .........................................................0......W?....@....................................................x.......................8.... ......P...........................................................@....................text............................... ..`.rdata..............................@..@.data...0E....... ...\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-9VQTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422200
Entropy (8bit):	6.001326458589123
Encrypted:	false
SSDEEP:	6144:buIYu6WFFZc6dA7K7m4nqnpqzOV53aL08Tz7ZxwO/qX6ypyQfI99LlJ:buIYKFY8CnpqzOj3aLcX6yl8
MD5:	D909EC7BA07147DF2A326C2AA900C4D0
SHA1:	414840E357C4BC791D88670F07B4EEC7715F3AB5
SHA-256:	220989A5C0F6305C3B1BC99794C4B8F5AEEB73319E017EDFD6FDA2C7AD4402E8
SHA-512:	094FA1BA6DD005E106277214C245B614A1755474134F4E727D1A9BC2444CC56A465CAB8DDAB7E041B821E233352B001C0949959EEEED4CA271CA0D7489A8F276
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.E...+...+...+..t..f.+..t....+.......+.}.....+.......+.......+...*...+..t..%.+..t....+..t....+..t....+.Rich..+.................PE..d......R.........." .........<............................................................@.........................................p...[....................P...<...X..8............6...............................................0...............................text...V........................... ..`.rdata.......0......................@..@.data...XM.......&..................@....pdata...<...P...>..................@..@.rsrc................F..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-A3C65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393016
Entropy (8bit):	5.825528276733731
Encrypted:	false
SSDEEP:	6144:CaBnU0Y2nSmEriT8aImA4aR/VL7h+9aS9G9T9LSmoXI3xrVOAzIAvi:CaKDlW8as4aR/VdS9GLLhrVxk6i
MD5:	AA8A434A9E2C4B0672258172D1609056
SHA1:	04640C7ED5910433577D59CBF7B9114A4E17415D
SHA-256:	99F0E60776EA1E90F40E99F73E40F9C6A4C10EABD26E96AA31EDFFA2485F4D20
SHA-512:	886B34E15E48A70728E4E4F830A532A220BA321A86B3E1A50D27CEE530D4F95FB2D89339A9D919FE2741B7FB91F6545A3AFEF31B2BEBFB0AC846785251EC0646
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............N!....N..... ................N ...N....N....N....Rich...........................PE..d...0..R.........." .........`......DM.......................................@............@.........................................`*......@........ .......... 4......8....0.........................................................(............................text...~........................... ..`.rdata..............................@..@.data........0......................@....pdata.. 4.......6..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-BORQF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	368440
Entropy (8bit):	6.076848656307543
Encrypted:	false
SSDEEP:	6144:C4wxsHZOs3kYsmfOv+EaSn5wH8MZCu9KOZ28sTUTHsZxe111JuJe0748JsSY:3H53DXOv+EaOW8MZCWG8sTna
MD5:	B9CAA61A8FD61B252AF2982F34B7B5B1
SHA1:	25BEAB843EF484E5A68C120E3E85566BBC1FD4CF
SHA-256:	604BF17522D2753A206C2261A3197A72F0E3DB8E7DC55D91A4D072E0DC47A546
SHA-512:	991685F4D19098D0A18F0D7E05B9F3C38A272D461DDF3B6406A2184DFAEF1B2D224917F96036120FDB88DFEA95FF07E784E95E985DE67F2B25DD97683AC5A7FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..U%..U%..U%..N.I.W%..N....%..N.K._%..:S~.Q%..\]V.W%..\]F.B%..U%...%..N.~.n%..N.N.T%..N.O.T%..N.H.T%..RichU%..........PE..d......R.........." .................V...............................................5....@.........................................@&......P...........x........2......8............................................................................................text............................... ..`.rdata...v.......x..................@..@.data....V...0...0..................@....pdata...2.......4...>..............@..@.rsrc...x............r..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-ENNLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	472888
Entropy (8bit):	6.027299728102778
Encrypted:	false
SSDEEP:	6144:KdMFoJhbYQTvX7HXs33/N8IIMmbkOhVMNZSTQI3hqgveOddZ1UW5RFtephAs7xD:mXTsHYbk1L+veObZvcV7xD
MD5:	248323A52EA3654903D601CF07B2E487
SHA1:	7DF9C2FBCE4607D8A7FB7C2F90879B951CC9B1F3
SHA-256:	464EA2E8F89E4011850A19E578BD47DD033EBCE395E6E6218231A216DD436B2C
SHA-512:	387AEBD6815E074A0AA1CF7A9360DDED13B9E2D6FA055F78D59D0CAC6EFC9D6270752EAFF5FD78B29EE8ED3FFE4175F51FEEC6BF5BA57FA457301754A2777A9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Er.=...n...n...n..7nw..n...n...n.k.n...nne6n...n.k.n...n.k.n...n...n...n..6n=..n...n...n...n...nRich...n........................PE..d......R.........."......b..........` .........@..........................................@.........................................................`..x.......P@......8....p..l....................................................................................text...&`.......b.................. ..`.rdata..P*.......,...f..............@..@.data...8\.......4..................@....pdata..P@.......B..................@..@.rsrc...x....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-FCT4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	240952
Entropy (8bit):	6.07457528919255
Encrypted:	false
SSDEEP:	6144:vx9WvOwqEqKpJxW8uSTgE+Qhu8GlWWFsRVyPZ:bWvOwdqKxEE+AWeix
MD5:	16C7E682BC9C255CF2EE6857D579170A
SHA1:	8E9E6A710F033C282D8409332A2D53F46FA7EC4B
SHA-256:	EE3F5ECB888A5AD2FAE002F19D7633524BEE30A58D01C404873267EEA56759EA
SHA-512:	A132D2671ADC12F8447CC4DC9D5F0D8288E41E25A043D4E76BC029D1DB7EFF1D7BDB11ED9BA121327BF5185E2E60C262A4BF8E3FE4B92CFC29D1929593CE6E5F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{n.F{n.F{n.F`.F.n.F`.Fqn.F`.FHn.F...F\|n.Fr..Fzn.Fr..Fhn.F{n.F.n.F`.Fxn.F`.Fzn.F`.Fzn.F`.Fzn.FRich{n.F........PE..d......R.........." .....P...@.......W..............................................{.....@..........................................L.......;...................!......8.......(....e...............................................`.......9..@....................text....O.......P.................. ..`.rdata.......`.......T..............@..@.data...0I...P... ...B..............@....pdata...!......."...b..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-G6VA9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296760
Entropy (8bit):	5.754116393473069
Encrypted:	false
SSDEEP:	6144:rQHT21KHpp//PD+ZeJuEMymETklqOdmVLzZ+xZK9E:rQHTJz/PD+EuDHDll
MD5:	6791EADC3A5DBC1271C9A07423B12E51
SHA1:	B075CC4137C53C83FA4FB53C6D9C463AE128905B
SHA-256:	2049DA5AE375425DEEE3D4130C32960E31D27D41017356EAED91CEF68E03ACBC
SHA-512:	2D22E48DB5CDDA484D8986CB87AB6D8B6A5B395B75B01976295CDD413395A7152C4EC1CF8BD548006575AC1131CA9C01F42EC2D9B98972570BD94BF2DE6500B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................qp.....qD.....q......Y......I...........qq.....qA.....q@.....qG....Rich...................PE..d......R.........." ................................................................C.....@.........................................p...........x............p...%...n..8............................................................................................text...2........................... ..`.rdata..............................@..@.data..............................@....pdata...%...p...&...4..............@..@.rsrc................Z..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-GVGJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173904
Entropy (8bit):	6.029126206651453
Encrypted:	false
SSDEEP:	3072:mO9lFp3WW0UgMa81QywRT4A3fOLuivsnw1pXhGux9obFsNvMVq2:mO9l73W4gnyCT4A3fOCik2YUvMX
MD5:	CC62D032BA76CA4B8522B35C6090026D
SHA1:	6343EFBB3A3AD1F1DA380B13810A78AAF1A5A4E9
SHA-256:	43446EC407AEF9DD1BD85FA8A55CC5474022DA7379B0D492595AFC75B5EA5EB1
SHA-512:	52FEA85048635DBE49D4FE331192F9D483697312C1C7A087C40855A7A2F4F4BEBD9A56F2A4ABFF844AFAF8AD9A4BD41E17429FAC37C397DD54A2C704BC883CB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........zY.)Y.)Y.)Bn.)-.)Bn0)S.)~5/)[.)Bn.)i.)6..)].)P.=)R.)Y.)..)Bn.)].)Bn5)X.)Bn4)X.)Bn3)X.)RichY.)........PE..d...M./R.........." ...............................................................c.....@.........................................@]......@P..x...............h.......P.......l....................................................................................text...z........................... ..`.rdata.............................@..@.data...p>...`.......N..............@....pdata..h............f..............@..@.rsrc................z..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-IECPQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	501560
Entropy (8bit):	6.0265930734690505
Encrypted:	false
SSDEEP:	12288:qIzLI7ESZKezxeyQw50uavA+ZUQJ4QBqA9vVw:qI3IQuKemFvAmUQJ4QBqWw
MD5:	B0253D0CBDD71653D60E5EB373DF1550
SHA1:	4C589CF3811A2B209EBABFFCF78E262EBB06A628
SHA-256:	E7D214979048057FB382C23331369E5F1C3FF37F27B72A0FD0DBB67E367699CD
SHA-512:	0F23BB234EEEEF3E33865196B616CF23FFB1B9E39EF83668E9A9F93DC218EABCC485DBA2CC885DD1DE45A6E5060B27D57226D4DC1C06CDA2C061ACA576259302
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................`D.....`p.....E.....m.....}.......>...`E.....`u.....`t.....`s....Rich...........................PE..d......R.........." ................L\..............................................M.....@.................................................P...........<........@......8...........0...................................................x............................text............................... ..`.rdata..V...........................@..@.data...xX... ...0..................@....pdata...@.......B...6..............@..@.rsrc...<............x..............@..@.reloc..D...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-J12JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	499512
Entropy (8bit):	6.003611090169429
Encrypted:	false
SSDEEP:	6144:HPyJycdWEY/4lUZrYbd9YVV2TfiYenhTGMHTQyR0Ycf8zN0SqpMhf9jOsJ:HK11vlUCb7yV2TfVKEMK8zcpuxJ
MD5:	34F679A12CC4AEFD9520DCB4C5BD8A44
SHA1:	C6801AB37AC3F8DE5AA0044E621FEC3FF62017D0
SHA-256:	A08FD089432FEB23CF723590BD9FA616731249DC42B620D38C2D2D5942ADC6B4
SHA-512:	A511D04D0C2D07B454775367BEF022BB68DD5C35782A88F2D624EF0B2694181C28A98C878414E5075B267650EAAC37CFE9D6EDD19042684328B34983133247B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;V...7.B.7.B.7.Bd.YB.7.Bd.mBu7.B.AXBx7.BvOpB}7.BvO`Bl7.B.7.B.7.Bd.XBC7.Bd.hB~7.Bd.iB~7.Bd.nB~7.BRich.7.B........................PE..d...s..R.........." .................a........4......................................m....@.........................................`.......H...........8....p..hC......8.......x...........................................................H........................text...B........................... ..`.rdata...3.......4..................@..@.data....m.......F..................@....pdata..hC...p...D...*..............@..@.rsrc...8............n..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-JSTVD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	467256
Entropy (8bit):	6.062669616688009
Encrypted:	false
SSDEEP:	6144:gjtbotdMOGiawDQrLxBhQk+KUZIkKB2BiKDVlkT/23NggV+mOGaQEkRvpEDKXYL0:ghONGiGPhWKUZInFKJlESpEL2/Wq84
MD5:	85E67C5D9BCF4C53FC2E51180F31BDF6
SHA1:	921CC4B1F7C108749B977FFB7C9C5764E1E5C9A1
SHA-256:	600572D1AA3FBA53994CAB4389E9850B947F59446655A455292F9C65BD885D7D
SHA-512:	4D2963005C9D5CD21DF89516F3D30EC34ADB3917B9B86E7A973A4C74B26D200C3E8DBD63CA00BCA820461A95FFAD8181A713D9DD937E4E0B91B8EA5601166FC0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.................X.b.....l.....w.Y.......q.......a...............Y.%.....i.......h.......o.....Rich............................PE..d......R.........." .........x......h*.......................................`............@..................................................m.......@..T........B......8....P.........................................................(............................text............................... ..`.rdata..b...........................@..@.data...p^.......6...x..............@....pdata...B.......D..................@..@.rsrc...T....@......................@..@.reloc..J....P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-KCOJ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235320
Entropy (8bit):	6.104809375327942
Encrypted:	false
SSDEEP:	6144:0OVhlyfHSIpnOfiTGNeh3+RGc7VTLxohy7HPljGC8d96:xVzyfHSIpnOfqGNeh0h7k6
MD5:	252D9D77EFD1B4DB0D6BBD2CE21D9126
SHA1:	B61307CC9371FD1B2324BB779FFE671F0404D414
SHA-256:	DEFB56C6F73F31C0FDE89236DEBE317E73088ABD5AF1CF8F0B31AD2983127D71
SHA-512:	FEFB5241AAB79EFEFB4145D0B8D142C58C715FBBA7BD7A646B17EA7533BEC1C591EFCB848CAEBC66543A09E15F8862E803A71FDA77C907B27CCF754756CC9608
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\...=...=...=....E.=....q..=..KD..=...El..=...E\|..=...=..Q=....D..=....t..=....u..=....r..=..Rich.=..................PE..d......R.........." .....8...B......TJ....................................................@..........................................2......x"..................."...~..8............U...............................................P.......!..@....................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data...PM...@...&... ..............@....pdata...".......$...F..............@..@.rsrc................j..............@..@.reloc..^............t..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-UU74L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	653112
Entropy (8bit):	6.186368410182239
Encrypted:	false
SSDEEP:	12288:luZZiyMwcj6gyio8wnS1cObQy0Cn9w8qjxw1OCysoanNcFl0bJ:letbglnZ0yW8UZn0bJ
MD5:	24C767E1B413C234099A92380E7A01EB
SHA1:	E47D30EDE3CAE1E36F95748E9259491D3544D5FF
SHA-256:	9F141975F27360914DB2344BDA01A0A66F9DE6FFEC987D13DD21B7CB278A106B
SHA-512:	BBF022B25EC3BD6A99D185532B7919B6B8DF1B6B1A88F4EAAB74E17B22C96DAE780EAB88DD27FEE83588B083E97FB63163AF0DFB6A8C75F3DD9662425433D7B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~S......................................................................................Rich............................PE..d...\|..R.........." .........X..............................................0............@.............................................................p........j......8.... ......P................................................................................text.............................. ..`.rdata..............................@..@.data...Xk...0...D..................@....pdata...j.......l...Z..............@..@.rsrc...p...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\is-VSTNL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	317240
Entropy (8bit):	6.478263107054429
Encrypted:	false
SSDEEP:	6144:EXNd63O7T7pQjZzIrP8qE82Pe77W2nllT772emSiz58x9SrBqYXo2d:EXqmT7uj1IbnZl79IWx9Srow
MD5:	DDCFEF35C8321DE196F16DEEE85DA6B3
SHA1:	CFC7E44AB112DACF0B680B787B9829C9B51689E4
SHA-256:	8D72FB156173DE6A18EFBB74D79D5876C5127BB79BF732D756714B498560871D
SHA-512:	C0593087981C846717473F9E9E504036CC4A5D1935C3BB1E7ED337C37FD0623CA059C5E050956DB1F56525EE8844192BA1E650EB62609B726725951B3431B354
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...........iCK.....M.....u@...........y.C...x.....H.....I.....N....Rich...................PE..d......R.........." .....^...\......L}...............................................m....@.............................................m.......(....P...........3......8....p.......r...............................................p..h............................text.../].......^.................. ..`.rdata..]....p.......b..............@..@.data............F..................@....pdata...3.......4..................@..@text.................b..............@.. data.....'... ...(...n..............@..@.rsrc........P......................@..@.reloc..2....p......................@..B................................................................................................................................................................................

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\it\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.688002110186614
Encrypted:	false
SSDEEP:	48:6R68Qv27VAhvTWMgGYoAiz5RAi4nsxMR0PAif5RAi4n5Aiv5RAi4n1HACiQtpjb2:OXQKqmdvu+xTa7Oog52XH5SRrLYI7
MD5:	6DDE54512179F33089F6710C74CFE74D
SHA1:	ED7F5AD3AB6E6428F2F97C933A03B3246E4718E6
SHA-256:	8D145E1D4D69FBCFE829EC8D620E56D3955891C16580D67162908DB92F85127E
SHA-512:	8FA36DE6B809145AAE9F517E07F761AB39F0852F61C4BCB458D7C0B36895657050570F60BDC6B44F5044D040E404F8373E0EC72182D7DE307EE40525C0F0DC74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......a.....@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................".............................M.U.I................."...........B>........p#%5ko#P0i..D.X...P.x.............................................................................M.U.I...................i.t.....).S.e.r.v.i.z.i.o. .d.i. .a.u.t.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\it\is-OO0TP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.688002110186614
Encrypted:	false
SSDEEP:	48:6R68Qv27VAhvTWMgGYoAiz5RAi4nsxMR0PAif5RAi4n5Aiv5RAi4n1HACiQtpjb2:OXQKqmdvu+xTa7Oog52XH5SRrLYI7
MD5:	6DDE54512179F33089F6710C74CFE74D
SHA1:	ED7F5AD3AB6E6428F2F97C933A03B3246E4718E6
SHA-256:	8D145E1D4D69FBCFE829EC8D620E56D3955891C16580D67162908DB92F85127E
SHA-512:	8FA36DE6B809145AAE9F517E07F761AB39F0852F61C4BCB458D7C0B36895657050570F60BDC6B44F5044D040E404F8373E0EC72182D7DE307EE40525C0F0DC74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ......a.....@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................".............................M.U.I................."...........B>........p#%5ko#P0i..D.X...P.x.............................................................................M.U.I...................i.t.....).S.e.r.v.i.z.i.o. .d.i. .a.u.t.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ja\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.301832005775013
Encrypted:	false
SSDEEP:	48:6RakT9MAkKf7ZAbikAH5A2AH+ATbmAHp0AmQtpjbAi0x2RBHFyAilSA/ZltqA/jA:OlTkKf7+b8HenH/TzH3lg52XH5SRrLY7
MD5:	5A82B97DB42D128443C37B7979078A01
SHA1:	ACD3F3FBE9284A1F73A10056E9EE5C216552AB3C
SHA-256:	80B890AEE7BB2568D10D37E0ACCB55940C72E064195BE2647C6186C1BC1AF2DC
SHA-512:	E518B5BDFDB5705382F6D92A0A82DC5981E7467DD2E8D2F4202E98BADAD6048FB206D09BB0D14A63D7FE3E36D4C6215859BDAD85B87D16788595DB5C0CD39139
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@.............................................P............................................................................................................rsrc...P...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................".............................................M.U.I................."...............U+"...K.NE.4#P0i..D.X...P.x.............................................................................M.U.I...................e.n.-.U.S.........[.D.i.g.i.t.a.l.P.e.r.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ja\is-8OPPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.301832005775013
Encrypted:	false
SSDEEP:	48:6RakT9MAkKf7ZAbikAH5A2AH+ATbmAHp0AmQtpjbAi0x2RBHFyAilSA/ZltqA/jA:OlTkKf7+b8HenH/TzH3lg52XH5SRrLY7
MD5:	5A82B97DB42D128443C37B7979078A01
SHA1:	ACD3F3FBE9284A1F73A10056E9EE5C216552AB3C
SHA-256:	80B890AEE7BB2568D10D37E0ACCB55940C72E064195BE2647C6186C1BC1AF2DC
SHA-512:	E518B5BDFDB5705382F6D92A0A82DC5981E7467DD2E8D2F4202E98BADAD6048FB206D09BB0D14A63D7FE3E36D4C6215859BDAD85B87D16788595DB5C0CD39139
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@.............................................P............................................................................................................rsrc...P...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................".............................................M.U.I................."...............U+"...K.NE.4#P0i..D.X...P.x.............................................................................M.U.I...................e.n.-.U.S.........[.D.i.g.i.t.a.l.P.e.r.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ko\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.298883949101409
Encrypted:	false
SSDEEP:	48:6RgufYvQNAi13ujdAiF8AiKJPAiF3Ai3anCAiF/YAibqONAiutpjbAi0x2RBHFyM:OQNq3psrJ4NIanDytWqb5g52XH5SRrLA
MD5:	561137ED29ADA2016B8BF75360274D48
SHA1:	A566782DF4FF8C9F149F038A4D0748D58240E357
SHA-256:	729E9F082DEDD81EDDA35968113B9D5A495908970E3CE82B3E3870B92171982B
SHA-512:	8A8F17F436397E26EC2075AC604FFCB3A7B3CA3583D4B25ABFB946C874D7F8B26295A6EBBA26E9007239C7AA8175679A91DF87FD924D39F04F8DFFF65E9682D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......l....@.............................................P............................................................................................................rsrc...P...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... .................................................................M.U.I................."...........o..pj....W...Q..#P0i..D.X...P.x.............................................................................M.U.I...................k.o.......D.i.g.i.t.a.l.P.e.r.s.o.n.a. .

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\ko\is-FJUTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.298883949101409
Encrypted:	false
SSDEEP:	48:6RgufYvQNAi13ujdAiF8AiKJPAiF3Ai3anCAiF/YAibqONAiutpjbAi0x2RBHFyM:OQNq3psrJ4NIanDytWqb5g52XH5SRrLA
MD5:	561137ED29ADA2016B8BF75360274D48
SHA1:	A566782DF4FF8C9F149F038A4D0748D58240E357
SHA-256:	729E9F082DEDD81EDDA35968113B9D5A495908970E3CE82B3E3870B92171982B
SHA-512:	8A8F17F436397E26EC2075AC604FFCB3A7B3CA3583D4B25ABFB946C874D7F8B26295A6EBBA26E9007239C7AA8175679A91DF87FD924D39F04F8DFFF65E9682D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......l....@.............................................P............................................................................................................rsrc...P...........................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... .................................................................M.U.I................."...........o..pj....W...Q..#P0i..D.X...P.x.............................................................................M.U.I...................k.o.......D.i.g.i.t.a.l.P.e.r.s.o.n.a. .

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\pt-BR\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.8166809418871597
Encrypted:	false
SSDEEP:	48:6RWK69XOGANVakD8tZD8nUGAiyGAiy3SR0K0GAiyGAiyv3FGAiKGAiy32GACiQt4:OAEXt8H8MBaNs55l5Yog52XH5SRrLYIr
MD5:	E02F448AF78D853D29ABBD66E0C626D7
SHA1:	7E234CE75CB219C9F7D04ECCAF1CCC83A4ABE746
SHA-256:	FFDE1F02270C3A4D0B6B3CBBE30349DBFC5BDE0EF28A2DA8A6585CCDA0C9BFFB
SHA-512:	B1EB1562116BDE96E7B5547FDDF8246667846C8479829625294011D8F0A7D1BADBFAE024F24C23DD30B4B45D82A029380B053F5654047AB89A68867A3F2E83E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...............................................D.................M.U.I.................".............Y......B....B.#P0i..D.X...P.x.............................................................................M.U.I...................p.t.-.B.R.......&.S.e.r.v.i...o. .d.e. .

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\pt-BR\is-AICLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.8166809418871597
Encrypted:	false
SSDEEP:	48:6RWK69XOGANVakD8tZD8nUGAiyGAiy3SR0K0GAiyGAiyv3FGAiKGAiy32GACiQt4:OAEXt8H8MBaNs55l5Yog52XH5SRrLYIr
MD5:	E02F448AF78D853D29ABBD66E0C626D7
SHA1:	7E234CE75CB219C9F7D04ECCAF1CCC83A4ABE746
SHA-256:	FFDE1F02270C3A4D0B6B3CBBE30349DBFC5BDE0EF28A2DA8A6585CCDA0C9BFFB
SHA-512:	B1EB1562116BDE96E7B5547FDDF8246667846C8479829625294011D8F0A7D1BADBFAE024F24C23DD30B4B45D82A029380B053F5654047AB89A68867A3F2E83E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...............................................D.................M.U.I.................".............Y......B....B.#P0i..D.X...P.x.............................................................................M.U.I...................p.t.-.B.R.......&.S.e.r.v.i...o. .d.e. .

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hans\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.298717565172493
Encrypted:	false
SSDEEP:	48:6R3kZPNAiyWSAiYAiNCAAixAiBQAi4z5Ai74nNAipQtpjbAi0x2RBHFyAilSA/Zg:O0UH2SOed0VXyZSpg52XH5SRrLYI6
MD5:	BEEED4C79E1CF99EC58ACC78F3499CF9
SHA1:	B434DB0826243D41AECF0153DB76945145E2EDAC
SHA-256:	19541DC4CC0717B12AC917765584E9EBB14978B43E87ABBAB4C57308A9EDC9E3
SHA-512:	5CBF2CB44823167A5E3FC918AFD4165E71A4F9916DA8093D003B66887298BA2784FA45F757D5F8B592D430B326F8EA4F96033CADE0559BB9A7C183532E87AB09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................6.............................M.U.I................."...........nNtI,?...y..p.\|.#P0i..D.X...P.x.............................................................................M.U.I...................z.h.-.H.a.n.s.....D.i.g.i.t.a.l.P.e.r.s.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hans\is-O6TTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.298717565172493
Encrypted:	false
SSDEEP:	48:6R3kZPNAiyWSAiYAiNCAAixAiBQAi4z5Ai74nNAipQtpjbAi0x2RBHFyAilSA/Zg:O0UH2SOed0VXyZSpg52XH5SRrLYI6
MD5:	BEEED4C79E1CF99EC58ACC78F3499CF9
SHA1:	B434DB0826243D41AECF0153DB76945145E2EDAC
SHA-256:	19541DC4CC0717B12AC917765584E9EBB14978B43E87ABBAB4C57308A9EDC9E3
SHA-512:	5CBF2CB44823167A5E3FC918AFD4165E71A4F9916DA8093D003B66887298BA2784FA45F757D5F8B592D430B326F8EA4F96033CADE0559BB9A7C183532E87AB09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................(.......@.......`.......................x........................................................................................................................................................... ...................................6.............................M.U.I................."...........nNtI,?...y..p.\|.#P0i..D.X...P.x.............................................................................M.U.I...................z.h.-.H.a.n.s.....D.i.g.i.t.a.l.P.e.r.s.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hant\DpHostW.exe.mui (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.2587693287558075
Encrypted:	false
SSDEEP:	48:6RDd3ZiAim5qAiIpAiw0Aij+AiajSAi+G+vAisAiEQtpjbAi0x2RBHFyAilSA/Z3:ODFd97HuF5S/PzW+Ym2g52XH5SRrLYIJ
MD5:	1CDACCBA7CC44B334F5EF9D016CC487E
SHA1:	7B9A56541758C63BAA561DE9166D2A967D457891
SHA-256:	C28003527AF2BF31F9A082AE9FAC98E8BB2E562248541175A0C5E02FB416A82A
SHA-512:	3BE3DBBDD8A5A0353503108D18744EDCD22E49D927D890292910FF1883ECC2F63571DD8473F4525EAEB01A3D8BE6252A39178A5135989CCA7B8FB605D8400DFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......3....@.............................................\............................................................................................................rsrc...\...........................@..@....................................................(.......@.......`.......................x............................................................................\|.......................\|.......................\|.......................\|...... .................................................................M.U.I................."..............=.(.R#.8..T#P0i..D.X...P.x.............................................................................M.U.I...................z.h.-.H.a.n.t.....D.i.g.i.t.a.l.P.e.r.s.

C:\Program Files (x86)\FPSensor\support\u.are.u\win64\zh-Hant\is-VJQOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	4.2587693287558075
Encrypted:	false
SSDEEP:	48:6RDd3ZiAim5qAiIpAiw0Aij+AiajSAi+G+vAisAiEQtpjbAi0x2RBHFyAilSA/Z3:ODFd97HuF5S/PzW+Ym2g52XH5SRrLYIJ
MD5:	1CDACCBA7CC44B334F5EF9D016CC487E
SHA1:	7B9A56541758C63BAA561DE9166D2A967D457891
SHA-256:	C28003527AF2BF31F9A082AE9FAC98E8BB2E562248541175A0C5E02FB416A82A
SHA-512:	3BE3DBBDD8A5A0353503108D18744EDCD22E49D927D890292910FF1883ECC2F63571DD8473F4525EAEB01A3D8BE6252A39178A5135989CCA7B8FB605D8400DFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\|...\|...\|.......\|.......\|..Rich.\|..........................PE..L...R..H.........."!......................................................... .......3....@.............................................\............................................................................................................rsrc...\...........................@..@....................................................(.......@.......`.......................x............................................................................\|.......................\|.......................\|.......................\|...... .................................................................M.U.I................."..............=.(.R#.8..T#P0i..D.X...P.x.............................................................................M.U.I...................z.h.-.H.a.n.t.....D.i.g.i.t.a.l.P.e.r.s.

C:\Program Files (x86)\FPSensor\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	InnoSetup Log Fingerprint Reader Driver, version 0x30, 16125 bytes, 506013\user, "C:\Program Files (x86)\FPSensor"
Category:	dropped
Size (bytes):	16125
Entropy (8bit):	5.397393464538649
Encrypted:	false
SSDEEP:	192:1k2B03f2ICSsA4KoYSFIFMtKbFSA2PHWtwewl4uOEEE5z:e2BMToYSFIFEKbFAeMaEEE5z
MD5:	13AA148C5BC9B5754910066D6944F33C
SHA1:	B375F535777D215268E8E98CC9B46BA589578EF9
SHA-256:	BAE8B57CB2A11784D5752041BAD393F56DC32ED6C14742C30C233A6470EF7711
SHA-512:	7A0D38AD90AD62B69AEDC561BB016D844AC1E0128ABAC8317D453FDF9D27A7B05495D7CBC36B31D679156DDD7C2396C4207D8FA5CDB3523F0A391793A81FD48B
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Fingerprint Reader Driver.......................................................................................................Fingerprint Reader Driver.......................................................................................................0........>..%...........................................................................................................................?........B....506013.user.C:\Program Files (x86)\FPSensor...............{.. ..........D.IFPS.............................................................................................................BOOLEAN................................!MAIN....-1.. ...dll:kernel32.dll.GetVersion.........._.......INITIALIZESETUP....16.n...V.......ISWINDOWS32BIT....16..GETSYSWOW64DIR..........V.......ISWINDOWS64BIT....16.............ISWINDOWSNT6....16.0...G.......ISONLYWINDOWSNT5....16.w...........ISWINDOWSNT5....16.....G.......ISWINDOWSNT4....16.

C:\Program Files (x86)\FPSensor\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	722593
Entropy (8bit):	6.522048396529145
Encrypted:	false
SSDEEP:	12288:jQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyRm:jQYh1yLmSKrPD37zzH2A6QD/IpqggE2A
MD5:	AE4467B01F4E37CA8A0C98EEB028C96C
SHA1:	2F102B6DCF7C1D5B562407F5203DBF24D7A21AA7
SHA-256:	FC13574D82F9FE6C006A731D04512E189AF428880A5D09796D94DBB1A788370D
SHA-512:	3F2A08D91BE0BAB32AA9426653B163AE4795DAB15F1BA29A006FEA2C9BDC62E5F2B56026AE6EF9F72A2333F31128939EFC67D414852D131024B2574976CD1C0C
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&........................................................... ......................................................CODE....$........................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls.....................................rdata....... ......................@..P.reloc......0......................@..P.rsrc...............................@..P.....................f..............@..P........................................................................................................................................

C:\Program Files (x86)\dotnet\LICENSE.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 text, with very long lines (514), with CRLF line terminators
Category:	dropped
Size (bytes):	9519
Entropy (8bit):	4.902271147017698
Encrypted:	false
SSDEEP:	192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
MD5:	31C5A77B3C57C8C2E82B9541B00BCD5A
SHA1:	153D4BC14E3A2C1485006F1752E797CA8684D06D
SHA-256:	7F6839A61CE892B79C6549E2DC5A81FDBD240A0B260F8881216B45B7FDA8B45D
SHA-512:	AD33E3C0C3B060AD44C5B1B712C991B2D7042F6A60DC691C014D977C922A7E3A783BA9BADE1A34DE853C271FDE1FB75BC2C47869ACD863A40BE3A6C6D754C0A6
Malicious:	false
Preview:	MICROSOFT SOFTWARE LICENSE TERMS..MICROSOFT .NET LIBRARY ..These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft.. * updates,.. * supplements,.. * Internet-based services, and.. * support services..for this software, unless other terms accompany those items. If so, those terms apply...BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE...IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE PERPETUAL RIGHTS BELOW...1. INSTALLATION AND USE RIGHTS. .. a. Installation and Use. You may install and use any number of copies of the software to design, develop and test your programs... b. Third Party Programs. The software may include third party programs that Microsoft, not the third party, licenses to you under this

C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 text, with very long lines (755), with CRLF line terminators
Category:	dropped
Size (bytes):	79954
Entropy (8bit):	5.2343129347468
Encrypted:	false
SSDEEP:	1536:HA9jHwQZGfgg39/zwgAVkguQXrDjugtSEGepkWvrpX7anuqdLS4mfiStPq+3Lefj:HA97wfogz1AVxuujHtSFULryLggrGRwJ
MD5:	F77A4AECFAF4640D801EB6DCDFDDC478
SHA1:	7424710F255F6205EF559E4D7E281A3B701183BB
SHA-256:	D5DB0ED54363E40717AE09E746DEC99AD5B09223CC1273BB870703176DD226B7
SHA-512:	1B729DFA561899980BA8B15128EA39BC1E609FE07B30B283001FD9CF9DA62885D78C18082D0085EDD81F09203F878549B48F7F888A8486A2A526B134C849FD6B
Malicious:	false
Preview:	.NET Runtime uses third-party libraries or other resources that may be..distributed under licenses different than the .NET Runtime software.....In the event that we accidentally failed to list a required notice, please..bring it to our attention. Post an issue or email us:.... dotnet@microsoft.com....The attached notices are provided for information only.....License notice for ASP.NET..-------------------------------....Copyright (c) .NET Foundation. All rights reserved...Licensed under the Apache License, Version 2.0.....Available at..https://github.com/dotnet/aspnetcore/blob/main/LICENSE.txt....License notice for Slicing-by-8..-------------------------------....http://sourceforge.net/projects/slicing-by-8/....Copyright (c) 2004-2006 Intel Corporation - All Rights Reserved......This software program is licensed subject to the BSD License, available at..http://www.opensource.org/licenses/bsd-license.html.....License notice for Unicode data..-------------------------------...

C:\Program Files (x86)\dotnet\dotnet.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105624
Entropy (8bit):	6.543695650246659
Encrypted:	false
SSDEEP:	3072:tSs83NRRN35L+cu7mjuJRa7bAJWBS8mEzW9wN0Wwbs+IM6doPrPaaN2gVNxHIDbF:J83N3N35icu7mjeRa7EJWBS8mEzW9wNz
MD5:	1E4C2699D7A2AD19900ADD7719BEC115
SHA1:	70465C0E8B64A6D0B0981F11F0C38B1D5B78011F
SHA-256:	7D65AD7EA8F1AB66D2994342FF09844902A3B505648A3D0A200C4E46FAEE54EF
SHA-512:	A7F632DC517ECA4AD5A5D27CC2B6C583595AB12AD11095F7C6513ECC0DC54CB0702481E0D9732FE37E062B2701766CA84BC46A90F9366DBFD5223F1E51014ACB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y.......I.......W...........P.h.I......\...Y..........Q......X......X...RichY...........................PE..L...2y/b.....................t......`.............@.................................f4....@.................................hZ.......................t...(......8....?..T....................A......(@..@............................................text............................... ..`.rdata..pU.......V..................@..@.data........p.......V..............@....rsrc................Z..............@..@.reloc..8............d..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\host\fxr\6.0.4\hostfxr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	310416
Entropy (8bit):	6.46861853096452
Encrypted:	false
SSDEEP:	6144:LkkuIzA0IWAPMXqqR20tOTnqoEgENZxtmJ1ZwYUHZd8idxsgPO9y:LkPIzA0IWAPMXqi20tOTnqoEHn6wYMmm
MD5:	4EEB629375A130B40C2CFA7BEA9E0C64
SHA1:	D7EF02B10209D69152316A79A9FA22B4C3C04E60
SHA-256:	D39F70554607AEC2ED8131C3687A62BDAF809278928B04BDEFC1676D00FE726E
SHA-512:	D8470BA6A5CDEF426BFEDB20C934AE74B7B609F89D8D6B931269FD4DD9AF4B99E8BDD9C7527249FC6935253FC464229E5A3B0741AF201686D6CCE5E26891825B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o....................................,...........=...C......C.......C.......C.......Rich............PE..L...Ty/b.........."!.....R...F...............p...........................................@A.........................f......\|i...........................(.......&...$..T...................@&......P%..@............p..X............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...d............^..............@....rsrc................f..............@..@.reloc...&.......(...l..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\.version

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.8567717729434197
Encrypted:	false
SSDEEP:	3:jAfFYThAINTYh8:jQ8WINl
MD5:	7C23591D99D4B98FFB7D0B00AC5D0431
SHA1:	BD94B4B3F58D3EF1E4E35883C042CE39CCCCAD5E
SHA-256:	1427054FDAF579083312DB9DF24655E092785A77D92D25EC0B63BD6C572B9163
SHA-512:	FAB15F9D07F78F80F5E97C1F133636D8179E555982E437B7A10FA48FBFCD4E9B9865A7FAFB4A57C4C2DE1B1B84A4A72646607B4A96D577596F2488D7FBEE8715
Malicious:	false
Preview:	be98e88c760526452df94ef452fff4602fb5bded..6.0.4..

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\API-MS-Win-core-xstate-l2-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.674937345048977
Encrypted:	false
SSDEEP:	192:Sf5biWvhW3WYnO/VWQ4eWZIcA5E8qnajCOK:Sf5biWvhWnU7x5E8l2O
MD5:	8932EC8BEEEB7E6F9A9A6351BDBB39E2
SHA1:	24F11190B2C876B09204DF6CF7F34F7E37767F9E
SHA-256:	9C836D27A9FD11EEACA943153040D19DDF5E5A82AABD4E838929C71AFD37D182
SHA-512:	A60037F8CE9522A735DE09436CFE68E2A4ABADEBF9D10B699E1B6FF67D3D3E5686F51A21461DF532BF57614B77C6DFE699C13ADC80E5603021BF99FF36F9DDB5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...].R............!......................... ...............................@...........@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.CSharp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	972944
Entropy (8bit):	6.862250587045379
Encrypted:	false
SSDEEP:	24576:iezzuOYQUDx34q2O992KgvAcwAmkd+Vu9yHurKBBNtbxPF:tnuFQUd4nv1Pd+Vu9yHa8zF
MD5:	28BA0B80654FF3A9A1865F01ED467488
SHA1:	1DB6F6F25AD443A35C5B245A7420BD99CBF1B8D8
SHA-256:	4F94E14FD37E0030D4764EB9D98EAED51EF4CE77DB9717229409C8ABEF72EC2D
SHA-512:	FE2CFCEBA4B05525D21B3E61C32B7230151BDFBBADD2489A6A2B6C554ABF0B226CA3DF74CDE5200FC60587AE0DE30F1713428E9DFD444B7E0391F9D38F6AB524
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!.........(....................@.................................j.....@......................................................D.......(...P.....LD..T...............................................................H............text...H........................... ..`.data...d...........................@....reloc......P.......*..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.DiaSymReader.Native.x86.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1529728
Entropy (8bit):	6.570521209964174
Encrypted:	false
SSDEEP:	24576:sTmgUKuQFVIzsZ/xFWG9gb+vosKJKA8vTxtUNioIE0Qf0dQoFtAXJEysx7DK3XV:sTJFppvgKnkt21tgJEyacF
MD5:	047F957587CB5B7A50C2D084C99FC93B
SHA1:	CD8FF64D396D81BA0D091D40ACB14AF42171BF3C
SHA-256:	1151C5F56D884FE60FDDAED8A740F6D5C7E5B129003C99B442DE5694B4BBD9EA
SHA-512:	7023AF1C05AF234850B406FC55D4E3E8DEEA2A7A9EFE994970CEB9031A3D554D2C2D7737902BD00580E12D8D2A4915C164CC231EB2E1132AC1D7CCE7983C96BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............A...................................A.............................o.........Rich..........PE..L....._.........."!.................v....................................................@A........................@...n....q..P.......0............4...#......8...`...T...............................@............p..........`....................text............................... ..`.data...Po.......:..................@....idata.......p....... ..............@..@.didat..8...........................@....rsrc...0............0..............@..@.reloc..8............6..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.NETCore.App.deps.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	32886
Entropy (8bit):	4.271653336339308
Encrypted:	false
SSDEEP:	768:az9LVEsIhKPMEPrT3XCGjDyiEc6BHa21RJFe8kFN92uwtEeCJy1:uBVEsIhKPMEPrT3XCGjDyiEc6BHa21HR
MD5:	0AFAB28CD2E6AD278317D2A49B1F8E85
SHA1:	04930FB2CBD96B888CD2D45844CE7884E278DFD5
SHA-256:	B35AD1B7A01F6E2091F23F6FE6F1F62C737FF21C61532BBD24CB1FFA41AE4264
SHA-512:	A86948EF6A5B8D03508B710A2DC3E90EC984F2FF3016859D1956E20D54869D74EFF1B2CE68FBAA8C5C125BAEB89EE0042C10B7A54D21B87CA0E67FD3840D1093
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x86",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x86": {.. "Microsoft.NETCore.App.Runtime.win-x86/6.0.4": {.. "runtime": {.. "System.Private.CoreLib.dll": {.. "assemblyVersion": "6.0.0.0",.. "fileVersion": "6.0.422.16404".. },.. "Microsoft.VisualBasic.dll": {.. "assemblyVersion": "10.0.0.0",.. "fileVersion": "6.0.422.16404".. },.. "mscorlib.dll": {.. "assemblyVersion": "4.0.0.0",.. "fileVersion": "6.0.422.16404".. },.. "netstandard.dll": {.. "assemblyVersion": "2.1.0.0",.. "fileVersion": "6.0.422.16404".. },.. "System.AppContext.dll": {.. "assemblyVersion": "6.0.0.0",.. "fileVersion": "6.0.422.16404".. },..

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.NETCore.App.runtimeconfig.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.54941695087313
Encrypted:	false
SSDEEP:	3:3Hpn/hdNxDI/pANC+KL4nNOcW3mJAGRM3Bojqy2VKXmHEk/FTy:3Hp/hdNyhAk+Q6NOCUo+K8EkNTy
MD5:	3FBD84A952D4BAB02E11FEC7B2BBC90E
SHA1:	E92DE794F3C8D5A5A1A0B75318BE9D5FB528D07D
SHA-256:	1B7AA545D9D3216979A9EFE8D72967F6E559A9C6A22288D14444D6C5C4C15738
SHA-512:	C97C1DA7AE94847D4EDF11625DC5B5085838C3842A550310CCA5C70BA54BE907FF454CA1E0080BA451EACFC5954C3F778F8B4E26C0933E55C121C86C9A24400B
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.VisualBasic.Core.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1177744
Entropy (8bit):	6.861446822708677
Encrypted:	false
SSDEEP:	12288:Y85vmzudNqwpR73n2JqDyIYIH5lJKLy3ILjgs7iP/1lmbocFjJFkhON7z+sbaoiY:zvEud57vGnYl9CiFlRMJZVGoinaCSx
MD5:	2E4D2BB7B10370E662D0296DB6D26AC1
SHA1:	8DE6AF0FF61180A1727E9E9044F29999A2313034
SHA-256:	B1433183FF852993B00103C719F71E763808A7F4592FBC9ABD4CD04ED1D8FC47
SHA-512:	801A20A77770968E87FEE5522B586D3C07CDE631DDFECA73E1B69AE046DCD7C20049C8389175CB50B83B6F72A45C75403819A2A3B4E5754E58D2F75709FEFAF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........:....................@.......................................@.............................................L.......`;.......(...@.......D..T...........................................................L...H............text............................... ..`.data...............................@....reloc.......@......."..............@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............d....@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........R.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.VisualBasic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18048
Entropy (8bit):	6.570174715642814
Encrypted:	false
SSDEEP:	384:uG9NphH3cZeHxWmHY9QdWRsBlHRN7LG2teR9zbokoNrl:uGjHMZBWjLG2tC9zO
MD5:	96D85565E682B35F97668B63AEAECB70
SHA1:	8416B884BF99381696510288B4E5E7EA0BA8FC82
SHA-256:	0E44C228CACEDFFFAE49BD4E75FDCEBB0DA675046EC441F340571B5D1F2EE9B3
SHA-512:	B62A817A715066BA82BD2260B95046491D7ECA678B0FC262D24F428CCABAC52657B751BED19354CA2FF45AA5795E68B4D428C833E8F5C09029D6924F47191339
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I..........." ..0..............2... ...@....... ....................................`.................................w2..O....@...................(...`.......1..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......P .......................1......................................BSJB............v4.0.30319......l.......#~..p.......#Strings....l.......#US.p.......#GUID.......D...#Blob............T.........3....................................K...............2.................<.....d.J..........."...~."....."...}."....."...}."....."...d.".....".....x.....x.............................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24720
Entropy (8bit):	6.728069454622021
Encrypted:	false
SSDEEP:	384:sWhIpWgu1mLa9iQnByXhQuodCtZWasBlHRN7bRxwBmfWojR9zuswU0M5d1:0L2m0nMXGTIwjbRNfWoF9zuhM5d1
MD5:	65C6BE6BB035EABF68D48C0E133429A1
SHA1:	03160E6BD464D67A7952A4ABED8B360D7442C792
SHA-256:	E4AA05A6D64296D0C1F3D1B414CB2572DAB8E2FB2FA00E6440EB5BED3853F6C6
SHA-512:	90CADAFDEF4EDECF4E7A064C27241EA23A9CCE2FE08DB84F8AE98DD3B198A62C80490BBF8F3E428D1684B91E67A7BADC0FD5BF73A5DB9C37CE9BFD206B7CAB8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{............!.....0...................@....@..........................`......&.....@.............................................@............8...(...P..\...(...T...........................................................@...H............text..../.......0.................. ..`.data...]....@.......2..............@....reloc..\....P.......6..............@..B............................................................0.......................0.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........H.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...$.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\Microsoft.Win32.Registry.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81552
Entropy (8bit):	6.698502745816176
Encrypted:	false
SSDEEP:	1536:gzGaM3ml5EHVTatgFb2tzmv4ttmAsyJJTWxGsVibo5yWamyWh4arwHzuZ:kGaM3ml5uyt8yqxGsVibCyWr5cHk
MD5:	32CB37CA62DE381D8A3E25744B8E2CB0
SHA1:	3FC847335778A047AA4560A8B3C210EA7B10F503
SHA-256:	28F20B82579736B6838C7211A7BA59BCFEF933114CED589B6D826A363F7691DB
SHA-512:	1C2166F7FC2963B876399D0A6DFA7F3328A69732DA8C45819F2905768C5DF7AB3A60273CA3E92A48D53B66A91363EFCECAED18BB7E4F784F7350A84878427F92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%.............!..............................@..........................0............@.............................................4...@%..0........(... ......x...T...........................................................4...H............text...Z........................... ..`.data...............................@....reloc....... ......................@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.AppContext.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.776611511163506
Encrypted:	false
SSDEEP:	192:bALOxxBJW/7WKWo0A2j9seHnhWgN7akWGks9gICQX01k9z3AFMwyzV:bAIrJW/7WAsBlHRN7V/P/R9zVpp
MD5:	8785E10D6F118902410191188FD6633B
SHA1:	2C1EFC998E5779143319508464CC5F4928F08770
SHA-256:	D4A7C8488F3FBFFA433FC7DA52841FA9E6CB72D07B163D202F2F39D342CA5293
SHA-512:	99FB870716E4458CB78F07868F7DA873CD79BBA5E88846B85243FDC87FAD807222E13130186E1661850DB72A9F5EF6D17EEA03DBFE9685C030A7DA7F71C5AEFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q............"!..0.............^)... ........@.. ..............................R.....`..................................)..S....@..d................(...`......d(..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc...d....@......................@..@.reloc.......`......................@..B................@)......H........ ......................P ......................................9.....tR.....>n...@}..P\|(U.Ui(lv..s....0V....[!...4v......y....4\|...>.;.H~.cls./...D.{0.mG..,n.n..~....,..n...Qa:...a#.\..BSJB............v4.0.30319......`.......#~..,.......#Strings............#GUID...........#Blob......................3................................................".p.....p...;.>.........f.............Q.....Q.....&...!.&.....&...[.&.....&.....&.....&...B.&...O.&...v.p...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Buffers.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15504
Entropy (8bit):	6.774829599201325
Encrypted:	false
SSDEEP:	192:0I50xWm2WhWo0A2j9seHnhWgN7a1W/PeCDqF9e+X01k9z3AzsJYUcBQYy:UxWm2WPsBlHRN7fPeCe99R9zusTvYy
MD5:	EAC3CC3F0A07DF7FEF53E82A8D15C4B6
SHA1:	C60040084D76B0BFCA52DB7482B8CF0B85B57012
SHA-256:	507E35D0D2C265FD9F50B3B7278C99AE7AB9E0ADC754B27631BF28B05D01DACC
SHA-512:	931E58AF429E37AC1E9CDFA66336C753A96C5B134BBA15EB7763FE3C41EB69C1413AD2439252929CC57F0D61474C7CDD5103C4512205CBEACB792375FE039604
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....dp..........."!..0.............^)... ........@.. ..............................0.....`..................................)..W....@..T................(...`......d(..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B................@)......H........ ......................P .......................................&....!\|.a^.....iU.'.!k..1).Mr.._...c.Gm......Z%...........D.{....Ec<1.. 0eU.....H.P.3D .~..eP<g>.>_....?.........n..XBSJB............v4.0.30319......`.......#~..,.......#Strings............#GUID...........#Blob......................3..................................................y.....y...G.G.........r.......(.....Z.....Z...../...-./...../...g./...../...../...../...N./...[./.....y...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Concurrent.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224912
Entropy (8bit):	6.92338795816695
Encrypted:	false
SSDEEP:	3072:LCVSxgT5ahUrbOPr9l6v45cORHX28Eo84gr7dUwmkQrE4G7pg90yO29nqvgcji/w:wb9aUbOPr9ovzOR84GyO2ig4
MD5:	0EA9172D767B97F2C16671D29FE18B84
SHA1:	68B692248B38DBF628E57E8EF9B260CC523259A1
SHA-256:	3EE61C5E2F60877B3A8554E7670F9EC1D646E323916FA82725F852D329DC024F
SHA-512:	87783F4AE4521F08E92D49F791B7BC45E2ACAB47661669A79CC94F2EDFBEE05B340E07FEF88B6BADC9EE4FEE6EF74313E63531AA3B4DCED7E54D04DE59747174
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eE............!.........F....................@..........................`.......q....@..................................................H.......F...(...@......<...T...............................................................H............text...'........................... ..`.data....+.......,..................@....reloc.......@.......,..............@..B............................................................0...........................h.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...C.o.n.c.u.r.r.e.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Immutable.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	597648
Entropy (8bit):	6.870424786963628
Encrypted:	false
SSDEEP:	12288:EyGdyhQTmWAZcObKlCRl1Ra8JQodnLPMXz66M4cR4cYd/QOdNRU+:EMhQ6WAZcObwCX1Ra8JQodLPcFd1
MD5:	C5BB0FF1DBD1FEA5A0423FAF95E3BE1B
SHA1:	5C487FC8599B058869F71227C06EA9A3B32CCE45
SHA-256:	11F5AF684D43D6120EF56F1F45ACCD3284E9B213BB79B17DF2819176FFDD8E25
SHA-512:	FA5EDF84260D38094A655737D0F16AE24B26A16D7E94C822705999B71B78C729DCB00940F22B587F7A9E55D079D73BCF5D2EE3B526E4ACF4976F6568276174C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..............................@.......................... ......u%....@......................................................<.......(.......W..."..T...............................................................H............text...%........................... ..`.data..............................@....reloc...W.......X..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...v./...C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .c.o.l.l.e.c.t.i.o.n.s. .t.h.a.t. .a.r.e. .t.h.r.e.a.d. .s.a.f.e. .a.n.d. .g.u.a.r.a.n.t.e.e.d. .t.o. .n.e.v.e.r. .c.h.a.n.g.e. .

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.NonGeneric.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90768
Entropy (8bit):	6.564522296061092
Encrypted:	false
SSDEEP:	1536:tlRHIqjkL3fGFd5/jffSc6D+XBQCQeJYaoLrHzuU:tlxl4uFdVK+XBQCQe+aovHf
MD5:	1947ED2168876B046677687C670D28AA
SHA1:	96D94D937528A03745176FB96FFDC346DD1CEA42
SHA-256:	0D66781884EA4888CF8501A3E22AC33BBFE9EE4E42DC09F4AD8063DECEEB9835
SHA-512:	4FD6AF1B9B26FF35A7D943CD4FB8B1FF487F4A7C821748AF8696AB9F3C9F2DCB996EE7A7EB9333F57537B14BAA8536ECD9FA1116AA38469C46F0F7B1FB47212E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2............!.........................0....@..........................P......U.....@..................................................&.......:...(...@......0...T...............................................................H............text............................... ..`.data...K....0....... ..............@....reloc.......@......................@..B............................................................0...........................h.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...N.o.n.G.e.n.e.r.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.Specialized.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87696
Entropy (8bit):	6.681453855122018
Encrypted:	false
SSDEEP:	1536:KiPZkyLCiYvkCj8vYyY2041sTbk1o8nTZn6zuN:K+ZoiYsCYgyY2041ybMo8sQ
MD5:	6FFDABC44F72AD6184C28EECFC2E2B19
SHA1:	9D31DC015BA832D39DC5376E599BF7E508D882A4
SHA-256:	4A104D7971115A14A39697DEE7003EDF95C3EDEC528B8554B9BC03F1EC438CF5
SHA-512:	90E39E4EC02F791E35FE801959E4E7A48CEB0B133E729AB9AB72A71D2CA8503FFB4FECAAA1605B87250E61297ECB696C74FA28CEBCCDAD5C7483CB5A5E2F9ECF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........................0....@..........................P.......V....@.................................................4'...........(...@......D...T...............................................................H............text............................... ..`.data...&....0......................@....reloc.......@......."..............@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...S.p.e.c.i.a.l.i.z.e.d.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Collections.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	244368
Entropy (8bit):	6.876109335331511
Encrypted:	false
SSDEEP:	3072:2ouQOAJb4BJW1lPkXOL5Ts3yfgL40Y7PVvmtfYw1CqFAGCLpv4/7e2lHNNcQhDQs:plc0k45TDM56pAje2lHMOXqG1Gvkn
MD5:	413E11B6DDB658C8140CD449C1030F08
SHA1:	AE1CE59D4CE43C0F35C2BADF663316D92A1E2FA4
SHA-256:	79C7CECBE00941E9133A032B19EE471EAB90C2B65101B56608CCE96F1B0C62F5
SHA-512:	9961D3EA5F1B6987CDEECD572261FA60C661F1D12CA366221B3006504E8E649AA294C2CE4EAF150F8D7C1BD650DD83E42E9AF9470B3207542D86BC3CC6A559FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.....@...P...............P....@.......................................@.............................................p....>..@........(..............T...........................................................p...H............text...">.......@.................. ..`.data...X/...P...0...B..............@....reloc........... ...r..............@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.Annotations.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	172688
Entropy (8bit):	6.57197186052093
Encrypted:	false
SSDEEP:	3072:2t45lpgtRhCxOJHWcLveXc1GumTG5D5/vbF61+F7AwhYdrVF8lIf9Xav:e4/pACAtWO1QG5NF7t2rd9Kv
MD5:	19FF2E8EBE24C547466DC39780DB3DFD
SHA1:	D0A5031A2E26CD5A82E28D00C0CC4F690F306024
SHA-256:	3BFE0A399734168A42B4F0D02FD2753400F771D1576DD9854EF30714D623DAB9
SHA-512:	FCD4A1A5B90F686D1ADA294B1857EDC783F446AB7FF59116EA15498472ECBAA75AE252DD203A4CC9E56D9B45C6FDA7D14BD3A5634D48D04BF5EF3EDAACE595A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.............!.....8...@...............P....@......................................@.................................................05.......z...(......,...."..T...............................................................H............text....7.......8.................. ..`.data....'...P...(...:..............@....reloc..,............b..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...A.n.n.o.t.a.t.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.DataAnnotations.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17536
Entropy (8bit):	6.621290828090446
Encrypted:	false
SSDEEP:	384:78fmyfJe9eGXxG4mcUmWLXWDsBlHRN7CZLMB+6R9zctFT27ct:784xgnjCZos29zk2Yt
MD5:	D14286F66AD7CFC2B61DA1AEDD77ADFD
SHA1:	2D236376FEE3A61E112EE911688DFEB981687FFF
SHA-256:	BAD0A5A057B79EAB773C10F94FBDFE1812124317C1EF4C62B3BEACCADF027A5E
SHA-512:	6B47FC1F52667E3D5A217D0CA1601EEF9F141574C40078E4E504C0721AE713CAC7BEF2DDA1A217FB54660AB164789445A2CA1570A44AE4D728BBDFE623B29074
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...tx............" ..0..............0... ...@....... ..............................4.....`.................................70..O....@...................(...`......4/..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k0......H.......P ..d...........................................................BSJB............v4.0.30319......l...D...#~......L...#Strings............#US.........#GUID.......T...#Blob............T.........3....................................+...............M.p...P.p.....]...........................O.....7.................>.....[...............................9.....p.................W.....W.....W...).W...1.W...9.W...A.W...I.W...Q.W...Y.W...a.W...i.W...q.W...y.W.....W. ...W.....W...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36496
Entropy (8bit):	6.541755073809038
Encrypted:	false
SSDEEP:	384:tW7wWoaS2MghOWyiIo/DGwxVmf3p8XipGX5lAFDXSO88+6EZccdwV2R8TmZb4g8X:WP2oTPSFp8fDe84tavQtjeMed9zuJ
MD5:	E67CFA84EDF567D227A9C6235F7FA48D
SHA1:	CAA62BB259A5C8FDB83833219CA4F22A60515B64
SHA-256:	3E41C73A321560E947CB30DFD231D38B9DAD743E9A7ABAA65F6E9D6EC81FA1FF
SHA-512:	DE9967FC6445F038C69DDA59A062FA54CCBCC64529C2FDD06F90DAC9E30E1FEFEDF46B7309F78B0DD2F146E93DE373E3D4D17E2CC23D8BC1D1A051A9D525219F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....Z...................p....@.......................................@.................................................\...8....f...(..............T...............................................................H............text....X.......Z.................. ..`.data...z....p.......\..............@....reloc...............b..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...d.&...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...E.v.e.n.t.B.a.s.e.d.A.s.y.n.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...t.&...F.i.l.e.D.e.s.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70288
Entropy (8bit):	6.578092799555777
Encrypted:	false
SSDEEP:	1536:6x/UgL/nj4n5pnd2sbnVOXXk2/u3MorzGl5NC2oKQvpiKs9g6zuRn1:6x/JL2sXXk2OM2Cli2o3vp+9Bs1
MD5:	09748819C71017A812EF0EDE07348AA1
SHA1:	4CC902381E9D1353294379183D2F4B20F5FE3A9A
SHA-256:	5261DFB3E72DE897FE54E84963AF567289968E09F6B84A0C701A9A7F5C7AAC4C
SHA-512:	CD1EDC0E6280E8590A32895A54167569462F783B1E6E9BB0D0360CCFAB6B6DA0030F064DDFB3A340F96D501868ED93D72A6859DCC3DCE73E7145FB32A3654071
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P............!..............................@.................................2.....@.................................................h!..x........(..............T...............................................................H............text............................... ..`.data...f...........................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...P.r.i.m.i.t.i.v.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	679056
Entropy (8bit):	6.796522558418678
Encrypted:	false
SSDEEP:	12288:FTcghEy69E0kzMOaXzz7vUba6GOnV6LD8I6eeBWUUBvkkjodkGA7D2AmPQSsQ+Wn:dY9EnVO6Gqr6TWY9NV8Xk4QcBn9dfoY
MD5:	3EA6D1A70A4C678C6BCE6889B3B99B26
SHA1:	83641761708B3E3528D30F2A76F9A23C7FE68BC3
SHA-256:	1674C63B4874FE6DBE5377B996ECC4300FE2FCBA68345AE2AD4327696F528418
SHA-512:	A6CF74AF86B1B21218C1F6DC4343AFE3AC27AE1BA06B02CC5863508F7B9E04FF9D1F92E66BB6EF1FD34213A8415BEE4F4A9061CBC5444D4C2EA455D29732DA84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d..............!.....:...................P....@..........................P.......4....@....................................................8:...4...(.......h..h=..T...............................................................H............text...{9.......:.................. ..`.data........P.......<..............@....reloc...h.......j..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...`.$...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...T.y.p.e.C.o.n.v.e.r.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ComponentModel.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18576
Entropy (8bit):	6.543760418197241
Encrypted:	false
SSDEEP:	384:3Wb1WkvZutHHA+3CooWI1+sBlHRN70Fe99R9zusTRoo:oQhN10tj0s9/9zumR
MD5:	08459B61BDDD1B830127498F5F403A20
SHA1:	70E2725AFD69B7228459629819D34BB477A26090
SHA-256:	2F93DB8018D4874E7AFBC14AC4D53C6B11241D6E2C1523CC105D61FFBB696B58
SHA-512:	C84EA6F08F6CBCC855A62EF2EEFCFDF094FCBEC0858C1625B228098F6912E4F87B6D21545A886C0B89841E6BD035BDA0E2369D640C6226EB63C488C275E3D662
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H1............!.........................0....@..........................P......d.....@.....................................................@.... ...(...@..<.......T...............................................................H............text............................... ..`.data........0......................@....reloc..<....@......................@..B............................................................0.......................p...(.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...d.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Configuration.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19584
Entropy (8bit):	6.553019430424167
Encrypted:	false
SSDEEP:	384:gXoWX0yXQB1uXTSv/fvNRvGZYdf3zyP/weDEyaDNWkNWRsBlHRN7HYKoGlD/LVNW:TniDATjHHxLVNe9zz
MD5:	B8C01BDB9E332F2358C39ABFE5982D9D
SHA1:	08984E39511EAE9E3AA94F88EAD4E7835ECDE720
SHA-256:	840AC17C7661DD07D6758C0AE172C06AE3AFDB8F269CEABE31DFD2724651D642
SHA-512:	06CD0EDDB1F5F35E5FD40CD6277D3E45ADDA2FEFF2C7FFD19FA6DDC8FD2C10021714A4BD7974366E7740C0D67DD11665076816B2B290FCF1D93551097C58C890
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.'..........." ..0..............9... ...@....... ..............................=.....`..................................9..O....@...............$...(...`.......8..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ......................48......................................BSJB............v4.0.30319......l.......#~......h...#Strings............#US.........#GUID.......L...#Blob............T.........3....................................h.....D...............s.......\|...............D.z...............Z.................0.....M.................<............."...,...................v.....v.....v...).v...1.v...9.v...A.v...I.v...Q.v...Y.v...a.v...i.v...q.v...y.v.....v. ...v.....v...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Console.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144528
Entropy (8bit):	6.730145886392779
Encrypted:	false
SSDEEP:	1536:UbZmkFZRf8CRL0g6sFIqFJ+7VDFPQespWhfgr1RCuToGcjtPKe99kcC5/zuO:UbAI76Ga0y+KfUPX6JK9cg/3
MD5:	BB21F93E29C73B778AFD9F45F1CC71DA
SHA1:	2AB71473AE47F6F941D36DEF1B631757096D0266
SHA-256:	9090B6840346A886F8A0C850136FB5F97AA6CDD782A2B81518280D65BA78D75E
SHA-512:	339BE4686784279F911FA8CE7A9C6BAD052CD0C8A9A080F4A809C14C9E7074635FD139FCC1D67BC1149ABF9F4B68E0B11C88224D5EA3ABA0824909FCF6975EA8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?............!.........,....................@..........................0......b`....@..................................................,...........(..........h...T...............................................................H............text...b........................... ..`.data...............................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Core.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24192
Entropy (8bit):	6.280842052265658
Encrypted:	false
SSDEEP:	384:CEfbPFWOUSnPEW51b04H9DGMq/tE8aQjryAkxkBm4U1zXtzC1WQuIBW12WesBlHR:CaPFWOUSnP751b04H9DGMq/tE8aQjry5
MD5:	4F980E171C678E2397145EE3823FA861
SHA1:	FD8F0EF6C15930849F7C2FA5388D1D351EA9229E
SHA-256:	86719826561F575E6E1B8E57FEAE3527AF2EFF1798CA7917E28599D01CAC6429
SHA-512:	08E4E594291C91FEFB8803F9A41A014801E44D522129F5AB84B1011554FF395E8269B402CC258612C1737BA7A56FBF95FD5D3546359E7A922E53E51CDC145DD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C............." ..0..,...........J... ...`....... ...............................c....`.................................CJ..O....`..4............6...(..........tI..T............................................ ............... ..H............text....*... ...,.................. ..`.rsrc...4....`......................@..@.reloc...............4..............@..B................wJ......H.......P ...(...................H......................................BSJB............v4.0.30319......l.......#~..........#Strings.....%......#US..%......#GUID....%......#Blob............T.........3............................................................................1.N...c.................y.....0...........].....z...................................K...................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[...y.[.....[. ...[.....[...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.Common.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2734224
Entropy (8bit):	6.887704544788062
Encrypted:	false
SSDEEP:	49152:9mBKgxvq76nc4EPba92I7aE0Vnv1XgVi4nNmc28DpBsbRDMaVkmjk+:0BbFN8tDlVHjk+
MD5:	3AC870F0357D256B9494EB9F9AFB75F0
SHA1:	1E1C6783D7CCDA5122CA498D11BF76D411684B5E
SHA-256:	AB688B6A218A49754446C33E2B406B9974CFFA7EE571F746F8D7D8A2B98BE722
SHA-512:	3ABC6A4420FFD365E6B8C5FA03A0DE4F892A3D1CBCF63F9388B47A27D1745A9D1579F7FB2162C57B4BF23FEC1DA06504BC25835F8AA6CAC585775CA6438D120C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\.............!.....v&...................&...@...........................)......y*...@.............................................p.............)..(....'.H......T...........................................................p...H............text....t&......v&................. ..`.data....T....&..T...x&.............@....reloc..H.....'.......'.............@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.a.t.a...C.o.m.m.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.DataSetExtensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.650276978502567
Encrypted:	false
SSDEEP:	384:EquSWJTWD7W0sBlHRN77b1QG2teR9zboQUv2:VuAMjtQG2tC9zJUv2
MD5:	71CC2679C4C5EE0799CBC6B2FFEC698F
SHA1:	AFCEB79B0BB819964614087EC11D5A403910158F
SHA-256:	D336B21F13CDF593BCE6CC507F9F1783F6B0CD78FE55576D8E790ABCE164081B
SHA-512:	9D67C51A6BB497BF0AA05092526B5E83DE38DBE99351DC77ED7F50F5CEC1ABA3FA06914E9177912283D88165C78AF14731798DE3BBCDFA4F31F7AE75E8DA676B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2..........."!..0..............)... ........@.. ....................................`..................................)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ .. ...................P ........................................$.{e...a.t.Y..@g3x.L..+^k.o..&bW.$N4q......P.t.....I.._WA1...(.....k.\..n.G.o..'...o...*.......C_s...R.R.....;.+..$..<..".BSJB............v4.0.30319......`...H...#~......X...#Strings............#GUID...........#Blob......................3................................................E...............................:...'.A...i.A.....A...~.A.....A.....A.....A...e.A.....A...........E.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Data.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.239118755009795
Encrypted:	false
SSDEEP:	384:7B/JC9XmGP2SoxDZQV/SOWFFWJsBlHRN75tWTN4tgR9zJNO/q:7VsXmJDZQQVTjOTNx9zOq
MD5:	E519565EC2D4BF4F9BC88D85EDE9219E
SHA1:	476A0887F18382A4E9960A990C7DCB24DF08DFF6
SHA-256:	376D854DDFA7ACCC0B92A68AB60A40D615992CD2CE293C2C62D8940531D8AE67
SHA-512:	3DF85106DD38E13EEED4A7624503C0ADD49964CD4E7A6D3D2052D73CA676E610F9F97EDD5C7DE2F0B9DFF25007F53D47AE2CFF535B8DABF046776283CFF4E03F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.r..........." ..0..2...........P... ...`....... ..............................Qv....`..................................P..O....`..4............<...(...........O..T............................................ ............... ..H............text....0... ...2.................. ..`.rsrc...4....`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ......................HO......................................BSJB............v4.0.30319......l.......#~......0...#Strings.... ,......#US.$,......#GUID...4,......#Blob............T.........3....................................<.....[...............:.................A...........o...........!...........R.....Z.....w............................... ...........#...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.786356252523749
Encrypted:	false
SSDEEP:	192:KUEVZoxxeGWc2WCWo0A2j9seHnhWgN7akW2qKks9gICQX01k9z3AFMZu3h:KhVQAGWc2WIsBlHRN7gK/P/R9zVYR
MD5:	C7C70307DAB49D8D5AA91F71F3C94D4C
SHA1:	1DCB2362C603CFA0121D159E8F90A7B22D1BAE44
SHA-256:	248E46536DC622BA6B3BF052BD6F890068CCEA3E1D7201FCCBC2B8AC71CACDE3
SHA-512:	8B24AFB047B36D0F42EC168C19276EA1C20E7058A6A6A5D87C47E98539A743BE5ED51D235A29FC00C393F50206CAAD000499FB48496E564AB44BB5785082835D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........."!..0..............+... ........@.. ............................../.....`..................................+..W....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................>.%.6H......s.7.8..N..j?.XW..;.....P..R.......Y.+...F...-..I.m.......w.._.0..._hB..8.UA.........;.!>.=....M0.r-.}a.F..B...BSJB............v4.0.30319......`.......#~......H...#Strings....8.......#GUID...H.......#Blob......................3......................................Z.........9.........................,.....{.........F...........5.............................#.....p.........................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Debug.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.7572463978827475
Encrypted:	false
SSDEEP:	192:GU1bEGVxx+cHW4mWAWo0A2j9seHnhWgN7awWGSXhG2ZUnQJeX01k9z3AaoPtaDj:5foOW4mWGsBlHRN78G2teR9zboYn
MD5:	556D168C50DD2260496570302B1E09A2
SHA1:	F0E7A05E82179D7E02DD3AA2B7C1720DD4C3A45F
SHA-256:	4C0544796A65854B5D66624475ECAC75DEEF64E85122C884CD4F451DE9BF33CB
SHA-512:	43E2834510D476011879ED1DFA3F864F80C24AFBDE042D3B2E9EE7710D1AFA69863B53BA0252A0F2258134D3A092146B29A8C6E1CA03276623563E62293A920C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............n+... ........@.. ..............................b=....`..................................+..W....@...................(...`......`*..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P+......H........ ......................P ........................................'..?...L\|..,?..N..i..U......%{.a.f.....{.NoDws..+..J..d.I..p..^\|.....'gBS...9..S...T.....p...J5la>V..6.k...;....m.,WG9BSJB............v4.0.30319......`...t...#~..........#Strings............#GUID...........#Blob......................3............................................................o...................4.................;...8.;...].;.....;...F.;.....;... .;.....;.....;.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.DiagnosticSource.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345232
Entropy (8bit):	6.863147515269157
Encrypted:	false
SSDEEP:	6144:1U9radYoujlFpzvKKvbnsM32etqSV1yFZCRE8WEn3J54W7O05C3roZ:W9aYomRSKvbnsM32AgCUsi6o+
MD5:	D6796EE50230E377AF9C46DF14824630
SHA1:	B2B46E42ACBB9A2DCB596187F6148CAF23B21E56
SHA-256:	224BEF1156CC59F0EC604106C11F24493A8C7949E9CD9B537C5C209058E9D25E
SHA-512:	50A40C4CDC2D16AF671AAC8236692D2A469452EE59ADE1D023538DD716AFD0C7ACB6DEA583CDB2D7F92C752FA25ADF0DABC6C143EA44FB634549D5D332A8CC02
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../............!..............................@..........................@......#.....@..................................................b..(........(......./...)..T...............................................................H............text............................... ..`.data... c.......d..................@....reloc.../.......0..................@..B............................................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .C.l.a.s.s.e.s. .t.h.a.t. .a.l.l.o.w. .y.o.u. .t.o. .d.e.c.o.u.p.l.e. .c.o.d.e. .l.o.g.g.i.n.g. .r.i.c.h. .(.u.n.s.e.r.i.a.l.i.z.a.b.l.e.). .d.i.a.g.n.o.s.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34448
Entropy (8bit):	6.535612615327265
Encrypted:	false
SSDEEP:	768:2GxnkdMtpKwLiKqFCM1n2owSIvTkO6jRR3l9zuCfr:5xFtpKwLidFT1n2otmTRWLHzuur
MD5:	85A3B3FF4FF3FB2E9893CF4091112F9A
SHA1:	9389FA6041817A12279B56DE4AE6A015E0D6AA37
SHA-256:	E317A3D3B3DABC8D898E93B9C62E05431A93AAD0AF29885595A447FE2AD1DF42
SHA-512:	139E5C424FB95D4691024681CB170C9AD79959E24347B8056E3F18AF3D44E0CE0AB482B4591FC2AE9687BA80008FEC54CD1D51F5D607E08359A0FEA39C21F60F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.....R...................p....@.......................................@.............................................p.......`....^...(..............T...........................................................p...H............text...1P.......R.................. ..`.data...D....p.......T..............@....reloc...............Z..............@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Process.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	263824
Entropy (8bit):	6.831846259645366
Encrypted:	false
SSDEEP:	6144:ImfcBAv8zy7hIwM9ajuwFXVs9b3NX1Pkx7qkvmhMDRWEQR:ZiQn7h4UjuwR3hpvSUWdR
MD5:	FEAB1ECD253497762663DDEE56B460DD
SHA1:	2811F373E1C73BFEAB89441B9B15D5764FA4DAB1
SHA-256:	D0E179EBE4788D424F0A8EC6306EBA24FF6584B7D760420EA4245CE64A5F1EDE
SHA-512:	F4E8CA5C3F8B0256471196E54660BD35647B5DD5E5628D7EB1AAAE5C9E25FA48B3050922F3A90B2CCB2D94FF3DC8D9FAD849A9D3FAB0DB412F57D95997AC37EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i!............!.........\....................@..................................]....@.............................................@....F...........(......h"..8&..T...........................................................@...H............text....~.......................... ..`.data....7.......8..................@....reloc..h".......$..................@..B............................................................0.......................0.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........H.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...$.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34448
Entropy (8bit):	6.591291675128323
Encrypted:	false
SSDEEP:	768:pcgPzNFAYGjonAYkH3fn9Is/7Y0KjQ03l9zuJa:pFzNKYGjonAYA3fn9IuYBVHzuA
MD5:	5E253BB963B8F1DC3A4EBE474FB8305B
SHA1:	4AD3F09F60F28D7675DDC10CDC3B236AD9CE3082
SHA-256:	9001876BAB9D59DAE97A949F50E3F2AF160B7BD154EA2810E6FB1179209BC826
SHA-512:	4089A66AAFCFDDC19DD8A8541D2952E3AF37A1D6B2BAA610F5770F689CC4C6E943A599CC5B06EAB92841A5E07613A3FD65D3B15D1E477E65AD2E1B28E45CD73C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ry............!.....T...................p....@..................................:....@..........................................................^...(......t.......T...............................................................H............text....R.......T.................. ..`.data........p.......V..............@....reloc..t............\..............@..B............................................................0...........................h.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...S.t.a.c.k.T.r.a.c.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54416
Entropy (8bit):	6.69985329524874
Encrypted:	false
SSDEEP:	768:lEqA6M3IhkZ5gBsUbNNIdzXRCIDvFPG1PxATFAVAXhjLV3l9zudf:lRA6M3Ihm5+Id7EKVG1PxAiVchxHzup
MD5:	561168B7D4532D3C105450794974E320
SHA1:	DF02BE8636AC1AD38003B9D53EE6ABF84D20A38C
SHA-256:	960A387FF8C3C16E2CF67E5E34258FCF342B16605D316CD4975834A1206B7286
SHA-512:	DA7BA2BA72651EEA7C96C7C62B338C5F267E39068D89385EAA466346D89625F956CA934F83231CBFE7B7CE9C5A2D0CA207B9228454FF8E7E066F650FAB9681AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..............................@.................................).....@.............................................0... ..X........(..............T...........................................................0...H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0....................... .....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........8.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...n.+...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.e.x.t.W.r.i.t.e.r.T.r.a.c.e.L.i.s.t.e.n.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...~.+...F.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Tools.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.693387870178034
Encrypted:	false
SSDEEP:	192:icVWA1xxe4SFWYUWEWo0A2j9seHnhWgN7akWVopqks9gICQX01k9z3AFMZt+N:DX/84OWYUW6sBlHRN7zpq/P/R9zVZAN
MD5:	8A1554B6F20ADB80A9DBE6AB0C5AC304
SHA1:	CB21962BADCF5F105BD89EF94AE83E06A859082A
SHA-256:	35A090B446737202576600295F114E8B2818A04D7B22F96B1F93CD6EB62D27C3
SHA-512:	ADC9FCFBB60EEDDE167D102A6297B43D3793C9CFD20B6F649FA7370FD5B1151F3646BC4AE5E4163B5F034BC62C15A7743A854AA20108DF67D6DC146205F8D76F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0................. ........@.. ....................................`..................................)..K....@...................(...`.......)..8............................................ ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ..L...................P ......................................W8).. %.......(......\'P.8.V....l..X$D...N.d._..h.s..?3....N.e..o7`.....b.D.T.w...W..tDlP...GW.r..&E.e..l+......*...I.J.L.lBSJB............v4.0.30319......`.......#~..H...H...#Strings............#GUID...........#Blob......................3......................................Z.........s.........................,.....w...N.....F.....0.~...!.~.....~.....~.....~.....~.....~.....~.....~.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114832
Entropy (8bit):	6.660128923430778
Encrypted:	false
SSDEEP:	3072:ZHvbIJ4aO5fRyUpFksoyzf9eVfiTRCexHh8BmtR:JM7+pFkTZuHRn
MD5:	7BD2AA57E35783809579CE8747EF0894
SHA1:	C419C1E0028D03A502E2808396E31222046C6944
SHA-256:	6A4E1BA126EA4BE51D96C5CEABA6EF33312D1A3E9775AFB9F5B64E5028BACD69
SHA-512:	8AB8BDFEA056E2DD65689962B1EFFA635355A882B23E7F0F3B89875E4EC0CFFFDD4EA38817FE928A1D058AA2F848CE6C5C57D6C6C6CF5A85FD207FAAD3AA37E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Y............!.....r...$....................@.......................................@..................................................+...........(...... .......T...............................................................H............text....q.......r.................. ..`.data...H............t..............@....reloc.. ...........................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.r.a.c.e.S.o.u.r.c.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.710621874483606
Encrypted:	false
SSDEEP:	192:XX6pDj+yTxxdWW6DWhWo0A2j9seHnhWgN7akW2e76zHBks9gICQX01k9z3AFMRh/:i+yN3WW6DWPsBlHRN73SkHB/P/R9zVRN
MD5:	D3F1E0BFC88C5FFD88E32A2DBCEEF492
SHA1:	FF9713BB2FE8574E3E1C4F5325FA071A327FDC84
SHA-256:	53AB12A1169AB36F81C05473A303FE4052E5DFF86069A82F82031DC4EF5330DE
SHA-512:	9BC6F882DABC62A7DD0F96F85CD6E1CEB7261915EF43B58C4A9CF34DEEE231B1C8F3E6E9521D4ADC140C17441DB50D3E2937EBC76A154019182351F62A5AFE8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............>-... ........@.. ...............................9....`..................................,..W....@...................(...`......,,..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ -......H........ ..\...................P ........................................BO.i......h..y.....?".....$8V.`....S...&...~:.h...fz...\|...?..{.@...A.HG.f..A{..}>.q...#...f].Z...`d.....3L....`.M...=BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3................................ .....................].........................................m.....q.....D...........P..........................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Drawing.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126096
Entropy (8bit):	6.557721715214292
Encrypted:	false
SSDEEP:	3072:hGI7hYX9I8GfPMbjunhO4xfHO0mqbq6odIYp19n4:F7ho9I8VWhOx0V7efK
MD5:	B52DA8195A7CDF5AAF8E6EA88AE44352
SHA1:	554998B4D8DE573D0638B99B0542C04E09E80459
SHA-256:	ED8BAEEF9BCEE49FE1246B457B5401CCD4C0E3CECD487B5C5422FB094B822ECF
SHA-512:	57D240CCF6AE9DF4F87A46B187CF05AD2DF3D1B24C5CFAD35B11289EE43324552C56D17072BF2667D2B5A46FB04EC219F1B5B253D451B753D2CCFC438D565221
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U............!......... ....................@..................................(....@.............................................4....*...........(..............T...........................................................4...H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Drawing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.3817360654042865
Encrypted:	false
SSDEEP:	384:esLzP7uC8sYITet7P95bvWGtWnsBlHRN7a7LMB+6R9zctFWAWs:es7slVja7os29z5Zs
MD5:	6E5A60DD983E1D248F2B309061423EB6
SHA1:	A4676D67B0EFF04F0152597E1E2F88EFC11D7652
SHA-256:	2B644D9C5D881713075BEF021B137A739DE3DE16E892111EB48176B96B8BACEE
SHA-512:	98F2231B47EA013461FFA238F319358B13ECC3BAAD34E7C5009058C230AFF8560D0CD113C13DCE2D515B2BBFCE800BAF8C8758F50135C3109DE967DE18617CFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E..........." ..0.. ...........>... ...@....... ..............................@.....`.................................}>..O....@..T............*...(...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc...T....@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ......................(=......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID.......H...#Blob............T.........3..................................................................m...........#...............d.....x...........W...................................;.....~.[.......................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V...y.V.....V. ...V.....V...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Dynamic.Runtime.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	6.667203520619766
Encrypted:	false
SSDEEP:	384:2GMC1j7MW+CWxsBlHRN7My50ZSxR9zus5z9VfS:F1gmjL50Zi9zuCZxS
MD5:	B0BC9071189BAAF05E6E39D32965615B
SHA1:	682B6E1F319BCBEBEBE362F54302429D76CCCD09
SHA-256:	25EEDEFDB03D33437E597DDB2938E06A4FA9A5050A78E95A7F1594AED14EE71C
SHA-512:	F85A57D8AD64EAF4E46E093BEF34EC8A11C9FC10D4906232D585B4711BEB27C8DC6CC01460BBD8C3D91833929DF9AD40F4C2F5C598F52CDD71219363EDD233A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"!..0..............,... ........@.. ..............................5A....`.................................X,..S....@...................(...`.......+..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........ ......................P .........................................T.a...0...u..k"x..<.s.F.v.2&I.Z;x.jY7...\|....r.U4N...C..(.'...c..(m/.Y..:.h>..).bZ.....'mK..d.6.....=t.3..;......,.BSJB............v4.0.30319......`...P...#~..........#Strings....0.......#GUID...@.......#Blob......................3......................................>.........W...............................Y...9.r...j.r.....r.....r.....r.....r.....r...w.r.....r...........#.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Formats.Asn1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179344
Entropy (8bit):	6.851884000597485
Encrypted:	false
SSDEEP:	3072:hRL7euEDcP6dv98kZTjkKJaphMMZBwy5wgOuG4krZAuZAY/Oojh8eiPoGQWUc/6:iuEDVdZToKENJ3olzigGHC
MD5:	F1886A01B3DA6AF4CA90D0A01E9F86EE
SHA1:	93F1472632F3B7C34FE8F5837BD894B7BC2623F4
SHA-256:	E6FF77A6F47338B8146F72858E7D1BF897727534306A1991158015FD8216D585
SHA-512:	F81F81E450D6F80A7AF137E04E4388E9E057505FA83228178A5437BBB6A810CB49D923A26C27591E5F8B67440903EF0B12CB8A5384AFAC3EFBF12C526D1F86FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!.....b...0....................@.......................................@..................................................=..`........(......x...l ..T...............................................................H............text....`.......b.................. ..`.data................d..............@....reloc..x............~..............@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.h.a.t. .c.a.n. .r.e.a.d. .a.n.d. .w.r.i.t.e. .t.h.e. .A.S.N...1. .B.E.R.,. .C.E.R.,. .a.n.d. .D.E.R. .d.a.t.a. .f.o.r.m.a.t.s...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.Calendars.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.777047838998614
Encrypted:	false
SSDEEP:	384:xqav7vRqXWDRqTRqm0Rq7WSsBlHRN7Bkj05seyR9z0Vuw2:N1qKq1qmuq6j6j05sN9zAM
MD5:	B18AB3D66B8E36CA04BB6E794559573B
SHA1:	DC01FD410E71AB6D4FD487D1FE6236C1A4E8783B
SHA-256:	D78D9D700538AC5785823F9DB3FAE7B647B7266E57F079F68744C98B188D1C80
SHA-512:	1125E541F6685FA79CDB4D5860E02C20AA65AF373FA141093BA659E5FC81AADF1D998A5A8668ED9CD9ADF4C3A2CE2568230A4F80F4A4A8090A01C37A39F19509
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............+... ........@.. ...............................S....`..................................+..K....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................v0..2...~.1.(.O......~..jP......4.N.W&R.#h.9..zMY...]..b..LItH.=..._..l\|.w.E.r...=Z+.<6r^b`.]$..)./....X.....$.I.....;.hBSJB............v4.0.30319......`.......#~......$...#Strings....0.......#GUID...@.......#Blob......................3................................................"...........;...........f.......,.................H...!.H.....H...[.H.....H.....H.....H...B.H...O.H...v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.8125235529806405
Encrypted:	false
SSDEEP:	384:ElgRPWYRYRp0RjWtsBlHRN7zG2teR9zbocfP:E0NqpuJjzG2tC9zF3
MD5:	47454EF854BED8E23E0E92F0A524FBFA
SHA1:	DDC3BE351CC8D4436B529C405BC2A8D55F1B68A6
SHA-256:	9AB26FA750DC0A0223AE06E8889B493BEA381781AF3437EED88A980B2E041800
SHA-512:	4B5842A76AB0CA3FEFB32A85F06764BADF4EFC85D44A4E47AE2E1E61E87012CB6AAC1987CF7C7DCF3A7AD50B517FADC77FAE5BB138D728D23E82564119EB79DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pw..........."!..0..............)... ........@.. ....................................`.................................h)..S....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .......................................G.../.PE...$...IJ26D:..I.d.7...).Oy...1...&V,'".~.P&rqqk..C.X..Acw.N...{0O..,6...y......C..+^.N.:..)"pZ.=o]PA.A.6.[..U&`BSJB............v4.0.30319......`.......#~..@.......#Strings....$.......#GUID...4.......#Blob......................3..................................................P.....P...3.=...p.....^.....a.......%.....%...w.%.....%.....%...w.%.....%.....%...G.%...I.P.................7.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Globalization.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.725154296803221
Encrypted:	false
SSDEEP:	384:WGnQYApRLWdR5RA0RHWBsBlHRN747j05seyR9z0VuIc:WGnQYm0PAupj6j05sN9zAq
MD5:	3C361171AA62AA0BE62B252934FA9D9F
SHA1:	4773A2DF6830C939FA6E15EF4568625E97D6F9D9
SHA-256:	68D472245B6CC0CB42F082140F88050186F368E4B5DA710976E2D1EDBC473C14
SHA-512:	E691B7A0DB09F08167C338303168106A518DAFD2F73B3EEC98373BE2E4FDDAEA60DE2511F5E3E515A46432334EEF64B1511FF9A4639847EE92892D681C2944C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............+... ........@.. ..............................W.....`....................................K....@...................(...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ..D...................P ......................................-..J}.......+...Em...G.b.7..X.....e3h]..n.4x>....C....u.*...E).....Z.t.F.o..^..Y..k#J.j..^._,.....T.VNo"X.b.:.o..ri.BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................).........3.K.....K...L.....k.....w.......B.....,.....,.....^...2.^.....^...l.^.....^.....^.....^...S.^...`.^.....K...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.Brotli.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66704
Entropy (8bit):	6.653274992647268
Encrypted:	false
SSDEEP:	1536:DJW5aNjqF774jdSpnXb232CqkVmlTe0Fazujl:DQ5wqZ74jMnXb23V8qUac
MD5:	493231632FC6886FAEE04E2EE5470140
SHA1:	E32880F77038418CB29E444441D75AA76ABAA2B8
SHA-256:	76B7C75C1B6B281A56C913FFDD360CF56130AE150568284DCA34D35ACEDEADDA
SHA-512:	C83FC49BB7EFBEE0727A3A5C0938D7180493B40F3FEA20EE77EE1518ED3119AE79327FAF85885D18718FE1611D463DCA8E35366BD5A597DC64EC95C2687C6B5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....P............!..............................@.................................%.....@.............................................L...."...........(......T.......T...........................................................L...H............text............................... ..`.data...............................@....reloc..T...........................@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.FileSystem.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.705390265929467
Encrypted:	false
SSDEEP:	192:qOPcizfWQmWTWo0A2j9seHnhWgN7awWb3JhG2ZUnQJeX01k9z3AaoCtZ:PPffWQmWpsBlHRN7UG2teR9zboEZ
MD5:	7C06B8FD89AA2D7EE4B1CC6340ACB566
SHA1:	FE43CADE4335F74B38F16A0C355826608C0D8AEE
SHA-256:	30684F0E39CE3BD6DA23A5C51E80B08A709E17793944A233D325187B9568A157
SHA-512:	9A36BAAF966B4789179406FD5591CB3108532A1FEC701E49C6C95336B1B5668BBB0CA421D5AC351EA0763FD14429A5A48E2E599316CB36CCBB670EFA822015B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ckZ..........." ..0................. ...@....... ...............................X....`.................................9..O....@...................(...`......@)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................m*......H.......P ..p....................(......................................BSJB............v4.0.30319......l.......#~..t... ...#Strings............#US.........#GUID...........#Blob............T.........3....................................................I...........k...................[...+.....7...................................i...........x...........Q.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.Native.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	766608
Entropy (8bit):	6.1386572659536895
Encrypted:	false
SSDEEP:	12288:2J92xBBTJQ22E12g2126CfIqy3u8o2/lsnNuVYEQTsA6AHhly88UXTw05nmZfRoN:+OJQ22E12g2126ml2CTR6AAfAmZfRoN
MD5:	1104475FCAB9E3A781137C07FEFEA241
SHA1:	A65175DB0429FCE83B2AA8846980A446290866AC
SHA-256:	F1783F8F81DDF02AA88D827DC6BE72C27F3E234B5D2299E44C1A42EDE6024F96
SHA-512:	1E9F9AEF423625BE2CED3017BB871C7F3933A47E0DE1D918A0795B3444E79F2B197A243FF98967D611D49D099DD924246B2BC224593CBFD93279237DFBC5BFD4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C._{-Z_{-Z_{-ZV..ZS{-Z..,[\{-Z_{,Zh{-Z..([A{-Z..)[R{-Z...[R{-Z..%[r{-Z..-[^{-Z...Z^{-Z../[^{-ZRich_{-Z........................PE..L...Qp/b.........."!.....H...B.......<.......`.......................................>....@A.........................\|..<...<...x.......`................(......p....v..T...........................@w..@............`...............................text...tG.......H.................. ..`.rdata...#...`...$...L..............@..@.data................p..............@....rsrc...`............t..............@..@.reloc..p............x..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36496
Entropy (8bit):	6.562923522088102
Encrypted:	false
SSDEEP:	384:1WTIWtNu/al2Yd5zDN2BI3/fRBU+bf3smZEyjr9Xpee2FH9CEOGdqtHfSaGU09bR:WPDf4QRt/c4E7cGcWjG+fXi9zu8pg1
MD5:	277DFEEE9322072FA412547E5F8AD169
SHA1:	2F605EB8B39EEBE25BF8DF64DA541D191722FB8F
SHA-256:	F9A259662B511E04A186251879B18B03B7AFF627AD8C2FE59C17C5B1215A967B
SHA-512:	FDCE6D2F63E89497F9061E7ED433E2EC9762D7E70AC00340A64B4CDF21812892D09E1EEE77C752D2CA2E1ECB9CE5B3578A54369287659C2741354CD805F8927A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....X...................p....@.................................,.....@.............................................L............f...(..............T...........................................................L...H............text....V.......X.................. ..`.data...G....p.......Z..............@....reloc...............b..............@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Compression.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	244368
Entropy (8bit):	6.783521443214478
Encrypted:	false
SSDEEP:	6144:9Hj/m6VjoJtOlcDpqelVTFannd1qI5GrQuy7ZyKW4:9i667OlcDs0g1YQuqZ
MD5:	EC95CC11343B4B1394EF2AC90C8EF24A
SHA1:	905E9170AB247BFD0B7405FEFCFB57E1257FBAAE
SHA-256:	E701D6D595B2593805C042F0FC86DADBA2E1D860FB23755C6CA35D942228ACB4
SHA-512:	A3D6C98F2413DB1BB67E486476D55BD3AC7E2923E3ABC44A12303EF38437FC474C0C5C65F5A41BF76EA45F4696B9B06F07DF83D8164E2F1836C6BAF7B0FB9ED3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............!.....B...N...............`....@..................................C....@..................................................H...........(......8 .. '..T...............................................................H............text....A.......B.................. ..`.data...?*...`...,...D..............@....reloc..8 ......."...p..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........$.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.AccessControl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85648
Entropy (8bit):	6.713808714027247
Encrypted:	false
SSDEEP:	1536:DLFUr/CkmzX5IYRIHzs6+gvXYeFBxWHm1kkj/fpVId8zu2:DBUrzmj5IcLcRum1kkjpOaj
MD5:	E41E3980F2DBE49B92D9A6F926ACAA6D
SHA1:	2E031F0D25773C5F480C2609A5A2E8022664D039
SHA-256:	92373DD5E2E63BA5E20AABEED50A543D8DE680CCE1AA381DDA0366F8C6661647
SHA-512:	5CEF16193581D50DB094D70853A703ECBC4B037C633B71BEBBC1186C738191462F8AB2477DF0291469BFD63F4E301F1E9C0B6EECDEBB0172748DE5C297302208
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@............!......................... ....@..........................P.......,....@.............................................p....%.......&...(...@..0...8...T...........................................................p...H............text...s........................... ..`.data........ ......................@....reloc..0....@......................@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40080
Entropy (8bit):	6.572619813252983
Encrypted:	false
SSDEEP:	768:T0ZIf/xO1i6JXYAKikKVY2zoxTjURJQP9zua:TxYi6JX8iDVY2zOnFzua
MD5:	7A732DFF7D970F41E27D7278DC76800A
SHA1:	22AFA1BBDEFC43819839A67D86C2D7F66709F202
SHA-256:	4AD6C763F5CA16BC601413629399C64C27FB48C1DDB8870AEFF676838AA15BFF
SHA-512:	6499CD711B2A94BAFF22B4E86A4384E5B31B583E7F5C0157BD304A993175446357A97B844EA1DD0800A9CBCBE6335DAA2B2EE19CD4347B1145E16B07AA02489E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....f........................@.................................-.....@.............................................X............t...(..............T...........................................................X...H............text....e.......f.................. ..`.data...e............h..............@....reloc...............p..............@..B............................................................0.......................H.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........`.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...<.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15504
Entropy (8bit):	6.8108803388986825
Encrypted:	false
SSDEEP:	384:KgT9sWZqW9msBlHRN78oWOleLR9zusQQHt:K6hTj84ed9zuEt
MD5:	7E22B96C283718F145111502F04B04E3
SHA1:	D8FE26E1AD136BBB221724B3521477AEC3B0F28C
SHA-256:	A14309847889C041B1FCA50A0433DCBE822CD74B92E2877F7AA0AFD5AA63473E
SHA-512:	F32B5572260602BE81562201CA83A64A3819B7D291D070D5915597258D98A95293354104786964AEBB45570140AA062DBC069C9BB97ED844B264A1469A1E2225
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............)... ........@.. ....................................`.................................`)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .......................................u..N.GZ...s.w..l.e;.9.(..D.O.1K0.,A....h.......Vwh.)....z.f.p..Zbn.V../s._.f....'*."5...!.$.....{h.....`....;.......IBSJB............v4.0.30319......`.......#~..L.......#Strings............#GUID...,.......#Blob......................3................................................!.J.....J..._.7...j.......................E...........Z.......................A.....s.....u.J.................1.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67728
Entropy (8bit):	6.636928688093189
Encrypted:	false
SSDEEP:	1536:9e1V2xvsIg/ILBZOxf7lg0dzo/x0npK31z74+zu8YS:9AcyIgQlZOx7l9Vo/ipC1xz
MD5:	A148CB9F782A6168BB0ACC34AE0FDF78
SHA1:	5A95CF43B38BDBF2FA1747038DB7D1597F55F7B4
SHA-256:	80AC3E813B53D930D3DC9EFCAD7F4F5F069FDCB79A0832D1C49B8C7011B2494E
SHA-512:	508179827B1A32F068D260A8231301FE4904E5D2E0302207AB4477F271D95CD67DC8963CC03F3F126E0B4E3B4A990A5A72B17F2008CFED9803C5C951C754F4C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...CE.............!..............................@.................................w.....@.............................................L....!..`........(..............T...........................................................L...H............text... ........................... ..`.data... ...........................@....reloc..............................@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.FileSystem.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24192
Entropy (8bit):	6.338622378030698
Encrypted:	false
SSDEEP:	384:15aPWc+mFnJ85Zu+m2sqjd5z5nNktLjhuNW02WLsBlHRN7NWeG2teR9zbo1Q:GP7Fn8dPfVqpiojhG2tC9z5
MD5:	DB3FB70F7C06836E7AA1BDE20C940D9B
SHA1:	2CA087D32580745C0BC7DD04490A5F1EEC423B90
SHA-256:	197DB4F4A589607F59B95D9DC252CE94D47D4DE848C6711DCD204519824A280C
SHA-512:	61AB0C374F5650967B541268E7A4C1373E66875CCE6851D04A1D26B9E1A09AFE228D80F8DFF1896A4551CE50ADFFA23FDE39ECFE5569E6CF106BC9AECE06B782
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....A1..........."!..0..,..........NJ... ........@.. ....................................`..................................I..S....`...............6...(..........LI..8............................................ ............... ..H............text...T... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................0J......H.......h?..............P .......>.....................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADP..7../...........S.t...p..T...3.2...0.J.M..=.0....bAA. .e......"....N..~..s...@].Sew.s.t.7.4...5.......x..........]..Q~........#n..'.<.+2]./...0...2.W.4...4>..5q..:...>(.3OL"PP^..V~..VV..eRaDf.3.f7..f..fj.Hpj.1.j..&u

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76432
Entropy (8bit):	6.5659207742202215
Encrypted:	false
SSDEEP:	1536:ub8K8pqcctypdNeVcp3MSm2Hju153xmzuzAn:ubnjypdNeSp3MSJDG5BmgQ
MD5:	8126A3BFCBC4D138E78806C4E6D825D2
SHA1:	ECC548029C786BB6840A6598FC7F3CEC8A79957F
SHA-256:	9DF8E64B265BF5741DF22E1D497BEFBB09015799C4D387B667DDAF62F6ECAFA4
SHA-512:	F005AB3C996C7D21382999B072498989F6E2D8F48E42BA080C241FCA5B71FF3A30BD51219199FC7C6260F921C6C356808557850F6D72E322E687EAF362010516
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..............................@..........................0...........@.............................................4....#..X........(... ......x...T...........................................................4...H............text...h........................... ..`.data...1...........................@....reloc....... ......................@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65680
Entropy (8bit):	6.522981274808922
Encrypted:	false
SSDEEP:	768:WQAFnLfPbREYI82hyqdHePkj0v+xP/APVFwK0k6L9vHGujLiXi9zu8Zf:WQeb+82Zj0v+xPcVFZd6LNp6+zu8Zf
MD5:	33837959142C5E36F23C7140EEE2498A
SHA1:	81D98DA677BF3656572E5B8CC4058CD3DC667B84
SHA-256:	336E153CBFD7078BBD03AFDB0A36F0397C3C55DF365AE5EB4C94D2855D7DEA2E
SHA-512:	00F61F75CEB3F82E0AAD59FD26A03E84110CC1CDEBC6261D410D9BF8AAEE85C83AF2C488A8B3BCEA3E120C02F183D25F2771D6E430435388F4E487FF6526F95F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.A............!..............................@.......................................@.............................................@.... ...........(..............T...........................................................@...H............text...%........................... ..`.data...............................@....reloc..............................@..B............................................................0.......................0.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........H.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...$.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.AccessControl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.78996646613368
Encrypted:	false
SSDEEP:	192:QA2ePxW2WjPWIBWo0A2j9seHnhWgN7awW+bUJt7hG2ZUnQJeX01k9z3AaopoMyH:Q9e5W2WjPWAsBlHRN7bIJ/G2teR9zboE
MD5:	40A79FE660CC0F90E3E2403038EF70C8
SHA1:	8B4BFC3679FF45FDA889A4CECC0A03CA45361E7F
SHA-256:	933555B280C84F7240F2DD6CAFFC70B5874DE3880D0F069869445298399C3EB7
SHA-512:	141383C344F351C61901C381E5E95A7EB227546585036D26702A5EDA31367499F64E8B7D11B5644C5427FDFC05DF8A38F3982EF803F1E560C07EE3290074FDEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............~-... ........@.. ...............................K....`.................................0-..K....@..P................(...`......l,..8............................................ ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................`-......H........"..............P ......h"...........................................<linker>.. <assembly fullname="System.IO.Pipes.AccessControl" feature="System.Resources.UseSystemResourceKeys" featurevalue="true">.. System.Resources.UseSystemResourceKeys removes resource strings and instead uses the resource key as the exception message -->.. <resource name="FxResources.System.IO.Pipes.AccessControl.SR.resources" action="remove" />.. <type fullname="System.SR">..

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.Pipes.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	125072
Entropy (8bit):	6.650000502867434
Encrypted:	false
SSDEEP:	1536:IZEXgYsZNCHWcl3ZPJNnCMTB5NGWjxrfee3DQL+oGMyY6oFUwRfdc29ApVXVRans:IZEQfNApPvnCMl54ecClYz5dwp5raXc
MD5:	A662FEB76150089063F5A5A81B8C3C22
SHA1:	A6219C1B92D9BBAE6A8F6956C2AFDB8F40453309
SHA-256:	DC93371584A82D37F8A270784AE272321CD9D87A1C9AB0A34D435BC2F755E52E
SHA-512:	F34DE3F04B99354BFD4EB70A4CEED939E8D1044397E46EEA06E5DA5BB4F7841D1A2ADCE90CEEA327AD8EF8E0F8CA6BA3144F31ADE313B770281ADFB90FB86F10
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#............!..............................@.......................................@..................................................,...........(......0.......T...............................................................H............text............................... ..`.data...>...........................@....reloc..0...........................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.821132599456543
Encrypted:	false
SSDEEP:	384:UwZ+YCWp+WksBlHRN7b4j05seyR9z0VulqYV:UwZl/jb4j05sN9zANW
MD5:	AFF1A75D5A1505ABECFF22BD5A3F38A3
SHA1:	12474E0B7D3A4AC15D4F018C5309A04CBB0BA955
SHA-256:	4A8A63B556E15A5307748D4C98E77CA05A2F24E196C497EB8F50DD398FD09BC6
SHA-512:	52559A6DFB4CC4EB18C3F96946D1DA58777B222FF1762236F87B8B3FD02E502EE6FFC479348A816120E490C246B34E56D8B824C93BD8CD7B2D8C0F1E4B17C776
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............)... ........@.. ..............................._....`.................................\|)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................T.Cjy...J!...?.H5I.....1.`G.3._M^611o.)...77?`......E....xZ..r.!2s..............2..^...f....%....b\.....E$.....q.....BSJB............v4.0.30319......`.......#~..<.......#Strings....,.......#GUID...<.......#Blob......................3................................................,...........E...........p.......W.................^...+.^.....^...e.^.....^.....^.....^...L.^...Y.^.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.IO.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.672827922128272
Encrypted:	false
SSDEEP:	384:4bS83cYxWnbWBsBlHRN78rdGlD/LVNSR9zum:YSJHFj3xLVNe9z5
MD5:	F7C046D5B808F20BA108BF7FB81EC9D7
SHA1:	8185516D008A20C2AB8B7876822909D5DC9ABCC3
SHA-256:	9C2F4BF0B3C2D2A9C5928C9CA743AE7253CC9DA9A64FAFDC44D0C5D9FC97E07D
SHA-512:	B323C2F4F738FDD69CEE0C3E8F1F5D0DEF5C0919DF2C2CA5904F09152E5FC5B5190E3DBD0E3152FB35836D3A2351E0398A43C5BDE1C54A0FF36042C7C37A93FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8<..........."!..0.............~... ........@.. ....................................`.................................,..O....@..$................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................`*......H........ ......................P ........................................Z..py...$M.'......G-....@.$.b.&..M.%.".:..W7./..h..<....C7).. ...y.`FN\.......h.P.]".Y........{&.......-...O...U~...lp,BSJB............v4.0.30319......`.......#~......8...#Strings....,.......#GUID...<.......#Blob......................3............................................................=.....).....h.....k...........#...........8.............................Q.....S.........................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Expressions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3499664
Entropy (8bit):	6.8274449186145905
Encrypted:	false
SSDEEP:	49152:NlJ+SqQMuvF2Bg0oVBj/nRXA1UET0SEVp5ZWy+c/xE553P77zbr7jrgrNZmfDYZy:N3jC52rNZIcbRT0
MD5:	5856A0A58B72A9985E1D25F7DD305ED6
SHA1:	875DADBD27F5B2308D66A579BD305167933039B4
SHA-256:	A0FCDF64056F35CFFDEDAB91FD190BD84A20DACED9EB8664C34492A329578418
SHA-512:	78767193D5FF51F99597AC25574EBAB667B83E1FD3E8D14BCEB546B8E932E77C2B84B84A5DA1AEE71B0D03B8CDA08D37020BEE0C0FD000B31E954B0AF8CC3E6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!......-..(...............0-...@..........................`5.....f.6...@..........................................................>5..(....2..H...x..T...............................................................H............text.....-.......-................. ..`.data...7....0-.......-.............@....reloc...H....2..J....1.............@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...E.x.p.r.e.s.s.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Parallel.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	768656
Entropy (8bit):	6.895739583563281
Encrypted:	false
SSDEEP:	12288:HhTYbrWMCGZq0bzROPNPCjsrqx251jK6v06CB7WyWf1RWjjm37GHqsX9k8yRL1vV:qdzR6NPCjsrqx251K6v06C8yWf1RWjj8
MD5:	A5794B9808BE795AD4DF4C03E33837B3
SHA1:	D02EEA52D3DE636C73F5D515BFBD2C2040E283A7
SHA-256:	8E12D8053197028EA7224785716807679D6B534A8347030E0681E8E1B0C4E83F
SHA-512:	61ACE2CBAFBEB6E527151BB1C5287ADC8D5595F73DCE8690AD613234AECB28504DBE1ECE9B8575B0B17772D3C8E7561D7D4D682C9C74922DE86760DF47C11C34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.1............!..............................@.......................................@.....................................................HE.......(...0..$}..,...T...............................................................H............text............................... ..`.data...,........ ..................@....reloc..$}...0...~..................@..B............................................................0.......................p...(.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...d.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...P.a.r.a.l.l.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.Queryable.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213648
Entropy (8bit):	6.728551267647979
Encrypted:	false
SSDEEP:	6144:LHBms/ByOlN5tVBUJp4It1D+QaM/mbGZGtnHna:LByOlN5tVBUJp4It1D+Cmd6
MD5:	B4676FBF29B143C8A376DEF473B10E95
SHA1:	C638AAB3CCF34860914CBF59A0B17C16C1467156
SHA-256:	87FE9ECC303629244D5BB880902E936AE9E5F3D66BD30616F7E34E22B814DAEE
SHA-512:	C64D514D1A7EC8838AA40529739D6B738C84E74611E9065E50EDDE3786D1158E56BFD756A0E011AD3A22ECFF07E1D18DBFD8B3F781F5C029211569C9F75E3535
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I............!..............................@..........................0......4.....@.................................................,-...........(.......0..T...T...............................................................H............text...I........................... ..`.data....Y.......Z..................@....reloc...0.......0..................@..B............................................................0.......................p...(.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...d.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...Q.u.e.r.y.a.b.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Linq.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	482448
Entropy (8bit):	6.907030925129429
Encrypted:	false
SSDEEP:	12288:Vn9cWi7yagGxY5wRNYIKskRjYQxPKduTLhXJ:99cFyagt5wR6Ri8z
MD5:	EC2EE53533DE3D9F5D199AFF1C4D04EF
SHA1:	C54A75A33E7D868FCE5815B86BECDB2B0A79242D
SHA-256:	F67BD51735386848EFF1AE6858B14B734745D9B8987AFDE62D71F9275819BC2C
SHA-512:	178D270B98C80B73AF4BC99BF065B4E7A37100A800E646BC96CA8B75153A3C4C5657172389D7E255FF04A0BF9B2388FEB1FF40485253F3326136022F53A2CE68
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^.............!.....p........................@..........................P.......(....@.............................................0...Tf..x(...4...(.......>......T...........................................................0...H............text....n.......p.................. ..`.data................r..............@....reloc...>.......@..................@..B............................................................0....................... .....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........8.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...L.i.n.q...<.....F.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Memory.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166032
Entropy (8bit):	6.97489110425909
Encrypted:	false
SSDEEP:	3072:j9YOAoeG/Ayxswy6fM/2Nh/h/t/lUYrA8S1lfkldcwzGD:JYOn/Avuh/h9pU88ficw2
MD5:	CCEF1F9A0413B3567ADA54D79E5C7544
SHA1:	6A7DE5FF12A073085F6CF11563F7A748FD5BEF62
SHA-256:	51EE85D6FE9EC906BBD22BE03AEF842D68FADA00B351EDB368DD2A50A633561A
SHA-512:	B4AE11212BD75D85BF05C7A3FEF75CE46EA132BE7F4F8800C3D42C44CAAA380B7EEB636A02C58464495A61D669E66235AA9C59A33A78BC64D29440FB2B373B87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4..............!........4...............@....@................................._.....@.............................................@...<4.......`...(...`......p...T...........................................................@...H............text....)......................... ..`.data........@... ...,..............@....reloc.......`.......L..............@..B............................................................0.......................0.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........H.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...$.....0.0.0.0.0.4.b.0...4.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...M.e.m.o.r.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...D.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...M.e.m.o.r.y...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74384
Entropy (8bit):	6.711143530144894
Encrypted:	false
SSDEEP:	1536:LXYG70OUGBnS0mC5G1KD9lK0UB5YjbwMHUfiCRjqnXzum:LXBPUOAPYK0k5YjbwC5XH
MD5:	D3624556A877FC4D0158284FF3A5D852
SHA1:	63B95BCABA1DB399CDCA4BD5B6CBB397A6C240C9
SHA-256:	AFDF82CE005E7CD1BE3717A1443CE93A8AF123737DF792D56CD894BEB5F509B1
SHA-512:	BBEE6077C54A0FD28753C1978B14700FA857DF2CA3E0AD49DC7D479D3BB378B65A53DC35354A76E8F02549124468A247C4F2C36100AB06DFA288B54323430462
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.r............!.........$....................@.......................... ......hi....@..................................................#...........(..............T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....D...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .e.x.t.e.n.s.i.o.n. .m.e.t.h.o.d.s. .f.o.r. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.l.i.e.n.t. .a.n.d. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.o.n.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Http.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1628304
Entropy (8bit):	6.83814796606989
Encrypted:	false
SSDEEP:	49152:RL0RyMgaHQ5gXI7MJgPeDJq4aT9klzB9sb/Vh/s0iJt6OJtgiyJKXJ96POMFw:JN0kKXL6Ptq
MD5:	BFFE3CED10E0AC0B7683C06638C53B55
SHA1:	4B7647C5A1C1FF034BEDC0038DA762EC4B244049
SHA-256:	588300C52A21CDB2CC162A52C692FF4C56C4D4C4509D32F8726970DB16E378C9
SHA-512:	149BD75806CF41B63D0BC5669E9AF03FD209A245949EE25ACC40D84399071682FB333D8FAC1F55834F66AF8EE0692C4ED291298E991D6073943554C7B77DE4EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rm............!.....N...`...............`....@.................................kY....@.....................................................`.......(..........0u..T...............................................................H............text....M.......N.................. ..`.data....\|...`...~...P..............@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.HttpListener.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	573072
Entropy (8bit):	6.800072917455529
Encrypted:	false
SSDEEP:	12288:v/aeO2gk8H08EWo8vwT2zPflzY1ZNdR9XhwnDuxRa8t:v2xk8U8ERYlBe
MD5:	EEF37919FA2089D391C77785B0DE9F6A
SHA1:	2AA58F552EBAC828D5343518BB1EE6873216B0C8
SHA-256:	A9CAE622F5D1F20CAEF16CE6FD6193106A6615CA9571B9B7DCBEE0C636211FAE
SHA-512:	6C26E19A1D31EC591DE3FF3044F1796D640BE4CFFDF71D4EB972BC29BA1F232C1ECA469ED6DE11E7227BEA29E6D6706A57FF394736AFCE598F10C4B77A90D69F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..............................@.................................#o....@.............................................(...4... !.......(...`..0R...3..T...........................................................(...H............text............................... ..`.data....y.......z..................@....reloc..0R...`...T...B..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........0.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Mail.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	494736
Entropy (8bit):	6.837665138222711
Encrypted:	false
SSDEEP:	12288:jk4+MVI+HqBo/WU37bH52xUG7ZFB2euBE7PxdyU:jg+IlPV342ryU
MD5:	56EECB76A853982A824B793E5CA760A3
SHA1:	1779BED84A12DAFF1A2CE15D2183924FE2B30189
SHA-256:	5F18C1BD7407F408E21432DB1FF87B7E6D94F0FE595B8C8DE54AE13BD9211C96
SHA-512:	586A3F0F1E5649FA091EAA6C1486D736606D4B7CED54C0571A942DDE3DBDC83C21E642B9B7F9D5177D274589F1FEA8E07901C066D1C85E6C586F4565B091B4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a{~............!..............................@.......................................@....................................................H&...d...(...0...K..42..T...............................................................H............text...<........................... ..`.data....[.......\..................@....reloc...K...0...L..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.NameResolution.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93840
Entropy (8bit):	6.746350410223494
Encrypted:	false
SSDEEP:	1536:0jpUyx8K1mmdrhCy3n56C4D6jKlpGU0elC50BLxR2vVonqu3gXn193TsO77zu8:09Uw8K1mmdtf3567DUKlV0elC2fAVyqF
MD5:	9888EF572F07841EFD7887C1F856187A
SHA1:	F914AD924423CEC7329E3799CBB59E40B280619A
SHA-256:	AC8F9C6C22953F9A9EFCEAAF95DBCAFEE6C0CECC0818B608CF84F9C60232383C
SHA-512:	54948553E96F4E72E82584B62A299E83C8DE151099D57DC09C0E5526BC4A52702DEC38AE0D8D53EB951E041A3DAC9A8D13DB92F871E73D28460AC9632999898B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P.............!.........*...............0....@..........................`......~.....@.............................................4....'.......F...(...P......8...T...........................................................4...H............text............................... ..`.data........0......................@....reloc.......P.......8..............@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.NetworkInformation.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138384
Entropy (8bit):	6.692315415920491
Encrypted:	false
SSDEEP:	3072:Gwp0KDvLBlDjOs5ysFQ46qPZLVXQ2VfwynbIeyhuuPFlNo:VFvlhJFQ46WrnkNPq
MD5:	316DA250D2A825F0673F4170A01AB5AF
SHA1:	3A116EFB8254E45C99A688AD0B40A128288CCD6B
SHA-256:	B173D3CCAEA54ABDEBA110EC502EC8C5DB0E57E2AEE184131E47D94582638BB1
SHA-512:	AC16048995451EE453B79ABACCB0C88D2CC7ACDCB564099DBF7CC59BDBA52A197C7EFEE6FB6D37188DF1AFB4281696FFF57EEF4F9669AEDBF1B56D3A422373FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2u............!.........0....................@.......................... ......x.....@.............................................L.......@........(.......... ...T...........................................................L...H............text...d........................... ..`.data.... ......."..................@....reloc..............................@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Ping.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71824
Entropy (8bit):	6.726118190367309
Encrypted:	false
SSDEEP:	1536:4FmlHfrX/SSa3UdNkMj4m59qGGrr9GIgf9zuE:44lHfrP83w489qx/ZS99
MD5:	4750A29FE9260274437FE749D965F5D4
SHA1:	CA392A8EA6C0C8482CD8B411622303886983CFB7
SHA-256:	80E7163AE1A77C153F98B7491996BA746857DC05B1C37C3DF81706B298FAA78D
SHA-512:	1190D1F3901C51B5B3EAC260CE0D1E48CE38F4E3E03B791DD0CC16775CF18310B265962B4CABD6FE5FF11289F3790A092E2AD435EE5215A34E3DE2EB56792F6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..............................@.......................... ......ul....@.................................................."..0........(......\...0...T...............................................................H............text............................... ..`.data...;...........................@....reloc..\...........................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196752
Entropy (8bit):	6.854366555853586
Encrypted:	false
SSDEEP:	3072:zRQM0EDOup7veTvi8sh8/0HfpfzbLhb8uGF1DNeX7T1sWkN6OlEFo4BWm1d2usso:VQM0EDJzqvxwyF1pU+CjwWgbb
MD5:	3BC9AFBA2B2AFA7C258BA32C495EF014
SHA1:	1D551333E38B3386A9EFD770538EE9BA6FB6656A
SHA-256:	79205A458BE28889755EFE5C3E95D27F80CE722281286567739D36CAB60D46B3
SHA-512:	8DFA95B8568AE51B44EFBDDB97BF811CE298991FF04E34522F9DF5AFE7225286495CB1C1D13891B9D95116F06CFAFBEFB3A3C1F310C099A65B2789528BC59E04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...GX.............!.........D....................@.......................................@.................................................,?...........(...........!..T...............................................................H............text............................... ..`.data...S'.......(..................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........$.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Quic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	263312
Entropy (8bit):	6.761511567140867
Encrypted:	false
SSDEEP:	6144:OUC/uvLcLDWRmpoKYWIh++Z1Sz7lPMf72c9w1x99:OUC/uDcLDWQpoKwfClkCc9M
MD5:	8C19950A66F57EA16A7DB52FAF2686F2
SHA1:	6913C4BED5D0EC8DEF1613583B5637CE55CD7EC6
SHA-256:	F36CCC2A13F5B7B48C7CA629B26F4D2833FBE87DBC638085996765936F1DC521
SHA-512:	E9241960687A8FC579ADE183D6AC27F92DF815E2BFD8612EE71A6D222D8C7418E9CC512D962C8587708E98DD32D29D6723D7BBBCBA0626484159730838B50547
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...WB_............!.....h...r....................@..................................I....@................................................. L..`........(.......$..(&..T...............................................................H............text...+g.......h.................. ..`.data....L.......N...j..............@....reloc...$.......$..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Requests.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315024
Entropy (8bit):	6.706389756574641
Encrypted:	false
SSDEEP:	6144:K1wQ4XwcX1R4LPLAbEsgiErUq/DpRrV5FZRLv:jQiwcX8nAbEniEN/Rr
MD5:	65169743B815676D2FAA1F47574D8152
SHA1:	AA2C3605E3EEA9E18FE9EE83DAC0E50A7D533136
SHA-256:	38E77CAD3B7740B688250BC48E724D19251E99117AD84C32B5C3E1E4C82A48E9
SHA-512:	432D97BF5FA617F4D93121B0024C830647DA515ADF1649DA40C100204FFE5CE4601566DDE711B8547BDA05591EBA3405446655CB6BABD1FA5DCA2A0CAFDBD2AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*u.............!..... ...................0....@.................................R.....@..................................................V...........(......82...+..T...............................................................H............text............ .................. ..`.data...=N...0...P..."..............@....reloc..82.......4...r..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Security.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	613520
Entropy (8bit):	6.945942080687897
Encrypted:	false
SSDEEP:	12288:LY2/cVNSGxKDpOV4bkbbr0SIPbXetQG9L0049lytIxxOFaPf:leyDkbrqTX+l9G/ymEy
MD5:	F265DB4FA27D54EDC769A9023DD5C195
SHA1:	F13CCCF0C13C95DE5FE4FE1DC308110A4D6CF4C3
SHA-256:	F1BB1BB6F6237968347C2D3179FB3966B29BDCA1D0E228C47576B18E8DDF5596
SHA-512:	DAB6E1E547F479A05974A0E24496D61D2696535A0996B686E65CB98471B473C60AC9D3BDACDB9A5723AF99EB77DFA121992AEC37AC153FD430678C397123B092
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;............!.....T...................p....@..........................`......H.....@......................................................"...4...(.......P...-..T...............................................................H............text....S.......T.................. ..`.data...S....p.......V..............@....reloc...P.......R..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.ServicePoint.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34960
Entropy (8bit):	6.59451622386637
Encrypted:	false
SSDEEP:	384:yWxFW1h4BI03dWRojm0it/x4KnC6qYFSlxgdg3a2myQJNa9RCvTfNCzrMsBlHRNk:VEh4CAMRym0HA2wgghlCPjk3l9zu4
MD5:	447FC48478BAAB8D8B4361ECB560C857
SHA1:	220315557D72988E2AB48009238BCC0DB22106E5
SHA-256:	54E2B97D9BBDF7C3300226A8E930A19FDD82A16F06BCB992ED04B7A05ACCB57F
SHA-512:	BD39A654ACF60D12D7723D72CF93D6CA646F4CA6E4CACAB52D3A33748614F3130B7A1A5ECCD9B9D8D8F52693F0E9FA84E407EC4B493A8549A87739CDF8F85211
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..............!.....T...................p....@..................................h....@.....................................................(....`...(......X...<...T...............................................................H............text....R.......T.................. ..`.data........p.......V..............@....reloc..X............\..............@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.r.v.i.c.e.P.o.i.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.Sockets.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	458384
Entropy (8bit):	6.842199088936072
Encrypted:	false
SSDEEP:	6144:+zOW/YStqrmkdhetBAPRFE21wddOZTiL1InyIOBmzg7w1opuh0oSSLci5bJWv:LQsmkNnwddO5iinkMoub/6
MD5:	E1C3D1D777FFDF55E66BCD877027DE46
SHA1:	9D8195D082D0E10AB8E915FBD2FABF18E778DE5C
SHA-256:	D6523C47166E39A2AB9FE5804544AC6E1A2A9182FB423F8936079EE40A87F566
SHA-512:	342806A7A8E1BA91A40EE73C566AFD4466340A91625784AF919A3B0DEFE2287774DA5DA5DF951C23FB7FDBC621F9C93BA6716F8B41D076AF96EB03F72CD5B03C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.E............!.....4...................P....@.......................................@..................................................\|...........(.......D..p4..T...............................................................H............text....2.......4.................. ..`.data....X...P...Z...6..............@....reloc...D.......F..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebClient.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	146576
Entropy (8bit):	6.767289725013669
Encrypted:	false
SSDEEP:	3072:pUZmtVXD4NqulupVY3qwJhliX3wrV1+Bb5kf9X47d:yYVXk8ulQkObE9I7d
MD5:	9ED7E2B2DF0F929B49E865B8F0D41F23
SHA1:	FFA7700F42533F1D6292732166E4995F6B2DCCA8
SHA-256:	EAD6321AF9D20AF698613A2FE2E4DF47AA893DF6D30754CEB5F76D4FAD037879
SHA-512:	25204933CAF9FDDFEDD23ABB441E0021851FBBB2016A684B18C5448F3F34F0786934B4CF2DFB37717480C11984C13161DD5C151DEA5494CCC22F59A8618F0966
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!.........@....................@..........................@.......l....@................................................../...........(... ......@...T...............................................................H............text...R........................... ..`.data...i*.......,..................@....reloc....... ......................@..B............................................................0.......................p...(.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...d.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58512
Entropy (8bit):	6.650236817776532
Encrypted:	false
SSDEEP:	768:D4Q15nfRiuFhWa9fNXKOKD+evg9V7vZEFEb51RlGxGjEYB3l9zuz:D55nfRTsAbEFEhlTESHzuz
MD5:	55B1E33EC1B199BA7C8CED2D0146BC41
SHA1:	165C1E10B51C217DA1968CDFA7F5DA9729886932
SHA-256:	3601706EFAF9585E203EAC4E47B4FD0DDB40F95B04154111D1D855BB0B2C87F3
SHA-512:	2AD1B4B7801D50779CA9BE8AEC5B51F96C5C4959FE9E94DA30459DD8BA57AFFF21588035FABB663F761B3A8C48BDE4A3430ACB7E7EE8EE69EF62251AD9F327A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..............................@.................................l.....@.................................................. ...........(..............T...............................................................H............text.............................. ..`.data...............................@....reloc..............................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.H.e.a.d.e.r.C.o.l.l.e.c.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebProxy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30352
Entropy (8bit):	6.648920711446527
Encrypted:	false
SSDEEP:	384:k3WdwWLnNj4OEwsR+SycZN/q42zVGt1pWKlL/95b1ZWqTWO4sBlHRN7Auhy50ZS7:kqtNyiI/qs1MhqHzjAuk50Zi9zuCZfL
MD5:	E72BCC64C353F4238A39911D5582B9D6
SHA1:	D7E914D70FEDC0C3C84019A438846C1D565CC087
SHA-256:	6ECB1752AE17F4DC1BEFEA9C5F268046575B1838E3C99CC39DCDCE3AA8D04808
SHA-512:	E38F8CB33E38F530C9C4B27B5CFB4441461DDE42134422AC17DE8414C7C3D310D6966BABA02B23DF9D8EEC33492B3742EBBFCE25B331B1C4262E4C0774EE8B52
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K.............!.....B...................`....@.......................................@.............................................p.......0....N...(...p......p...T...........................................................p...H............text..."@.......B.................. ..`.data........`.......D..............@....reloc.......p.......J..............@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70288
Entropy (8bit):	6.605078025486799
Encrypted:	false
SSDEEP:	1536:EjgDMIHHUyD2GOm2gfFa3s6lcKRaQ9eYwMfaAf9Xzua:EjinwGO4fFa3/lcKRaU7f9X/
MD5:	D0024EF969EC9F591E617FCFA6E8DC59
SHA1:	2D801801433416DD5DA0E6DB14C12CC648826780
SHA-256:	692588D2AE05EB83502C94E1FF526042FE47266AE59E383814256A425D472945
SHA-512:	D4EDEBA7B2B0A53089D97D8A6A4EBEA47E484E5C18F1384A4A4E7E0E7D1CE2907238AC98F110E28425DF218F0BD5AD5B38232759D53D958D347F3A147D5346CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Xf............!......... ....................@.......................................@..................................................!...........(..............T...............................................................H............text............................... ..`.data...Y...........................@....reloc..............................@..B............................................................0...........................h.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.WebSockets.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	163984
Entropy (8bit):	6.76725398979543
Encrypted:	false
SSDEEP:	3072:w+KtEW/GWPmyZMPrepROMMmB9bmCYZbQLmvhlst/o7X2j3RhEtmeJXX8:YtGWPp6rijP9bLmvhyt4KRhEjM
MD5:	372A0459CA05CA71F854E5780716DF53
SHA1:	8A532191955794FF4F601CCD462AA40F63F8FE15
SHA-256:	0E05FCA3A1B64F52568226A00D5FDC54B70A01B3B5F66F071FDB0B883E1FF91A
SHA-512:	329B2B32DBBF42B13071350E4B4F16C0140A7410B27C7768838AC320C4F6715DCFA903BACE23DE4B247EB240A4D49234622401EA918ACFA6AA0ABB69337A87D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Sh............!.........<...............0....@......................................@.................................................@7.......X...(...`..$...<...T...............................................................H............text...Z........................... ..`.data....'...0...(..................@....reloc..$....`.......D..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........$.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18048
Entropy (8bit):	6.567318488999292
Encrypted:	false
SSDEEP:	384:BQ6EWw130N8VW8VaWpsBlHRN7IK3zVOY/wR9zQFYB:BQ6Er130Y2jIK//M9zf
MD5:	759C92A30F2A464B524482417C19B518
SHA1:	8171768DAB0F10E260B5C80E6D7BA99920E9CDF6
SHA-256:	64243C6329D05F8E070FCB110A3E46CB60B875ACE4ACEE7B4D05B565E4AB54D0
SHA-512:	41278DCE9AA8CCF50E61826753F123FBCD97B61F877DCA2485BA4506004CD13F3B5EDF915DC96F7590EE196ADE484F673173D63F79A730AD6E41130737DB00D1
Malicious:	false
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Net.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P"............" ..0..............2... ...@....... ..............................[.....`.................................92..O....@..4................(...`......l1..T............................................ ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B................m2......H.......P .......................0......................................BSJB............v4.0.30319......l...X...#~..........#Strings....D.......#US.H.......#GUID...X...D...#Blob............T.........3....................................6.................l...\|.l.....Y...............M.......m.....m...c.m.....m.....m.....m...'.m.....m.....m...^.............n...5.l.................S.....S.....S...).S...1.S...9.S...A.S...I.S...Q.S...Y.S...a.S...i.S...q.S...y.S.....S. ...S.....S...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Numerics.Vectors.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.686854481677489
Encrypted:	false
SSDEEP:	192:4iTpiVxx9PWBBW6Wo0A2j9seHnhWgN7akWVSiMks9gICQX01k9z3AFMWYh:40GjPWBBWwsBlHRN7CS/P/R9zVXh
MD5:	25FB4BAF06C9D7A9840F01DBDCDE5E0E
SHA1:	E05F06D7F82026A6835DE61B70549C848B988D69
SHA-256:	2D5AC8782B10A017E4803CA334F27BAA686807999563E076EA3499C81992E127
SHA-512:	7833DE71A49EAABC40C48D9BDBEE68C65EF5D97DFCB37D5F3A177185839B44D31F765F111D2CEDCC5B5E53826E3087B7B2233CD857635851D234FD5C23FD4220
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r!..........."!..0.............>... ........@.. ...............................f....`..................................)..K....@...................(...`......@)..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ ......H........ ..p...................P ......................................fo.M+.F.Pz9..:_\h.}..g.fP- ...e.Jy.......4..s...\].\|..0..=....B....8.I..;..7.S..'v..noe....KlRT..ku.Q..'.N4..%JE..K.F.IuBSJB............v4.0.30319......`...<...#~..........#Strings............#GUID...........#Blob......................3......................................D.........]...........v...................`...8.....0.......r...\.r.....r.....r.....r.....r.....r...}.r.....r...........6.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Numerics.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16016
Entropy (8bit):	6.686757767460252
Encrypted:	false
SSDEEP:	192:cDCs1SWZNWBWo0A2j9seHnhWgN7a1WgwacSuF552v++X01k9z3Azse4sFgj:cD9wWZNWvsBlHRN7ArNk5+R9zuseDij
MD5:	E16003B73B98C318FA64FC7E53E72F3A
SHA1:	D7553354F5774D4FB1C0EEC2F29B205DD64F46C2
SHA-256:	AC19D8042380EF0942B57E9D252E357C1C07BD2C6487CA39C5960268BDF5F3DA
SHA-512:	E4B7BFDCF0F8BBE79AE0D550E2B81CC34F6E7A0DCCB32566E3EF4D1FA80F2D6A22F3FC9BEC0A82682B1F13401C31B13F0D8FECF8DBAA80137105255CA32D973C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E............" ..0................. ...@....... ..............................B#....`....................................O....@..T................(...`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................8)......................................BSJB............v4.0.30319......l...\|...#~......@...#Strings....(.......#US.,.......#GUID...<.......#Blob............T.........3..........................................0.........]...............................D...?.e...K.e.....e.....e...".e.....e.....e...}.e.....e...V...........e.............-...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ObjectModel.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84624
Entropy (8bit):	6.652384374233908
Encrypted:	false
SSDEEP:	1536:bzwLCImdP8ebSRBdDvWiOWCHfborf9XzuIwu:bzwLCImd4DvWP1bKf9XCu
MD5:	79C20C350BE617E5F9EB4CEC9E96F999
SHA1:	230411806BB5B669BF7B43CCA8F0DC695A262FE1
SHA-256:	ADCAA9C0C7A4FEE2437D1C8111B98BB609CC5B1BF06A80764F2BAA6D7B329A08
SHA-512:	69B45A8E691B72DA1A11D3318B71CEA7D3A24D9D1EBB79277F34C6B85E41D2FC2B98F0C1796D5AD4F650E3784297F74095E355705928E58F4D959FBEF04BA8A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P8]............!......................... ....@..........................P............@.............................................p...h!......."...(...@..........T...........................................................p...H............text............................... ..`.data........ ......................@....reloc.......@......................@..B............................................................0.......................`.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........x.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...T.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...O.b.j.e.c.t.M.o.d.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...O.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.CoreLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9994384
Entropy (8bit):	6.912783117178856
Encrypted:	false
SSDEEP:	196608:f7tsHNod/HXHIsqxgR08IdXr1qQb9W/UCF2esAT:f7tiYQb9sUISAT
MD5:	964045A4D33BE841A7D873360145107E
SHA1:	79A39B73DFC7106FA4E0267218D199978156FE13
SHA-256:	E83B1047BB8B3BC3563EB90C68C8D3FF7D7544CE5BFE741634DD4C181F4D09A7
SHA-512:	7673DE510AA9A53E0B02640FE5A92AE15D6C42DFB84712BE68A5B6367E763125842FD73513FC8EC9A7DAD326BBDA9D9DAD01E856431BD3EDC0696B3B6B18A7FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\1.............!.....v........................@.....................................@.....................................................H....X...(...0...H..@...T...............................................................H............text....t.......v.................. ..`.data................x..............@....reloc...H...0...J..................@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...C.o.r.e.L.i.b.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.DataContractSerialization.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1914512
Entropy (8bit):	6.827934338637352
Encrypted:	false
SSDEEP:	49152:/R5La602a8IkVF0hIH0IDGaDWSSz/w9ODPPLv2DLU3Cs7V:2eFU/JD7V
MD5:	B8CF7C67D6ACDE418D5EFDA7ABA90579
SHA1:	DA48010C7F4C64567690736FEDC0993B04A79178
SHA-256:	E4CFDEB1CE5BCF99FD8EAA387383218835C6111E9690257468A880A0027FA572
SHA-512:	54BEA083657D74DD15C1A3C8AE3A2CCE34569827688166338460C1A6CD5FE6BFE06BEEF53CE31788639DD998268F46312A4A681D95341CB7D59FE6D09525F873
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........H....................@..........................0......gZ....@.............................................D...0...........(.......&.....p...........................................................D...H............text...f........................... ..`.data............ ..................@....reloc...&.......(..................@..B............................................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0...j.)...C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...D.a.t.a.C.o.n.t.r.a.c.t.S.e.r.i.a.l.i.z.a.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...z.)...F.i.l.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Uri.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	247440
Entropy (8bit):	6.954312660378064
Encrypted:	false
SSDEEP:	3072:Dssc08RBa9AMHnRM+jkF3sM/7MpdYs7BUy40gRpPKfvXTp9LPFYD3KTZdinjuDok:ILZMHR9pdYr0kCXTp9Ldw3Kenj+U13A
MD5:	0D151639289DE01CFDD9710F1CC8D39D
SHA1:	70C81773DF720CE5EFE394FE297C1E9DEA1F3019
SHA-256:	8CE127BCA344DD768B850743B04BB669877D3E1E26A582B494BC7F1C4B6D0241
SHA-512:	6CD3A1DE0DD1BF23A4A607A6432D70900D23AC7546709116BFD73C9EDF9054637A69A68332903100D0FD6BD26DE3B60AC386673C3579916FF0D9511D4A3EEF5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.............!.....j...2....................@.................................1.....@.............................................4....L...........(..........(...T...........................................................4...H............text....h.......j.................. ..`.data................l..............@....reloc..............................@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Xml.Linq.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	368792
Entropy (8bit):	6.80561055696192
Encrypted:	false
SSDEEP:	6144:wwrmJcDcRPg2ivqYcrOME+QUT/2Ryh5rux7FK5BpItcHdofLebbJn6puipaxU:BrmJcD6PZFYcrOy/2RyPCo6cHmfL0bJs
MD5:	CBDD8E0EEDF14102D342061AC90AA5B8
SHA1:	94CAC872A4B42604EB87637598EFEEE0BE3D9D32
SHA-256:	6F282434250C4F602B62B0FC22AE9DA989413C597AC85B5BD93643F5FA8FFE66
SHA-512:	74AB6C8F7913C96290807A1A19F622EAC3CB9A7B0D5A3FD4173F698E0439FED4C19FC0E500831119EDBB292DAC6950F1B2EACD32350D0435AE4EB431FFA54845
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-NL............!..............................@.................................f.....@..................................................m.......x...(...`...4..,+..T...............................................................H............text............................... ..`.data..."J.......L..................@....reloc...4...`...6...B..............@..B............................................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Private.Xml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7861400
Entropy (8bit):	6.900882619572266
Encrypted:	false
SSDEEP:	98304:RTThhoNU7Gd0ff2MO0s803m0ZBg1XDR22b6h1rnj:9ThhoNkGd0ff2MOh803ZBg1XDR7Ghhj
MD5:	EDE933588FE576146DED0E5BD0411F94
SHA1:	A39777CCE8FD4A1892D5F14CCC9C029952B55025
SHA-256:	A3855B3808C25E824C1DF89E7E4AA9FE3A8E40D860D84BEAD5FF43AE096CAA58
SHA-512:	9E43DE3CA02330E010EDB49AAE30D3AA6C46C8C4AB93E9380831584E7A605CCFBCBAFAD408F960B796926FB97F6153E33B7C111E60CBACDE9033AD7AED8170A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....4o..................Po...@...........................w.....#.x...@.............................................4...tv........w..(...@s........T...........................................................4...H............text....3o......4o................. ..`.data........Po......6o.............@....reloc......@s......$s.............@..B............................................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.DispatchProxy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62104
Entropy (8bit):	6.764601126664897
Encrypted:	false
SSDEEP:	1536:AMEKBIE5BcYjHxxLeWhsFcu5BixUxbcXotGX4gpz/:AMEcIIBc4HbElBix1XiGIk7
MD5:	A5FB967997B962C6B82FAB705CEDD942
SHA1:	8AF0ED6BD936B0435A1F9559DDE36CCEC7571CD8
SHA-256:	06577782ED538F22A265BFBCA9E540195E50DD4394B95807FDB0B30C53E9C16A
SHA-512:	E7A07DF4809552CED94D69F4D7E84F8D8543956056ADE5D4337EBFE651510CFB442845C37675BA42ABD5ECEB574523079F0CAEC9D3059A6717F30FD83F23C1CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.@............!..............................@..................................g....@.....................................................0........(..............T...............................................................H............text............................... ..`.data...Q...........................@....reloc..............................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...D.i.s.p.a.t.c.h.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.ILGeneration.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.720341996290238
Encrypted:	false
SSDEEP:	192:bkIW1xxSCW9UWSWo0A2j9seHnhWgN7akWT8Nks9gICQX01k9z3AFMa/m0U/:gv/ICW9UWYsBlHRN7D/P/R9zVa/Ha
MD5:	594DA2857733B3F4DDECFEA4B6681185
SHA1:	2A7CDEF2A75966835CAF2F9A3B76314D600767F7
SHA-256:	1A396A1B6EB80629E57D1AAE08F4336EA52401166DF7D7A748B4E50E242F5AFC
SHA-512:	60A4BDC61A4F62B18F36D20DFF9B39B530F06B62CFFF251DA5552B5EE61C95A15C0CD4597269ACB630829801F6ECFA834DF63C541F4255A63B9CB721DD2105BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-............"!..0.............n... ........@.. ..............................g.....`....................................W....@...................(...`......L)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P*......H........ ..\|...................P .........................................0.h...&..x..O.kA....y.&....j.8.......S....&...gBd....T.8...,].f...7=...Oi....TWCTJ8....e&a.!...i....\|E4..Ja.WQH.<.A..f.rBSJB............v4.0.30319......`.......#~..t...D...#Strings............#GUID...........#Blob......................3................................................"...........;...........f.......7.................b...!.b.....b...[.b.....b.....b.....b...B.b...O.b...v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.Lightweight.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.695032418513088
Encrypted:	false
SSDEEP:	192:9eqSxxdrOWmVJWwWo0A2j9seHnhWgN7akW3soeCks9gICQX01k9z3AFMpz:9ezjrOWmVJW2sBlHRN7toP/P/R9zVpz
MD5:	241D23BAFBB61CDDA94055683B4F78B0
SHA1:	4608C5E4294A13107C32C037832B760893CCC9ED
SHA-256:	D88C48AB704FF37D9E2A835EE5D1F8F82C1CE83120B08DD7FF83176F855541BC
SHA-512:	153C483BE851FD45F9CC0B72310D8ED5A926FB7880013F60315C0A6B34359EE0DC05A32266457D6D7A35CBCFA674B5823DA216D22E3F5BA3868C79478C38B36F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............)... ........@.. ....................................`..................................)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ........................................J..~.".Y.F.j../.Y...T..Op.f.r...G#Q.a.A......6$...]...a3.cG6.t..]+7A...,...(f!{9......4..^5$....%....gU.UkQ..d..I...T.^`NBSJB............v4.0.30319......`.......#~..H.......#Strings....P.......#GUID...`.......#Blob......................3................................................2...........K.m.........v.......@.................G...1.G.....G...k.G.....G.....G.....G...R.G..._.G.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Emit.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.711439081915893
Encrypted:	false
SSDEEP:	384:imx5u88LLW6DRW+sBlHRN7z6j05seyR9z0VuEo:buHgjz6j05sN9zAXo
MD5:	FCE182E10FACAC0F1DB93DB73C71F7BA
SHA1:	D51EA6E428B512ED38DB68C670132EF803CE1BDF
SHA-256:	573EC24E5F5098541409C6F29A354B84B62FDBE4E0EF1ADA6881C40BFC5FAD51
SHA-512:	9B6FFAF90FCC1056E48AEBE5F0CEDC822ECBABD5FEF1AFF4874D86BB818AE3B1185E3820AAFC51C215FC9BB56365FBAB6DCB95E4809CC8C1E5F23368F2A715CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a............."!..0................. ........@.. ....................................`.................................`..K....@...................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................wVI..\...!I.<.A#...Ka...m)....B.Wr....Q..;.F..(Q.....h.M...H~EH.../g''.{..\'...5..\.+/.V...\|....3.~r....#...'..f..B%n2K..5pBSJB............v4.0.30319......`...X...#~......p...#Strings....(.......#GUID...8.......#Blob......................3................................................"...........;.....2.....f.......$.................+...!.+.....+...[.+.....+.....+.....+...B.+...O.+...v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15504
Entropy (8bit):	6.790214328189543
Encrypted:	false
SSDEEP:	384:OmJFWcWW5UsBlHRN73fRe99R9zusTzrNmG:xbRj3fY9/9zuE4G
MD5:	99A85AEF38B7E8FC91806732AD1CBC44
SHA1:	6B88A11D3D6D7F3030A6E416B43BA2A70CD1A398
SHA-256:	B601BBBA62E958E3C825AD524D50757051EA52664B3A8635C479D11BA4C7CBE1
SHA-512:	A8D971586A5D9FA443C7FF63F7C5742F1DBFD4CFF3FB5C87D9766BF996BB7D1D31C40176DE1798F11D3956DAC8F85097CD33F90D58739125C75094B2FF8527A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t..........."!..0.............n)... ........@.. ..............................:^....`..................................)..O....@...................(...`......`(..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........ ......................P .......................................N....[.\@...F..._*.....ab..a..Xb......~F].....4'q.)......#Q~.:..`..rL...,.d..v..Q..6...UE.cO...&.{Vh...OP..lA.. ./.Up.fBSJB............v4.0.30319......`.......#~..0.......#Strings............#GUID...........#Blob......................3..................................................,.....,...3.....L.....^.....a.................w.................w.................G.....I.,.......................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Metadata.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1073304
Entropy (8bit):	6.811127533544393
Encrypted:	false
SSDEEP:	24576:ELxjd5mHl336BG2vjkf8tpO/edd4N3k1e1:Ehd5kl336BG2vjkf813CH
MD5:	4C81901F525F633CA9936F7F54B35E31
SHA1:	67C1F1EA3C171B5D849B4DA8CFD5557DFD20A5B6
SHA-256:	0DD27A4A6BA1C462E9A80A833DCC7EE12F80FBA518167CBA0B4A0FB6019607BB
SHA-512:	59195A925A7C18930B97E10EF6A0432150DFB2E4892BE673472F6D41132405271297773D77CE18488BE642ECF4358C753D5B0694D4DC0F4E95DFFA7F353CB64B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.............!.....0...................@....@..........................P......u.....@.............................................d........i...8...(.......d...W..T...........................................................d...H............text............0.................. ..`.data........@.......2..............@....reloc...d.......f..................@..B............................................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e.s. .p.r.o.v.i.d.e.s. .a. .l.o.w.-.l.e.v.e.l. ...N.E.T. .(.E.C.M.A.-.3.3.5.). .m.e.t.a.d.a.t.a. .r.e.a.d.e.r. .a.n.d. .w.r.i.t.e.r... .I.t.'.s. .g.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.7511811119725165
Encrypted:	false
SSDEEP:	384:UnsWtWM+WasBlHRN7FEcTN4tgR9zJNErbE+:UsCJjFEcTNx9zIbE+
MD5:	D9057336A167994F0A83AE2B3C00A599
SHA1:	C6731F6426F0C9DA828B6E59EF74471ED2EB25C8
SHA-256:	51300D31B27135469FD3F8F910EAA40D63A74CAC41882C25D5A0C238BDC85763
SHA-512:	A2272774DCA20C166DE678BC975F404C762799464BC3B6C837EBB9E6C7C14791AAB2B662636213080E9C0DF10F77B8CB3C3A99E1852E858DD64F6C2667572F03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!............."!..0.............^+... ........@.. ..............................{.....`..................................+..K....@...................(...`......T..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@+......H........ ......................P ......................................F.s&0...........]Ar!...E.n,w..I.i......R..B.'.:...k{....B.K......._A.....+.Z:&...L........P'.s.=.....;.._......J.~UJBSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................3.........@...........Y...................`.................g...?.g.....g...y.g.....g.....g.....g...`.g...m.g.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.TypeExtensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32408
Entropy (8bit):	6.46117837744564
Encrypted:	false
SSDEEP:	384:TWQeW9IjpYcTiyyRtNLWrdzy+A2AcytP5I1vlsBlHRN7j7/P/R9zVuD:P9kKcTV2t5Wc+bAXtwvWjvPZ9zk
MD5:	DE0A3533ED6F21D64FFEE66FD347C420
SHA1:	AB7DFD332C08B340076F2E861E79B2B6CED778FA
SHA-256:	699D37D175C0A5C214F791DAFD6E56CF66047260F07CAACE9A76941FB7395DEF
SHA-512:	FB50E56FC0D7AAEB05FB85505880B4AA6BA8AAC532AC5B75BAC5F9F28E7DBBC5F92A73F69778428975E44F26C5F6E5E5CEA928FD9975D8F725745FF787B6426E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.*............!.....J...................`....@..................................8....@..........................................................V...(...p......\|...T...............................................................H............text....H.......J.................. ..`.data..._....`.......L..............@....reloc.......p.......R..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...T.y.p.e.E.x.t.e.n.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Reflection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.707447688781763
Encrypted:	false
SSDEEP:	192:MegMZK+ExxYbWPCWtWo0A2j9seHnhWgN7awWgLV71hG2ZUnQJeX01k9z3AaoG8:VFgibWPCWLsBlHRN7XLtG2teR9zbot
MD5:	77D202856710501AC2BE588AC186CDAB
SHA1:	73FC70BF087D68D33DCCC7C96571120D322D71CE
SHA-256:	B622FA1816E19F78985D25010E77D260340E5A63A7F249F51318C691F3B68362
SHA-512:	70813F4203D1369E97B44B0E55E510E365490DB58144F1BBCFF65977A1C02AC8FD15A8FE5F242781223D5ABA0CBF01A7D0E3F30BC7D30CF0B1C835A70B017270
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n..........."!..0..............-... ........@.. ..............................C.....`.................................8-..S....@..d................(...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`......................@..B................p-......H........ ......................P .......................................~'...K..<......crY.^+h<..V[.....OU./d..........DU.l~M....".t.8.-.q5...q.LFFn.V.i.F.."..c.2e.5..JR.k[&..XK.\.2..[..5]y..e.BSJB............v4.0.30319......`.......#~..........#Strings............#GUID... .......#Blob......................3................................#.....a.........z.<.....<.........\.......3.....w...U.....M.....7.....y.................................................<...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Resources.Reader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.762952065691952
Encrypted:	false
SSDEEP:	384:/wKGAWR3WosBlHRN7e23LMB+6R9zctFGFv:YxP0jLos29zlB
MD5:	994D0EADFB8F679DF717D7EA10FB9DF1
SHA1:	76C97D4BC8CC1BCD49700D88A25F5C1CE32182BC
SHA-256:	59BDC8F5B2E204AC8037EDB6509E8549503FCC104CACE1FF907AAB1A9BA4860B
SHA-512:	5CD299888B6F553C19CCA2531C494D31C92CEDBE30B6F0C0C9A22E4AA25A80D084854FBDD0447A63957CD7A4714C570AD64F396E29D490F7F4DEC5D8CC2975C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!>..........."!..0..............)... ........@.. ....................................`..................................(..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ..@...................P ......................................n^Z.0..3.).....O..:...\|..x.$.....!n.J.0r...<..(..\|.U..+p..M(..O.....q-#.'%.Q...""v...b..@u8.. .BP-....g.q...O.#Am.s.......>BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3..................................................=.....=...3.*...n.....^.....a.................w.................w.................G.....I.=.................$.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Resources.ResourceManager.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.759349769856366
Encrypted:	false
SSDEEP:	384:f/9LKWwzWAFsBlHRN7ivITN4tgR9zJNf2:X9gJ2jPTNx9zm
MD5:	D0F261F438B5CCE25F376F071F9E669B
SHA1:	D57F199671C02716705866AA205407CA24DB15BE
SHA-256:	338A5001BC8B016191AB697F622F2E0DB8B14F94BE6BDC084F36A3E37F2F6623
SHA-512:	58704048AFD3871E441328F4260702B6E83BC6471E289507DC0A059E19616BA3BF148113B4A25822568482701C112593F68B8AB9E97B6297226B10A93B9B4486
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....x..........."!..0.............^+... ........@.. ..............................y.....`..................................+..O....@...................(...`......H..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@+......H........ ..x...................P ......................................RA-X.......j.F..0._...1...bwZ)..+.. 1Y.>.>.\^0.;.D\......\..\|....OU.vSf..-.........P.2...........AqU.....X.)..gF..B.].BBSJB............v4.0.30319......`...h...#~..........#Strings............#GUID...........#Blob......................3......................................M.........f...........].l.................r...A.....9.....#.....!.........................................q...................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Resources.Writer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43160
Entropy (8bit):	6.651710466162429
Encrypted:	false
SSDEEP:	768:/mQMos6LnD/CaUaIayaKaYmaIaLoa66a7YadvamayamkSqscZjI1SiI4TntX7j19:/lsQlZ3fYrZ96v7Jdyr3rscZOSvc1Wz8
MD5:	3F70CA29D2DB892F37529516884CCDB9
SHA1:	8D599BBEC0EB991D1997CABA66B000517E884296
SHA-256:	DAEFFD9C3655E33BEC996E69F90A29B5B58413B1D6718BDAD4671E192C9A5DB9
SHA-512:	2082BB8B3867BA1695FA57DC885448CCC82F709CC502A40F033E5B2B04AB7FE6EE7DE2314FBB9FFDC3C39748E0384E2CC3C91BF9C6057A3CAEDB1EE353C100A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b............!.....l........................@..................................n....@.....................................................X........(..............T...............................................................H............text...vj.......l.................. ..`.data................n..............@....reloc...............z..............@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.s.o.u.r.c.e.s...W.r.i.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22160
Entropy (8bit):	6.446294835595399
Encrypted:	false
SSDEEP:	384:VWe2Wj7ZFYI00002leWWWM7L3WtNlqgsBlHRN7J/pUad+JR9zusLjl:rPZFYI00001oojMadk9zu2l
MD5:	F16FE8B82DCA9B3C842E5B645D756508
SHA1:	FFD7979B72C28ECF02906D0EF1282C99DCAC1ED6
SHA-256:	E0BA9AACB117224094B7F61D2208C9C0534C1E0DF12004A17600A3B8E820D484
SHA-512:	007D4CE20C3353394275CB51228903D7423A755B826CA9CD53996D94C9C804EE107E9B0E354B5167EA5E4D0FD8A1A0ACC5DF50E9C7CBEB8743B18E91330EA9B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q/b...........!.....(...................@....@..........................`......i.....@..............................................................(...P..4.......8...............................................................H............text...t'.......(.................. ..`.data........@.......*..............@....reloc..4....P.......,..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...f.'...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...U.n.s.a.f.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...v.'...F.i.l.e.D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.527855549217886
Encrypted:	false
SSDEEP:	384:tWBLWr0EaeayEcBvsBlHRN7sfTN4tgR9zJNPG2c:g+01eayEjqTNx9z22c
MD5:	169846AE579641DA67001F4DAB8E1F3E
SHA1:	9FEFC3AC60A8367E328FDC26D30766B7AE241F9E
SHA-256:	694A726230B8A36241D1E5FA81BCFC11B1AB3B0324A3D94CC41CEB2033D8E79F
SHA-512:	2992CC291EFBEF354CA3921B7A157E30F557E640D2E7DF056AD998AC0A2D4C7E5B064E8E9B22AF00EF0A90E2A681E16D203A8D92630712BDC4DC591D156C0D26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8.............!..... ...................0....@..........................P......[.....@..........................................................&...(...@..H.......T...............................................................H............text...'........ .................. ..`.data........0......."..............@....reloc..H....@.......$..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...V.i.s.u.a.l.C...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18072
Entropy (8bit):	6.608666972669781
Encrypted:	false
SSDEEP:	384:k58KUByGe9xCEf6iW3NWkGsBlHRN7y/P/R9zVP:kpUByGeJkPlj2PZ9zJ
MD5:	46333F3074F8832920D8777831AB2CDE
SHA1:	B2029CBE5B3B20A344BA1BE5BE94D0A59B1A4855
SHA-256:	7581D1D088F37488D4C41240DB1346D8B53E8A6E56EE27BB80C6D1DE62273C7E
SHA-512:	66CE1751F7B88AB91851D33C93E8922DEE6F3C3C343BCC7B7C3B446E856642770CAB2ED3DE5AAD6A389B62B5BB79F1D5DE2B38F7059B703E9A1C9F0F1D234D97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............3... ........@.. ..............................2<....`.................................83..S....@...................(...`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........ ......................P .........................................U....h,..l03..V..S`I...X................~.......-..wp..`n..{.`../{.g.].2m../Y._.^...{.....6.m.y.c...0...Z.j..S.}..P(..'BSJB............v4.0.30319......`...$...#~......l...#Strings............#GUID...........#Blob......................3................................O...............Z.............m.........,.W.........5.............p.....p.....p.....p.....p...E.p...b.p...z.p.....p.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Handles.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.807660825970591
Encrypted:	false
SSDEEP:	192:hZUtx15EIWumWXPWo0A2j9seHnhWgN7a8W/N/wEJVOYOg8nK4X01k9z3Av7r:sX15EIWumWVsBlHRN7E+oVOY/wR9zQ7r
MD5:	9DC517A36D8AEF4EA82C57551F744352
SHA1:	24E015A2D989B4136839FE283C934F95F5482770
SHA-256:	B5920F9846F5A36B48CFA67DBA3B0698DF2ACCA9080D56D40C3D9EC7D294CEA9
SHA-512:	CF02ADF999E75636C001B4EC4E736C406A9129E72F75B6529F44776E2969DE87947B24DA40D443048C92759B264741B4A5BB42DB64798861559ABDD777ECAB65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.+..........."!..0..............)... ........@.. ...............................m....`.................................x)..S....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ....................................../.@n....h.F#.o.>.I).8.Ub.O.`'...O....w...&^.....q.(.a..&._$qc......L:U_..<o..=....J7......?p..\....+F..9Mem.....nX...?BSJB............v4.0.30319......`.......#~..L.......#Strings....P.......#GUID...`.......#Blob......................3................................................(.x.....x...f.F.................'.........L...........a.......................H.....z.....\|.x.................@.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30360
Entropy (8bit):	6.609598213901939
Encrypted:	false
SSDEEP:	768:EoFdr0WQ6euLDKMM/tzmGW7BFFxIjUTNx9zSGl:EoFdreuLOMZ17BLxYGpzSGl
MD5:	5802F54DD14206F60DEDED0673CA388A
SHA1:	5CC2B5D0AD1116D4FAFA92556B708802E550D5E1
SHA-256:	EC303C2F7AACBB2BA634D980C03B4F3173732C5CCDC6939F705AF781365F30E3
SHA-512:	C1D3DF28993F9D88430FF35632609DA70084FF4AF6DB81F6BB956B54215A6F9434B60D0746CDF4107D51831CF4686A35EE7B50DA10277758CE97513FA4877760
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.....D...................`....@.......................................@..........................................................N...(...p..........T...............................................................H............text...,B.......D.................. ..`.data........`.......F..............@....reloc.......p.......L..............@..B............................................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.InteropServices.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49816
Entropy (8bit):	6.544735189745316
Encrypted:	false
SSDEEP:	768:NZo3fKxCqWN4p8k61rvZqhwFLOFMj5iXj/j05sN9zAR/K:NZoixO4bGqhwF6FMj5iT/Qyvzn
MD5:	1C111CA31999478AC7D286B5B291F9F1
SHA1:	3CB936FCF1495275658F9D0079B857CE88A24802
SHA-256:	365A51E6A7ADC079ED3FBC31B0E9726C7A365CCC35FE5E09F7DE7D1EF7290BF2
SHA-512:	0EFD2D8C6F8F312C24817845D4AB097C8C92867D5B450268CED58578ED18E39C21A255AFB3767E72EFC04E02463425CBDCEA67DB478D1A39467042E6A8ED32C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8=.............!..............................@.................................C.....@.................................................<............(..............T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Intrinsics.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.6571208335969745
Encrypted:	false
SSDEEP:	384:e14fW3LWH+sBlHRN7bo9wRTN4tgR9zJNinO:catjboGRTNx9zp
MD5:	BAFE5E6621002287A8CCB43BB04A2A44
SHA1:	FDE0F348CB1AD16BF84248528BFBD0D6D8ACC9CD
SHA-256:	0E8D96C07F4548C34E5B8C88C776603F0E7472CC18DAA2ECE94EC3E74C9E7D05
SHA-512:	3637328D3C6C7E4ED49E587B2B0CB3AC855D51720E9EA2CC5882B94F46B0E508A38ADEEEF6C33DBCEB3E8E1A7E6ED4A4F7B3675B74A1F6801657DBFDB16C0F32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............-... ........@.. ....................................`.................................d-..W....@...................(...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........ ......................P ......................................*C3.c..%t5.........B>...3...r.Q.I.m,.U^..C.^......A!...s.f)......z!]2O.....Pt9.b..e&....q...J.k..St......7.\|.xx&...A..h+.DBSJB............v4.0.30319......`.......#~..<.......#Strings....$.......#GUID...4.......#Blob......................3................................9.............................p.........?.....g...................1.....1...}.1...4.1.....1...X.1...u.1.....1...(.1...O.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Loader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.712298208657757
Encrypted:	false
SSDEEP:	192:w0SJasxxoC1W7GWmVWo0A2j9seHnhWgN7a8WVuAU6GJVOYOg8nK4X01k9z3AvTeh:yJr6IW7GWQsBlHRN7e32VOY/wR9zQX6
MD5:	AD8E253F42DF40953E9C380A34332581
SHA1:	7A34E3D2DD84769DAB304A0DBBBCD5574D9DECE7
SHA-256:	A1B17F50ED4C6465DDD58E445B4ECAB53C42228226AB0C290E8B8AC1CE60B50C
SHA-512:	DF491F81FAF153829572412A856ED2FF671D95F23A8F5FE9D746DD0058CAB12F8C1E7BB80230318EB4B7D6F8A2DF1F4F7C116C1CDE3AA1E93DFFE9B39E7A0E43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Sr!..........."!..0................. ........@.. ...............................3....`.................................8..S....@...................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p*......H........ ......................P ......................................u......r..5.....Q....h...r......&..6...g...)...tA^...U.\;.....t@d..N.]#(.y.:..Q....)...Le.....%C(-jh.>. .tP.a."D.:.]...+.\BSJB............v4.0.30319......`... ...#~..........#Strings............#GUID...........#Blob......................3..................................................,...4.,...p.....L.......R.........t.....l.....V.....V.................................................,...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Numerics.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214160
Entropy (8bit):	7.0342036033459365
Encrypted:	false
SSDEEP:	3072:Pw44hB9148dqMnEsrZU53j626pYBllKWQI9yEJfYFmq2AYIInNX7YPoAKiDIEbmB:4dqqrQb6pYflKhEJrrTF7J2IPvprfy0
MD5:	8582B88DD96F3DD07C0A36581766DFF6
SHA1:	D740690A28E2A5AB211D62CB7C074802D8AA4D2A
SHA-256:	0EB2AC93C5722C811738C6CE44ADF01521D092BD8B9B50C974ED64421505D1BE
SHA-512:	38CC223779A2A544B2DC676EC5278CB7D70CE200B64416A7EC91BAEE9C8E4C7F6C8E31218DBEC83E10F4C603D7C39A7A0F715E82A5E2C85930FC9C74C0F3E094
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r............!.........(....................@..........................P......f.....@.................................................@I...........(...0......p...T...............................................................H............text............................... ..`.data...............................@....reloc.......0......................@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...N.u.m.e.r.i.c.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	302232
Entropy (8bit):	6.826718172067416
Encrypted:	false
SSDEEP:	6144:an3z6cX9UPAf98qdKf+f8wcw5ow2y/93yoS3q5XI:anj6cX6Af9K+Usew2ylM3qtI
MD5:	AF6BED661638E98A330C8ECBF9BEE08D
SHA1:	48D193B98387623ACE306D177897B598F792925E
SHA-256:	43053F7FA0E08951EE1EFB71E5746D33F7032139B0866CB7336B9A7A1CC21774
SHA-512:	9F68AFFF0C21D8E0B35D5969308FEEE24D45610BF5B228CC1D19564404DCED31465D9A03FEA1C5BFD1981785002CAC2C486DD910057326C2C4052CF4F922EF15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|0............!.........d............... ....@.......................................@.................................................<Y.......t...(...`...+...&..T...............................................................H............text............................... ..`.data...V7... ...8..................@....reloc...+...`...,...H..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...F.o.r.m.a.t.t.e.r.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16016
Entropy (8bit):	6.719844158466584
Encrypted:	false
SSDEEP:	384:Npq1VWbZdB5WzsBlHRN7CiwBmfWojR9zuswUl:LyWZdBpj/fWoF9zuE
MD5:	7ECCE6ACDC149B6772D3DFA90877988B
SHA1:	689D7822020296EBE6C93EE245B3C376C7DD8D2F
SHA-256:	4913C5B2CD45579123C6F52C976DEE3966DD5789F9BB471B2BB4A712C0A72361
SHA-512:	9E55BEFE03C74436549DB17B7F91A0FB2D3BD709179D18E9527FADD1B8355B65E8A0BF809FBDBEE33D78DED13F38869DCC02CC95003679433A7432F37FC9EDC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............~... ........@.. ....................................`.................................(..S....@...................(...`......d)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`......H........ ......................P ......................................8>2.XZ.......WN.`#..%...Ke....[Z0..\|..:...w....E....f:......2.>~.G...d...,....\|..s...)...!.0oc..>I ...Q.hED.W...S5Ce.}M.BSJB............v4.0.30319......`.......#~..\|...d...#Strings............#GUID...........#Blob......................3............................................................3...........^.....a.......O.....O...w.O.....O.....O...w.O.....O.....O...G.O...I.........................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27800
Entropy (8bit):	6.557800837104422
Encrypted:	false
SSDEEP:	384:XHWFNJBrWpnwhc2J/vgdXkO2akSMHHDGEHsjwZ42sBlHRN7sn/P/R9zV2:XqNJBQne9hgfBnZjs/PZ9zI
MD5:	028793A0216064CA892A7A7B1E7F02F6
SHA1:	3DB207AD5C2BA354B812E983E520035EC4C0898B
SHA-256:	418741EFDB57C64974333F2AB2730DA89DEEF5C38F3596CE6DCA67BC8772BDBB
SHA-512:	A7361735CA0997763BB7D8D611F12336E77D79A3AADBD3E50B7ECC38C876EA9F8DE962059538D9E1BEAE45FE2E3A3350F902C8A89FF52358A89E036C6FC8B93D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.............!.....<...................P....@..........................p......J.....@..........................................................D...(...`..........T...............................................................H............text...b;.......<.................. ..`.data...;....P.......>..............@....reloc.......`.......B..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.748958838593186
Encrypted:	false
SSDEEP:	384:iYklmI8Nwv6MWsFBBgWYsBlHRN7COG2teR9zboJU:5klmI8NwiiFBBxjCOG2tC9z6U
MD5:	AADAB528CC9DD085DD56725F2F2A3BB2
SHA1:	0570D5E43DEDD53F01A81EC078B3E669463FD538
SHA-256:	0E59C4268DA275E8730F3022C52A668ADB61E3E5AC439E4D6179F646D4F8A80C
SHA-512:	350F7DBD3218B6507C3CF4017FCF927658C904E04B46C7A1DED202BF3A249DEC90AE19F8C66F001F785592098C23EADDBD6F68E48257964471D2E0692A1FB333
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#............"!..0..............-... ........@.. ....................................`.................................p-..K....@...................(...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........ ......................P ...........................................J.yL.-6..o$bO.a[..RB..n..+).W.....3.5...+..g.Rw$....H.......=......8......(.@..*..._..\.l.....m.....M..p..9u.k.2.^..uBSJB............v4.0.30319......`...d...#~......d...#Strings....(.......#GUID...8.......#Blob......................3..................................................f.....f...W.;.................Q.........=...........R.......................9.....k.....m.f.......................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.Serialization.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17536
Entropy (8bit):	6.618224964872613
Encrypted:	false
SSDEEP:	384:JpEvDj8NXBDLWgU4BHWJsBlHRN73MblGlD/LVNSR9zulX:JpEvDj8N5PU4Btj3UcxLVNe9zO
MD5:	858FCE1E3A111900B8AEB2A52C2C6B49
SHA1:	0A8DC9F0C947BEAA44A7A9ADF0E4FD793711F833
SHA-256:	B49DF2C8AFDCDE0D416E27D2D339418AF294ADDF3C9CC09C067E0F51743814AD
SHA-512:	B80E2D41832BBEC10357B7E0A1A8A9B4C39552AC06153F4DEB8520F19115374158AE3E39EE5FF4381382016658164FFC7B9B6777F28CAB68483B104499C820C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=............." ..0..............0... ...@....... ..............................5.....`..................................0..O....@...................(...`......./..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......P ......................./......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob............T.........3....................................,.....................f.......t...............7.......t...=.t...M.t.....t...B.t.....t.....t.....t.....t...e.w...&.w...r.........................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T...Y.T...a.T...i.T...q.T...y.T.....T. ...T.....T...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Runtime.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42648
Entropy (8bit):	5.800339126211284
Encrypted:	false
SSDEEP:	768:/qV0jdpFKYl5f4bGRi2xVbcVT4pnSpjIPZ9zc:medGYl5f4bGR3G0tSZozc
MD5:	83BA81A5702DBEFA75B4B4565501D703
SHA1:	97A3D91F072E87CF43FDE1E036F2EA995991E8A4
SHA-256:	D3EB577DDAEAAEF974C0EDB211B5A70190118B9C037AB0CABA75090ED0543E2A
SHA-512:	B6954E80CD9F805EB143B2C6BC30BF793CD9FAEBF259A88949F768AC89D7014BD5D374B19EA0B660025A46078D78F8D8DA46A9818883A772BE18E23D3DE6A1D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+..........."!..0..t..........N.... ........@.. ....................................`.....................................K.......T............~...(..........`...8............................................ ............... ..H............text...Tr... ...t.................. ..`.rsrc...T............v..............@..@.reloc...............\|..............@..B................0.......H........ ...p..................P .........................................0C.c%...5;...4....w....%].)...".Q.+....'...W.D)Y....I:.....&-.y....*~...f...[!...mJ..c.h.........a.....B.hQKw[.tC.VRH..BSJB............v4.0.30319......`...l0..#~...0...=..#Strings.....m......#GUID....m......#Blob......................3................................T...............'.[3..".[3.....2...3....e.....>.. ....<3....<3....j!....j!....j!....j!....j!..q.j!....j!....j!..R.j!..&.[3..........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.AccessControl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197264
Entropy (8bit):	6.779696424015406
Encrypted:	false
SSDEEP:	3072:qU0Q+z8tFK8x5dJlZnFW2iBeVICTiupU8TVUnVZ5IsRTXKoUcQhiKd7gfCzAWoeH:BM8x5nlZopZXKSjK+Kied9H
MD5:	9E22015291FE64326D35D2B7DBE2C7C2
SHA1:	54B7CC10EDEFD9A7237499C0EF2FA5BC8325A228
SHA-256:	8EA4A471030A5AC726A49ACCB5F2D61DE3540F6DB19B2559D50542BBA3851F4D
SHA-512:	B59A8C972EDC01108420C68448E11CF43EEB26ED2DF3FFD7EAAE0D31456DFEA93BE28537237F4DBF322A01D8F7C73360506325D5B53D9B13862598B2D656E7B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.............!.........0....................@.......................................@..................................................<...........(...........#..T...............................................................H............text............................... ..`.data...^...........................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Claims.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	86672
Entropy (8bit):	6.527697725046391
Encrypted:	false
SSDEEP:	1536:VTzHLPs1VnByOuX3xmxFb9L8kGOQwQ7rzUU3q2bP6Vbn6BySvad8zuL:VTzrzOuX3xmxFB3DM+aa
MD5:	971145DE64A1BBE77808DA8CD8625795
SHA1:	2217828C3A2FE79E3BA5614450DE3F581BA5E519
SHA-256:	2674A8B15D0CDF28A0E73F4F6F83EBF554CB36BF9AD140D45A4E400920F4FCF0
SHA-512:	B74DAFEE97F9CACD20D3F04F6C19F92F1E94F22D38CC611FCB20BF519016FF33A7E56DFB91ED2B98D4AAA23B4C3901D2131D90BEB49F3D8730ED56B6F8658FC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....T............!.........................0....@..........................P............@.................................................t".......*...(...@......d...T...............................................................H............text...D........................... ..`.data........0......................@....reloc.......@....... ..............@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.l.a.i.m.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	689304
Entropy (8bit):	6.823627146286952
Encrypted:	false
SSDEEP:	12288:pCRDIv/3px9Ymh5s8W75wMQNCN+em8SaIRWLqawMwFzExgqLTJqldogYh+y7:gJ2px9Ymh5s8W75wMQNCN+em8SaIRWLJ
MD5:	2A4C4523242476BA2FE64F7767F3398E
SHA1:	7456E1D1B6F7699A602108984F94CDCA9DD3AE8B
SHA-256:	01FF3C33BCD42F869D73208FCCC468EBC392C2181C650A64CBE351BAEF4E9ABB
SHA-512:	807272A69724720669C7ADFF84BDC7E4499C145355D7E7AB19B1A40109A65C450C70DE83E3BFB9F8DA8D43AA0512933852833BC5F571EAEF89C1E9CDCEB2251A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..............!..............................@..........................p.......s....@.................................................0....2...\...(.......l...B..T...............................................................H............text............................... ..`.data...\^.......`..................@....reloc...l.......n..................@..B............................................................0.......................x...0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...l.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Cng.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	419472
Entropy (8bit):	6.834528653758341
Encrypted:	false
SSDEEP:	12288:lpJtenxyoK70uj/60hUgWWZ+gaclbx/n9ffw:lpmnxyoK70uj/60hUgWWJx/9w
MD5:	61DF9812A09490E5FF59C47CAA07A2B0
SHA1:	ECD995D413026E6A22FEA2C999290FD5E9F9E992
SHA-256:	D39F3BACC945D31F08D011500F87F11FE414F9564C773D42F477A764465ADAE1
SHA-512:	73DD92288F6CEB532C20748561B8A5F656CA984089F42B73E2C80FAED9044D45963C62D4477A703CED0FD44057DB970A74A2D9DB390F8A52D1856BCBCED0281E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........~....................@..........................P............@.............................................d...xw..8....>...(......@>...0..T...........................................................d...H............text...u........................... ..`.data...V<.......>..................@....reloc..@>.......@..................@..B............................................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	172688
Entropy (8bit):	6.726437118849692
Encrypted:	false
SSDEEP:	3072:VAyu3GH04ZSgegSEHA3yAL9JN/bn9AUQ335BotV6LvbxQvbBS/8:+yu3G3/oEHo/UBotUTxQvbU0
MD5:	DDC34CEA023A605D3DF9BB8BDA74D2F6
SHA1:	E1101EEA02CE048928D0F7D00A9B513593024F85
SHA-256:	1E6AEE205B4E957DBE7AB090C088B657A29153D3E58CAC29A6DB10CBCC5FACAE
SHA-512:	861A8264102222343346E3AE3DDB0CD4325E602A9DABB18F8B7BDC085064D1B6968D47135397FDB3BDE6BB44AE01337B00113D82FFD574512A86C382827A707E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p............!.....@...8...............P....@..................................T....@.............................................d...D9..`....z...(...p......."..T...........................................................d...H............text....>.......@.................. ..`.data........P... ...B..............@....reloc.......p.......b..............@..B............................................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88216
Entropy (8bit):	6.569029301858979
Encrypted:	false
SSDEEP:	768:157OOlllllllllGT1JK8RJiUkMcYVI6cp6zN/mAJJQoeSccRzkI32k365DAVsrII:15WT102D1c0BZVeSRzkImvtAVsaFPzc
MD5:	D6B925DDA7A13D409907F5A50FB2BDA2
SHA1:	B62925E820A08EDA26D84A663CF0B65C543B591A
SHA-256:	08AC0AB121F8A818CC2FAB722E634841FA660B2BA96D46864DB6500A63E11104
SHA-512:	67FFE32C1C803174DC44B0EBC6FBC69142A08B68F62D52277E449D197F37E08FB27B42860E1AE70165DAA497B0174F2368F0CEDEDC462803F47B6FD9E38F25E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..............!......... ............... ....@..........................P............@.............................................\|...@%.......0...(...@......\|...T...........................................................\|...H............text...3........................... ..`.data........ ......................@....reloc.......@.......&..............@..B............................................................0.......................l...$.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...`.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.OpenSsl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31384
Entropy (8bit):	6.25484677435803
Encrypted:	false
SSDEEP:	384:q9WA6ijRWwFbwPV0D/F/pQ+1+HCeqtwluWvWivK4OcVEFNJSusBlHRN7jNVU/P/U:Wbeqyll+iR1VE1mjkPZ9z+3
MD5:	F130FE68EE27151C26A5FA3858F07B3C
SHA1:	7D5354A8B6FF69A70F8436D35A8CE63CF7EE2C04
SHA-256:	7F59BB9A51676BB48B9B413DF5BEB4932D09BC03BFCB35085E924ADB3768DE5C
SHA-512:	36439745295F41DBB67D958A107EAE68F206588D25AB2EA1F902FE2CB1C7F21B6CD0BF5B51D146BE482E235537141B87AC13DEB191E18FF626C9A1BD4F1B85E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4*.............!.....L...................`....@..................................}....@.....................................................`....R...(...p..d.......T...............................................................H............text....J.......L.................. ..`.data........`.......N..............@....reloc..d....p.......P..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...b.%...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y...O.p.e.n.S.s.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...r.%...F.i.l.e.D.e.s.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122512
Entropy (8bit):	6.712410434434147
Encrypted:	false
SSDEEP:	3072:XVCnR/EX2+0pU7wJ+JbVUouC9MQxQEIf9XC:6R/4PwbcMQxW9S
MD5:	510A23CF0B8D553C40C9453D84A2FF33
SHA1:	7FD41497ABCB74C20890F40E65424A728CE060BD
SHA-256:	30B8281F804267ACA796EA0D5D6DA9C0622F16D149C6B9595EBF18314EB33B77
SHA-512:	4DAB45E0602D864F99B128C4E6899ED103F767A376C3386943519CBB9133D4F6FC943D2D51CBAB0207A8565CD0884E69A7052F4ACBC888B81462714BE4EF2575
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E............!.........*....................@.......................................@..................................................-..P........(..............T...............................................................H............text...L........................... ..`.data...............................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	434832
Entropy (8bit):	6.825675862323594
Encrypted:	false
SSDEEP:	6144:sjfcG7yAaZQZdeo3yUn0lBMr3NTYE1ihHCKsltBufvh7OzxgnEm8IgZj:sjUGJayZdfLn0lBM3piChEOFyEm8XB
MD5:	9A70604AA98CEAEE7AFF3FA8AB6BAE15
SHA1:	28E53A094295FB99D5DC230096154C4FEB9FC06A
SHA-256:	14889A3C0A096D1BCA9108F7D80EEE7F186527EBAB412FD452C4E6B03F06CDE0
SHA-512:	E0288142EDE07614329AA8E63ED4D67E9F316E2A07034F776F6C484F52EDDC1EE2829D50BEC25CA2858152C2D84916601E534CF2F3EABC91C16C0243448C3373
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Lh............!..............................@.................................B.....@..................................................n..h....z...(...P..P<...0..T...............................................................H............text............................... ..`.data...'\.......^..................@....reloc..P<...P...>...<..............@..B............................................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Principal.Windows.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	137880
Entropy (8bit):	6.792008986748846
Encrypted:	false
SSDEEP:	1536:7CyWRwJQ5ihYfcdRw7tfW4TyWHBBlEMXi+A1mrAQha8/BS2SerLEielwkJzb1zl:7fWt5C9nw7seyQ2+A1Mp9j/EielFzpJ
MD5:	7FBD44DF7EE8E07E6A72E788EBDF8A29
SHA1:	E1CC5717AE590813D4949A54006AE6C4B56A865B
SHA-256:	F0BDB8CC6FE684C28287CA982DDD646D60F19EA8FF91FBF17AB5DA86DC2890DE
SHA-512:	3C7D8C9AD6AE0DA640433699AE24620EB3480CEC66C81AB366B5EA5192D873143785919F0992B5B4DAF85FB0C3F5BD50E72E69A865C106C5199ECD99A415FF62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.........*....................@.......................... ............@.............................................d....1...........(..........d...T...........................................................d...H............text...}........................... ..`.data...............................@....reloc..............................@..B............................................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.Principal.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.82058184062749
Encrypted:	false
SSDEEP:	192:gFqIelxx1D3jWVlfWsWo0A2j9seHnhWgN7akWUjYks9gICQX01k9z3AFMiQWxO:gFM/PW3fWysBlHRN71U/P/R9zVipO
MD5:	20D602EC44DD2DDD0B7FABF7B0545249
SHA1:	6EDC73486B008AA7E6C85BA25B9AEFDE9861BEFD
SHA-256:	F57CFCF94ACC12434D9B1BB509233549A14BAD9D06168CCBE27A945F6B35F16C
SHA-512:	769C6F05FD34B4A67B2DBC0AF6FB2358536EE6AC178C7E680FC718FF4764A4BF6ED9C4F394C9BA90BA22E0C43BCE885A10B2D060112D6147136F93D8E292E952
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[s..........."!..0..............)... ........@.. ..............................hS....`..................................)..S....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ..........................................?7].B?Vva0.\\@.[..:..lGL...%.N..xG.PWPfX.}VI$..j...*P.g.....CA..I~........u.J~G...N...P.>\|.V..%.N..s.K.p..@K.l..{.ZD..BSJB............v4.0.30319......`.......#~..X.......#Strings....X.......#GUID...h.......#Blob......................3......................................F........."...........;...........f.......d.................k...!.k.....k...[.k.....k.....k.....k...B.k...O.k...v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.SecureString.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15504
Entropy (8bit):	6.813970331796232
Encrypted:	false
SSDEEP:	384:Ejehci+W83WQsBlHRN7opUad+JR9zusLwfD:EjehcrIjNadk9zuZ7
MD5:	3195D1DDF2F0B29A7696804C3098341A
SHA1:	60FB031FCA6C1684EF5FFE51F530779EC465033A
SHA-256:	04ADBF58CAB2C423A6C11ECDCA80F8B1BD67D9BCFE713CF59C393D69941425EA
SHA-512:	81E6F01CBD08271C2F55F1CFEF42C9A2B623FFAD5875AB48DD6BA05591D28EC521D122399E2C66025EA87F77924A04EB93443301EEEF11D375462409BEAB2385
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(..........."!..0..............)... ........@.. ....................................`..................................)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................RU..r.eN..G......lz....b.....(x.Z.XV.8.......U..1..9:,J.on.b.t8.>+.F>....\.5.y..{...*...e>.{w&..-..82.W...ad.. z.)ma....BSJB............v4.0.30319......`.......#~..P.......#Strings....4.......#GUID...D.......#Blob......................3......................................2.....................3.r.........^.......S.................Z.....Z.....Z...S.Z.....Z...w.Z.....Z...:.Z...G.Z...n.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Security.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18576
Entropy (8bit):	6.596745516945977
Encrypted:	false
SSDEEP:	384:T+rueDaL23W5DW6lsBlHRN7NiCcM6a1R9zusNd/Kl:feDai2GjN9n6K9zuj
MD5:	52E6A5D8A3F4E9CF60DD6D1A17866BD5
SHA1:	C6D32B52CB86AC6AE280B324A82ACD767332AD89
SHA-256:	00DB69DE6DAA628D137D66A223292B921785056D3B7E4AD9E47C5CE1415C0140
SHA-512:	91DCF85B74173631E8D0F124D658C6E2FF1837E89C062933E86F3B13FAF9B56BA910A5148D8FA34A9CDEC790C9F440304D92A3296FC6C927D05D1CA27F6794EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............." ..0.............^5... ...@....... ....................................`..................................5..O....@..T............ ...(...`......44..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B................?5......H.......P ..d....................3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......H...#Blob............T.........3....................................O.................p...~.p.....;...............O.=.....}.....}...e.}.....}.....}...'.}...D.}.....}.....}...n.................7.p.................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'...y.'.....'. ...'.....'...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ServiceModel.Web.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17536
Entropy (8bit):	6.599943708654602
Encrypted:	false
SSDEEP:	192:ziSEY8760DX88ggUWR5WK7Wo0A2j9seHnhWgN7a8WyZJVOYOg8nK4X01k9z3Avx5:zxOUWR5WqsBlHRN79HVOY/wR9zQxNJd
MD5:	3A99A935B27D94894531551FDED4C9B6
SHA1:	9D014E860AF31E4E040E05B0B88B3F542847173A
SHA-256:	1C34D73750A3CD876706D2EC941B89DA5272B37B3242B2587A1AF77524F721D3
SHA-512:	EB562EBD4A1C4F444C77A6B6720881D2A68FAECFF13E8E4AAFDFF5AD94328B5BB90B1E5F8EA36F4D5F6D13F45CE5C9D8016B31B31F4A6E8425B3ECF712A539C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............0... ...@....... ..............................C!....`................................../..O....@...................(...`..........T............................................ ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......P ......................`.......................................BSJB............v4.0.30319......l.......#~......,...#Strings............#US.........#GUID.......P...#Blob............T.........3....................................&.................................%.....?.....^.......S.....S...t.S...+.S.....S...X.S...u.S.....S...(.S...D.H.....H.........F.......{...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ServiceProcess.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.704152657475633
Encrypted:	false
SSDEEP:	384:GlWpWn5lpFWFsBlHRN7sMLGlD/LVNSR9zuHY:GDNjsfxLVNe9zv
MD5:	8017CA523825FF8536EFADB67DC59C59
SHA1:	D426ECE10AE750C49F7C5E9D0A7DC2AE0A6DA0FA
SHA-256:	52C5F504F43A035CD25BC257543B2579ACA4111747AB67CD70D93BC4B939A20D
SHA-512:	1D4A36389F793DDF8EF990CAD018A5323321F15B73E596FA5E4B80EB05D0101ADE0826492BA373098E4AD0C6424A7966C276E09AB5E12919E57B110A4D110B97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y..........." ..0..............,... ...@....... ..............................7.....`..................................,..O....@...................(...`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ......................D+......................................BSJB............v4.0.30319......l.......#~..<...X...#Strings............#US.........#GUID.......L...#Blob............T.........3..........................................o...........w...7.w...v.d...........U.........~.....B.................a...................................".....\.H.....w.................^.....^.....^...).^...1.^...9.^...A.^...I.^...Q.^...Y.^...a.^...i.^...q.^...y.^.....^. ...^.....^...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.CodePages.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	862872
Entropy (8bit):	7.527645804091499
Encrypted:	false
SSDEEP:	12288:Cu4I7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPLwrIR201fLwhHXE:Ct69km6k/IwRYbiBeKGCqwrIYEwy
MD5:	35C2F0B735A90D3CD811770455D7BABB
SHA1:	13385327104BB9AA396B1723C82D056ED398FA07
SHA-256:	B87FEF90A17A297F887D27CBBEA8DB439D34FC055F928B4DA95625BB3D1547D2
SHA-512:	460944762AD1BAEB8103B2753377624386002BC11F13B1BC9A8FE4DFE800B728DFF0F59F36568EAC117BDA8BDFF0371109E5A87766206446B8B854AB086774D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.............!.........4....................@.......................... ......~.....@..................................................<...........(..........."..T...............................................................H............text...X........................... ..`.data...c...........................@....reloc..............................@..B............................................................0...........................@.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...\|.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.7151642461282215
Encrypted:	false
SSDEEP:	192:3ZZvTaxxhGWZJWRWo0A2j9seHnhWgN7awWMp3OahG2ZUnQJeX01k9z3AaocN:Pv8XGWZJW/sBlHRN7fG2teR9zbo+
MD5:	523C8D9BA7526758EABECDFFBEB6A649
SHA1:	19092E5D382BB787FFEBE298D654B01E5FDC8A1E
SHA-256:	3E3A02A114994657DA3E65269C89902A6291A61B0D670B63145F8DC08B35B9AE
SHA-512:	027830E5E737F725F711823C41FAEA640D9E6DEB115D2DB929BE7558E75B920E565D031716B3EE0628FD411B65A7ADF76DB3105EA16A103AD61CCE2CE2776D7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............n... ........@.. ...............................'....`....................................S....@...................(...`......X)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P*......H........ ......................P ...........................................d.....%..{..N.....uv.C..8H.....,....Yc.. H5cT...$..xS..{...m&^(qJ"}.w.3.Y....Yp....a1U../..P.?....h...0C...........z..BSJB............v4.0.30319......`... ...#~......H...#Strings............#GUID...........#Blob......................3......................................v.........I...........b.............H.........$.....b...........H...................................i.....v...................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encoding.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.76254793636592
Encrypted:	false
SSDEEP:	192:p+gBLoFxxXtW0NWNWo0A2j9seHnhWgN7akWTM3HWGaN4NhrJgX01k9z3ASNSaX3c:piNtW0NWrsBlHRN7zmTN4tgR9zJNSac
MD5:	E449B28552061255A8081357D955FD34
SHA1:	8FCE93849CFBB93F44475544E0F03618BC56808C
SHA-256:	EF8262DFE6ABF7E465388C90F7717D355BB1D5F1186F1E88B6BB42D34EB1C57A
SHA-512:	EEFE2B27B14C88EF5368B2B785D4E4F49FBB98C7642A8A1C877F9BC746109E58B6968EE9359FDD0019FBE69646644B537E37571E300D66AD26BE2FE64D01C5D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!............"!..0..............+... ........@.. ....................................`.................................P+..K....@...................(...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ..........................................6....6....Pq&AS.x...!..`.lN#......o.....\.=BC..G..........;..LtU.4I)$..o......C..j)....~*..([!.......t....h.?V...BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...,.......#Blob......................3................................................"...........;...........f.............................!...........[.......................B.....O.....v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Encodings.Web.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	123024
Entropy (8bit):	6.611670545622988
Encrypted:	false
SSDEEP:	1536:h2rqCkhSOixaRZfbq8qcDaw+nijNc2aBor8c5qUCNWPvsYHXRC2FAiLoF4kwtE+r:h2rMSOgacQwndxSwKqmvs8ROicF45rr
MD5:	FE24A394FFF168704A59F045B94159E7
SHA1:	80EA367A20410A2168238D93E37DA5652A120CB4
SHA-256:	F59B04CAC7F5410F4D14995AFBFD2CBE7AF133D5D27A42FB96C0716BA1074A5F
SHA-512:	460A61441B615E946A5CC9226532C84B922A2431A0ABD382E9BC7F78B9FA1F3923EC3161BD112ABA53D01E3EB220FC8A250B2B3373B70A7D86592BA07B45F41A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P=.............!..............................@......................................@.................................................\|+..h........(......p...\...T...............................................................H............text...f........................... ..`.data...............................@....reloc..p...........................@..B............................................................0...........................X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .e.n.c.o.d.i.n.g. .a.n.d. .e.s.c.a.p.i.n.g. .s.t.r.i.n.g.s. .f.o.r. .u.s.e. .i.n. .J.a.v.a.S.c.r.i.p.t.,. .H.y.p.e.r.T.e.x.t. .M.a.r.k.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1351824
Entropy (8bit):	6.963408492031144
Encrypted:	false
SSDEEP:	24576:tkcuLygGf6kS8gK/YgKJ5Yf7BxSAL1INH+qocM4jDHk7sR:tmj1bFP+txSApINeqJR
MD5:	B3A1521DD7829E6D3E8741D373AF32A8
SHA1:	881E51A050024CD1E4CC33F16B03DCEF306DBDA6
SHA-256:	0493DF765A529C88ECE2A2334DD327742F7945D76EF3556C94B11C419402EA56
SHA-512:	4C42B76BEECD76C849111A5D1B50517895C5F1C70F3F3051EA101FA384106D0E58F8FA2ED1795AEE4A16F4CAD207F337A23C9FFBB7607D6D7615E876DE877087
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.............!..............................@.................................S_....@..................................................)..pt...x...(......h...@P..T...............................................................H............text............................... ..`.data...............................@....reloc..h...........................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....I...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .h.i.g.h.-.p.e.r.f.o.r.m.a.n.c.e. .a.n.d. .l.o.w.-.a.l.l.o.c.a.t.i.n.g. .t.y.p.e.s. .t.h.a.t. .s.e.r.i.a.l.i.z.e. .o.b.j.e.c.t.s. .t.o. .J.a.v.a.S.c.r.i.p.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Text.RegularExpressions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	505488
Entropy (8bit):	6.885040493730063
Encrypted:	false
SSDEEP:	6144:1y4MAyd/8+9mBwAo61yLLSvBf+OhiKpwR4UTLproxCBK7rgfNqYfKaI1Cr:04byf9Yvo6PpHhiKpwR4mVo4ws1quKy
MD5:	8B5B781359443160059ED2734C8C9600
SHA1:	B1B4C6581135DCE1A77F90DB14EA82F9F453E8A3
SHA-256:	395A7B0439A8627E3BA9E60F66E63B53EAA2BF61468AB1EA867FC721BE26E2ED
SHA-512:	06E2A11AD4AB8512DA9FA87924C556C19B85122BEDCC75C79E81C674B4392D8A992B96C4FF2E33BFBCE4EBBB77130AC30A1753DE56994CC5AAFF770BB123308C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.............!..............................@.......................................@..............................................................(...`..,C..()..T...............................................................H............text............................... ..`.data... N.......P..................@....reloc..,C...`...D...J..............@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.e.x.t...R.e.g.u.l.a.r.E.x.p.r.e.s.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Channels.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	116376
Entropy (8bit):	6.849713213262653
Encrypted:	false
SSDEEP:	3072:ksXkOtNYBVA3e7frDwg8AHWOy5y9EsVFh41vl:iCNYZ7fHwDO/E/
MD5:	D559FA36DC7C107E9B421C58FC4B8DB4
SHA1:	C91449878FDB475A1836970ED1BD13D4B37A1F79
SHA-256:	EF6C1683AB433F2B6B246D73696445DA0699544E31E78C023E07F86800127C6C
SHA-512:	D6D58E547EF83A1AA152376C82B7592A7C8799D97AF957ECAA31B90AE0D27C1E8D93867F8C67EF69C166E1AC3801A8B3886ABCB2788E1F34D4CE6515B6DFC11D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.....n........................@.......................................@.................................................d*...........(..............T...............................................................H............text....m.......n.................. ..`.data................p..............@....reloc..............................@..B............................................................0.......................\|...4.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...p.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .p.a.s.s.i.n.g. .d.a.t.a. .b.e.t.w.e.e.n. .p.r.o.d.u.c.e.r.s. .a.n.d. .c.o.n.s.u.m.e.r.s...........C.o.m.m.o.n.l.y. .U.s.e.d. .T.y.p.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Overlapped.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.717359362755196
Encrypted:	false
SSDEEP:	384:WeBxHYCHkXuHVmHDHrW1HWn+sBlHRN7hW/P/R9zVtp:zuqAtjhSPZ9z3p
MD5:	DFC3E599908DFE10350E526FFB0530E6
SHA1:	066F1BB7804113C3DE268AE7177EC4C712DD5A0E
SHA-256:	BCCE9F55958945CA0FB4749F6BFEA8851B316ED54DCA423C9B2E52E290F982D9
SHA-512:	37509C698843F49B768F59712F002C6FE1CB09085DE0F34ADF44F65BA054052F066A4CC6FEF7ED9F4597641184AC96297A82F793E7D6E11372F2B394B0DDAB54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............n... ........@.. ....................................`....................................W....@...................(...`......\)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P......H........ ......................P ........................................=.v.>\|.:..q.L...9....),..m...A...3.w.{..EY..D...L\|......J....k../.b4....[e..[....u./.+.I..s...J~T..X...2.s.0.A.^....3BSJB............v4.0.30319......`.......#~..x...H...#Strings............#GUID...........#Blob......................3......................................................4...........7.......c.........t.....}.......c...V.....{.................9.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Dataflow.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	450200
Entropy (8bit):	6.8438291097274995
Encrypted:	false
SSDEEP:	6144:bSRAcJZPnKJ8bLkJkPo9VYvxi7AlmbExvOnjr0flX9bu/L2SJomWvfT5v3Pjm9Yw:MZ9xvsr8lXBdSSnb5v3aWJDyz
MD5:	FE482F97D76BD12BAA3A6B3F45350941
SHA1:	3959804D31A7EC1A2E2C5B0D93C373A48188F63B
SHA-256:	F65552567790D03898DAF3088DF0FBC20321F78A6A9D9C18D392823B2CB84717
SHA-512:	903A4A5173B0273AB3558D9BB095C267033067E338AC477C17F01013E67E3D7D1387B66E1B5F42B568E64E22ED6BD2401DF9C173F4D68214B128A5923AF33425
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..............!..............................@.................................<.....@.............................................h...(b..0%.......(.......>..l"..T...........................................................h...H............text............................... ..`.data...1...........................@....reloc...>.......@...v..............@..B............................................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.P.L. .D.a.t.a.f.l.o.w. .p.r.o.m.o.t.e.s. .a.c.t.o.r./.a.g.e.n.t.-.o.r.i.e.n.t.e.d. .d.e.s.i.g.n.s. .t.h.r.o.u.g.h. .p.r.i.m.i.t.i.v.e.s. .f.o.r. .i.n.-.p.r.o.c.e.s.s. .m.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.800457298051624
Encrypted:	false
SSDEEP:	384:1Xw05p091rcmHDtRoWvXWasBlHRN7lx/P/R9zVNT:1XbAFajDPZ9z7T
MD5:	F279D672CC8471716AA518D97159A56B
SHA1:	372C3CAFD881707503E4BCFA895201D5CAB85939
SHA-256:	CD6F2859AF496A207CA3BAD7E238168AEEEA25BABDBF03B23A3EA2CF1555BC3F
SHA-512:	342DEF210885CA6153F4A34D716859B9146D4D15303A942B4B3578F871DCFBC7C35A3A587FEC52FD875A67B89ABC692889E2A8FEFA849BDFF77B4F378380BBA3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....oM..........."!..0..............+... ........@.. ..............................\|P....`..................................+..K....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P .......................................W."...r........U-V...E.D.5.c#{.f.W[$....V...`57b...[k...\\.n...=......fH.f......9.%....>..(d..X...w.....-..A..b..I.d>BSJB............v4.0.30319......`.......#~......8...#Strings....(.......#GUID...8.......#Blob......................3..................................................z...v.z.....H...............G.......[.....[...............]..........._...........9................./.z.....p.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	127128
Entropy (8bit):	6.847619120330484
Encrypted:	false
SSDEEP:	3072:WNkmFxJ3LBzdQZ+qJg9S5D6cs91uReaZ55:CkmLjzKZ1RM8ey
MD5:	54A1DB04CA1D1F42031D7375CF35EC4C
SHA1:	E745984FC2BB4CF85EC7C6E3FB96C24204A06F23
SHA-256:	C4789D755D6FCF6DD9562C064737F05F21C6A8E47932CC536AFEC3EB3585D2D4
SHA-512:	E7662625FFDDC7E52364E900B30EB89C82C3324415A577B7F13F8D321A811217AD384506FD790EBF3EB407158489D8A9C315AF05108358811F8854834C4FC090
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@.E............!.........0....................@.................................3.....@..................................................-..P........(..............T...............................................................H............text.............................. ..`.data...............................@....reloc..............................@..B............................................................0...........................x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...P.a.r.a.l.l.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Tasks.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17048
Entropy (8bit):	6.704074183067625
Encrypted:	false
SSDEEP:	384:RiCj4AG3tNKHuqFsTH9W+zWksBlHRN7xZH/P/R9zV2:YCj4LNMu3sjxZfPZ9zA
MD5:	40ED792FD0D298A2A8386B9B1F42E3F9
SHA1:	D945CC421750BBB943FD52F58F1C5627461B8291
SHA-256:	7E7AA3596D6155BB84C2BD2E5D0A1CC8E7AB42EDFA932880ECCEF1345C6D5333
SHA-512:	AFB906B71E2A543558CE521E83863F802DC8BAF0882D3AE79E7A8B064382D792CAD9BAF8E1A7F1E8AE2D560F100C6CFDE9D5A266B77ADEC41AE764DF06842976
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V..........."!..0............../... ........@.. ....................................`.................................d/..W....@...................(...`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........ ......................P .......................................D...A..<6;4.../}ny7i..Np.g.d...........j..c..BA0.O%...o.G...v.....V....t........!2Y..D.q.$y..W.,.;8..E.....p7Y5L...5?/`bysBSJB............v4.0.30319......`...P...#~......\|...#Strings....,.......#GUID...<.......#Blob......................3................................/.....Y.........\.7.....7...u.....W.......&.....t...7.....@...........[...................................\|.............7...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Thread.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.740607619525969
Encrypted:	false
SSDEEP:	384:Qz2E3ZVVDMWx7WVsBlHRN7bTj05seyR9z0Vurc:GvBNjbTj05sN9zAF
MD5:	DE4868A8598E673D9A665115C8B94E4D
SHA1:	12FEB3ADDF70C0FE5F9785A01210CF821F08A8E2
SHA-256:	81C8741BE35ACFE3A17079E0372A1E05ED279E112CCF775577F6929A7F956065
SHA-512:	C0B34A21C80E8780BB9865B635465168BD4ECB44F48CDA67CB1E9A6F521B01A2241F75255F8E8B5C66626509065762535E1B9FCAA09473137347437B7AB51817
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}.N..........."!..0..............+... ........@.. ...................................`....................................K....@...................(...`......0..8............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..`...................P .........................................Bt...km....b..c..A.....s..5...2.......6...W.qq9.. .HH?0.\.B.G...l\|$.z.\|....@....d.).j\.Onf.h..3&.d.g.z...s..W(pn.9#..}BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................].........U.@.....@...n.....`.............y...0.!...9.!.........T...................................u.............@...........

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.ThreadPool.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.696919152030665
Encrypted:	false
SSDEEP:	384:AC92+RTYB0W1vW6sBlHRN7g0y/P/R9zVyH:AsYyjg02PZ9zgH
MD5:	267FA8B89DE2AA77EA5A87083F4C91C2
SHA1:	499BD2E2D259544C564EE13F2C8AC720A3502D8F
SHA-256:	4BB8643430D995E9138F5D31D63C0ED644E30369DD3A6FFDFAB9A87EA9E4BC8F
SHA-512:	F64BD9CA9D390CC11902F255C1029E8507E83CF26AA93F3F734FD315B736D2BD0CE60759F583D945262C8CC71540A07CC03CC762EE42C4A842E3B843F3085280
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0................. ........@.. ....................................`..................................)..S....@...................(...`.......)..8............................................ ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ..@...................P .......................................{OTG. ..V....ods-.....e....2.f.8k.\{.-c.A^.d.....b.......kLw......&.t...O.[..0K..8..B......*3t.{Jf.<H......."..GQ..........<BSJB............v4.0.30319......`.......#~..d... ...#Strings............#GUID...........#Blob......................3......................................P.........7...........P...........{.............................6...........p.......................W.....d...................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.Timer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.7949851895397595
Encrypted:	false
SSDEEP:	384:9Pf6ZuqMH2HMWMWeCW9sBlHRN7o9j05seyR9z0Vuq:iuz2eSjqj05sN9zAD
MD5:	AE5FE0B45645C6B1907E604E2F8C2574
SHA1:	31A0988F3466652FD9F60555C91EEFA59D1F94CC
SHA-256:	DE93FF9000EF454431224F7C9B069C8D0A81B732B31C5010D435D028D811F8F7
SHA-512:	ABAB0C78DBD598FD27CE67B1704C68995D0A6507999724DB1AD3DC8B3B5AF7899A4CC4CA97E2BF59F8CB4F04D219C362C5814DDF155A438AF957D6F543E2AFF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............)... ........@.. ...............................P....`.................................P)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .........................................n..A.!i....b...]A.{&N.D.;...A-;.@....... ......D..%h.?H{.3.d....e....iO.@.u.....Q.OE.}.. .}yp.}....$f2n.f.......qn...!CBSJB............v4.0.30319......`.......#~..<.......#Strings............#GUID...(.......#Blob......................3......................................(........."...........;.y.........f.......C.................J...!.J.....J...[.J.....J.....J.....J...B.J...O.J...v.............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Threading.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	77456
Entropy (8bit):	6.624439341806387
Encrypted:	false
SSDEEP:	1536:yHyOW9S1nflDZeA9DwubEfxdyJl/aV0sqOxnXzuu:yHrNflDZeA9DwAAxdyraqYXp
MD5:	16D703FED19429F79C9AF3363C3B1DBD
SHA1:	6146F57BB6BFF3CA883504A94A569F91B667E587
SHA-256:	F5FFC4F2A63DCF26CE48A96AF11762B9420B44974455E1362335854ABC7FA5D1
SHA-512:	016F6169B296807204B3C666104C521E9EFC7D6C331D5D75E26E7846D9FE1407CE87527D0B121EDDFC6075A5CF006D0C1D7AAD9781CBB48DF7F19E24F641BE76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l}............!..............................@.......................... ......%u....@.............................................`...X#...........(..............T...........................................................`...H............text...v........................... ..`.data...............................@....reloc..............................@..B............................................................0.......................P.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........h.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...D.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...T.h.r.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Transactions.Local.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	317080
Entropy (8bit):	6.699561403157516
Encrypted:	false
SSDEEP:	6144:mvVrWjZj9EZR1MheyB/sQMyM6AIgTkhjE3R4ak:mtK4yB3FeTkhjH
MD5:	491282599BD60D601B5F44560B42D901
SHA1:	7FC399B512B5CAD305C0D3AD71BE1ECCC0F3B174
SHA-256:	6D529D7770A232C4FA062F930E39D593FA8F2B114C333999E3A207D968C20FF2
SHA-512:	96D438DD7AB405201A6A70E630E3A842383FC5DCBB306B68B4932BE58BB20AE61A0FBA679C78B47C8B506A637933B6EAB93DA0AD44ADC859BFFAD203FFD4BAB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....D...h...............`....@.................................\.....@..................................................N..`........(.......).....T...............................................................H............text...6C.......D.................. ..`.data....<...`...>...F..............@....reloc...).........................@..B............................................................0...........................H.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.r.a.n.s.a.c.t.i.o.n.s...L.o.c.a.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Transactions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17024
Entropy (8bit):	6.661718841639272
Encrypted:	false
SSDEEP:	384:7EuFRDGlWtiWfsBlHRN7rG2teR9zboQLS:IuFRK0ojrG2tC9zU
MD5:	0DAFE9D3DD39479062AA66D608F6507B
SHA1:	6E05FEA155D1004D711B0E0D6505F8F825B7CBA8
SHA-256:	F31C09AC2EF611E75DC50BE47C1ED7239E018F957A19D135BD6AEA4BD76A89F3
SHA-512:	226235BD2FC90CC63F2131FC439BC9FD1DDBA0E45D0705758FB13CAE99D2A00D899CB011249E22839788C2563F9539BA16763DC11176CC3C6A13930DB6932173
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....l..........." ..0.............j/... ...@....... ...............................Y....`................................../..O....@..t................(...`......8...T............................................ ............... ..H............text...p.... ...................... ..`.rsrc...t....@......................@..@.reloc.......`......................@..B................K/......H.......P ..h....................-......................................BSJB............v4.0.30319......l.......#~..d...4...#Strings............#US.........#GUID...........#Blob............T.........3....................................$...............f.O.....O...^.<...o.................H.....*.................+.......................r.....,...........D.$.....O.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6...y.6.....6. ...6.....6...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.ValueTuple.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.7985546651943585
Encrypted:	false
SSDEEP:	384:OuRCGcDUJW/GWvsBlHRN7BQwojGlD/LVNSR9zukdf:OuRwR8jBrxLVNe9zLdf
MD5:	D9AFBBDED4E0AA27572AFB6BE1EAB2B2
SHA1:	0AEB8C9597CBB0581AF07A18E84D61C3D1E3B5E5
SHA-256:	B253EC5BBAC7AF7D2258D6E3C51A1ADBC3C5A710590BD8B9F9C8E00EA6ED4962
SHA-512:	2676B9B3242509873086C99ACB8E461CB16B2528DD5572E994E88586013B925DEF61EFC5698A2259FBF8929BFD320E9DE3D0357A44983AC5309720D298934B43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^..........."!..0..............)... ........@.. ....................................`..................................)..O....@..d................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`......................@..B.................)......H........ ..(...................P ......................................:..c....35e.F.)...$.T,........=.*.Q/m..'N.v..p.qxy......h.:E".6FJ..j......-b7...(...1u6s........".bV.$E.6jL{&?.=..B@}..fdBSJB............v4.0.30319......`...@...#~..........#Strings............#GUID...........#Blob......................3......................................]...............%...................C.....s...Q.z.....z.....z.....z...4.z.....z.....z.....z.....z...........i.................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Web.HttpUtility.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51352
Entropy (8bit):	6.89113207196561
Encrypted:	false
SSDEEP:	1536:qqCOfvmE8AHyYQk7Y35tiPXysSA1hTFpxzP:qemEHSL5tvs7TFLD
MD5:	BF33E4D217C79F74EF711283049C4FBF
SHA1:	AE68DBB458337CCEC2FB104FC8FE73CD8F069E64
SHA-256:	BAA7E57E5ED850542FA914A90C912DBF0EEA5B4AA62518BDDF461EAEFEBBF174
SHA-512:	723B93C4479EAD60A8909540FB1F8506FAAB0D6A15544BDB20D45F70F8CD21611D7F741B5DE75D5CD41D583C9FD6AC6D2703FE9006EB6D32E37A9E9CE4A59030
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..............................@..................................S....@.....................................................h........(......$...(...T...............................................................H............text............................... ..`.data...............................@....reloc..$...........................@..B............................................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.e.b...H.t.t.p.U.t.i.l.i.t.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Web.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.6987294925490195
Encrypted:	false
SSDEEP:	192:sE3Zx2ID+8Who9Wg5Wo0A2j9seHnhWgN7a8Wnn5JVOYOg8nK4X01k9z3AvkTdh:sETNDTWho9WOsBlHRN7wnnVOY/wR9zQm
MD5:	EBF770D88E31A8E3B736A02B02CEA2B4
SHA1:	78A5B45BDDF3D5A277E7F8B464421330662D11B3
SHA-256:	275B89C808E47D731F5D19C6FADF11DC2BD139DF458F952B1644FF01B428FE9D
SHA-512:	CDD525F1B0220D1B678F78603E5D530B80EB9C76E4A3D957D5A28C344AE5580480F0E684429A45A9F75988E6A48FEDFE8894DD4F77F9CD3DDCA563D691D59E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t+..........." ..0.............z... ...@....... ....................................`.................................%..O....@..4................(...`......X)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B................Y*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....0.......#US.4.......#GUID...D...D...#Blob............T.........3....................................................6.Y.....Y...X.F...y.......................$...........o.......................V.....l.................>.......Y.................@.....@.....@...).@...1.@...9.@...A.@...I.@...Q.@...Y.@...a.@...i.@...q.@...y.@.....@. ...@.....@...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Windows.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	6.665057805027919
Encrypted:	false
SSDEEP:	384:WhaMth0rWmSWssBlHRN7CsRmuTcR9zusMco:x0izjbRmuU9zueo
MD5:	DEE5C019170B9F56AAB852D0DD224131
SHA1:	101918825EBE8893E0283C28394C45A50900C557
SHA-256:	B8ECD8BE58C211608FF4F67CE27832C1F40CEFD422C07A92AC2851DCD442EE07
SHA-512:	DD2F6638C7CB698DE6001C97997398EC56610D35224395648C8727740A42191F521A061CD83113E7181905AD2BD933DAFE33F495C45EE69DE8BCB3F12E69263F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h............" ..0.............,... ...@....... ...............................m....`..................................+..O....@..T................(...`.......+..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................,......H.......P ..0..........................................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......<...#Blob............T.........3......................................................Q...&.Q.....>...q.......D.........m.....y.................P...................................4.............Q..... ...........8.....8.....8...).8...1.8...9.8...A.8...I.8...Q.8...Y.8...a.8...i.8...q.8...y.8.....8. ...8.....8...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.Linq.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.653880720762548
Encrypted:	false
SSDEEP:	192:RM0ZhWIWJ4WDqWo0A2j9seHnhWgN7aEWTNDvWrkAmSGL16X01k9z3AvtFpWs5vH:SkWIWJ4WssBlHRN7MLMB+6R9zctFpP5v
MD5:	CC552FD613AD1B8B4E0D7BA898E811AF
SHA1:	97B54A94BABBEC01644265D25A19ECA4E2ED60E1
SHA-256:	155784690475960EE87D5071FE4C0CEB9857C1232970E8B16A40D7376C24B664
SHA-512:	3714B2DCC6890CB55FBA8987970445E7F68524C45340F8D732081DD26D9E13D3CFCA527A92F16989C69A35955990C2C8AA6D8B6793719F875A2B6A8F2E9E1900
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...xe7..........." ..0..............,... ...@....... ...............................F....`.................................{,..O....@..T................(...`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................,......H.......P ......................$+......................................BSJB............v4.0.30319......l...l...#~......<...#Strings............#US.........#GUID...(.......#Blob............T.........3..........................................f...........+.....+.........K.......;.....z...d.....p.................G...................................+.......).....+.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22144
Entropy (8bit):	6.3523929193239415
Encrypted:	false
SSDEEP:	384:f125qkxK67ex4FCquEWhAWYsBlHRN7tdvhVOY/wR9zQM:dKLVudjfJ/M9zF
MD5:	F46360F6FB77BF295307CB4909E2ECE5
SHA1:	84B85C5D9C71152717446BD2B09034F5C32F3CAE
SHA-256:	6674FD55B30D240B9A8C69D830D09A584F6F8797E822C620CD0FE77B7EAFBC49
SHA-512:	41564E533F118779A31CA3AE43C72B624C30F43DC3A518667EF31C1356AFE56CDAC6AF51464F4A3404BBCC418D5376E359AC7FEEAC80A018443B23D251E86AC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............"!..0..$...........B... ........@.. ....................................`.................................LB..O....`...................(...........A..8............................................ ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........ ... ..................P ......................................:._.@.1.v?).7.jC..8.....p3..........y.."Y.h.;...'\|!.<hq..P........kr...F..g...R.f.).X...2R.;cs.]..+......E...c.?.X\..!BSJB............v4.0.30319......`.......#~......8...#Strings............#GUID...(.......#Blob......................3............................................................G..... .......b.....i...f.....-.........................................[...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.Serialization.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	6.724023578356653
Encrypted:	false
SSDEEP:	384:HJrLW7HEqHWusBlHRN7QbVuwBmfWojR9zuswU+jYb:HdkHEqmjQifWoF9zux6
MD5:	8DD065F6A7E8B8A127B491F68E53C551
SHA1:	8E1C6B2A6766492B31F0E455A5BEB8E5632AC203
SHA-256:	446D8C8935762BB1DBE779A6F919504464E10C69796053ABE5847D34B56C5C27
SHA-512:	E6F363F59520E4557DDC248636CFD26ED83A47162E7C63B67E014BE6C1BA791B1CD1587D1B101B173CF2049B6ACE03F26762A5BD3FF1DD140A398DBC94D3A1F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............." ..0..............-... ...@....... ....................................`..................................-..O....@...................(...`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l...x...#~..........#Strings............#US.........#GUID...........#Blob............T.........3..........................................p.........$.F.....F...r.....\|.......<...............*...........]...........0.....M.....D.................s.....D.....x.F.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XDocument.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16016
Entropy (8bit):	6.7547297571555625
Encrypted:	false
SSDEEP:	192:HMexpuWkdWlWo0A2j9seHnhWgN7a1W4ZDqF9e+X01k9z3AzsJYUcdho2HLso:HppuWkdWTsBlHRN7Ie99R9zusTzMD
MD5:	785F1CC57FC01CE2081C2CBFC75C88DD
SHA1:	D011D63A7D7EA3B09F3F05872A0465556AC83D7A
SHA-256:	E48704F5D971D7AF44641098BE6F2152DF2CFD6664ABCC809443DF4370DB9086
SHA-512:	6947911A1E607C0DD4930BD66A154D1704AD21C1D4D940323ECD60252243C2DD169A31DDC5BFACA659A023D116D3A3D64D2259CED28FD57AF8C38A53F2153BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............+... ........@.. ....................................`.................................H+..S....@...................(...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ..........................................9.....(....r.a..To.i.n2.....&?.@....e..Z.FG..pR......w.._T....:)....G.SR..v..ms.V8...Kr...C......4a0IPM:......V....<BSJB............v4.0.30319......`.......#~..l.......#Strings............#GUID...,.......#Blob......................3................................................L...............................8.....L...p.L.....L.....L.....L.....L.....L...l.L.....L.............................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18072
Entropy (8bit):	6.601798224853122
Encrypted:	false
SSDEEP:	192:vWaeW7pFAcXexQfhGqxBb9o8Wo0A2j9seHnhWgN7akWJks9gICQX01k9z3AFMdYZ:vWaeW9pkTwPXsBlHRN7q/P/R9zVS
MD5:	36C70F32C57D4A05C8A3A66A85ED9E12
SHA1:	A454C335E6E4F73B68204062FE7C3A58D690015C
SHA-256:	404AAE54105E09EF16EBE8B8EC59CFFA817F70B24B1A87DF52C592403C57241F
SHA-512:	C5A6025D9C19A49ADA2218B31A49F57A776085817589A2F4B4BC32A8004F35798368445532C0149E4D9D8BDA76BCC80C7FDD326388A0D5C3F49F5E93DC43E432
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Vh............!.........................0....@..........................P......\|+....@.....................................................0........(...@..4...D...T...............................................................H............text............................... ..`.data........0......................@....reloc..4....@......................@..B............................................................0...........................X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...X.m.l...X.P.a.t.h...X.D.o.c.u.m.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XPath.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16016
Entropy (8bit):	6.7063125277359585
Encrypted:	false
SSDEEP:	384:khlkiAiDaWgvWgsBlHRN72/pQtR9zus7M:2iiogjyQP9zuP
MD5:	A3E896B9754EE12820FE8B57E3ED176C
SHA1:	CA3A7759ECC4D80CD1312334B274A186E84BFEBC
SHA-256:	2565B6225295B60D2D1CD850D5E34E0F307F7A3CFFE0813C603B5067A368ADE5
SHA-512:	AB9F75C970721C38CAB7CE78242AB9B256B48EC73B103024291EF72FE7AECB1A7A39427247A926AF809A6D7E086CB8F02B7EC3338894CBD8D1A157D1B75B4309
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1#>..........."!..0................. ........@.. ..............................."....`.................................x..S....@..d................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................I....o.A.U.."N.oS.e...aL.....C.l....[u.>.~.....d.%k..Q......../;,\|....o...8...gkAB.....f....L.....\|F..%...y.7?....].f.rj.a..BSJB............v4.0.30319......`.......#~......\...#Strings....X.......#GUID...h.......#Blob......................3......................................'.........C...............................d...%.{...g.{.....{...\|.{.....{.....{.....{...c.{.....{.............................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XmlDocument.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.768033916188262
Encrypted:	false
SSDEEP:	384:VBTGfM1iWusWDsBlHRN70wMLMB+6R9zctF5TaHaN:LTG9Sj0wMos29z6Ta6N
MD5:	C6BBB248590C790B26CA8512D9F53A68
SHA1:	E78637FDFEA737406717FCE4337EAC4BC76C3CBF
SHA-256:	EBA17E729D1CCCB4AE3629844C27589F5C730B911DBE25F58F596BC11F3D0480
SHA-512:	D3561CBEA2A83EFA581E1368E3AF4705A9577E2DFABBD9EB6AA190E623D816DA069B025DA81A21C5B06B1FE02767D539D981A882409DEE0DB9671FFC36302E14
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.L..........."!..0..............+... ........@.. ...............................^....`.................................\|+..O....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ...........................................a7DM.U3`N.#{$N..VR.y6(6.l.}0.B.Z._:..5Jd.....T...2.N..d....(...2DI.P......dg..&0....?.rM.}..~I#..g.^@>....../9DP.t..ZBSJB............v4.0.30319......`.......#~..\.......#Strings....H.......#GUID...X.......#Blob......................3......................................#.........P./...../.........O.............\...2.....g...................................p............./.......................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18048
Entropy (8bit):	6.60350795816892
Encrypted:	false
SSDEEP:	192:shgsJNT4xhE9+WYvWR8Wo0A2j9seHnhWgN7a8WCvPAJVOYOg8nK4X01k9z3Av0E0:s2uWhEMWYvWgsBlHRN7lPkVOY/wR9zQu
MD5:	7C9D617371A55759311602E2EA088F1E
SHA1:	E3AF240CB6C7DFE0FF491EED87637367E0DFD1F9
SHA-256:	D4B25BCF03BB6B78E7E0D422C2D78D699F1F8734517616D299FEC714E75B1617
SHA-512:	000BB390234D95848099EC21C6C7F113718CFA0465644345A6A49C0C845D16AB0C35E85E23A8458145754ED484D49207E5BACE5959628B5B52D5F7B5DBCEEC98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Qph..........."!..0..............3... ........@.. ...................................`..................................2..K....@...................(...`.......2..8............................................ ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........ ..L...................P ........................................"..e..P4M.AP.o..ss.0...0.=3...8....Q9.I...X.3&.i.TqN...Cy..3...~.: Lz.%.^....0.........L..G.{...c..*.1\|...7....Q.G<U...6XBSJB............v4.0.30319......`.......#~..(...p...#Strings............#GUID...........#Blob......................3................................J.................................+.....F...........N.....H.........................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.Xml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24720
Entropy (8bit):	6.199440055401682
Encrypted:	false
SSDEEP:	384:uV/Mc95qohA8bhUVGhvO2WGjsWHsBlHRN7qE3X+R9zusxnxzr:uV0chOEn2jhXi9zu8xX
MD5:	96830FCEFF554800D3275954B5E7800F
SHA1:	F73355787EEE2CEF59763E9B0111E8F6B9AEBE6C
SHA-256:	14F18485B677FEFDA2C5F890DCD5754CF30179C2B46635F095A0E8F79BBF7E23
SHA-512:	90DAD1D75A2A63F579FD5ECA8EB399621A6984326E6FF97C5E7ABE4A24D8577FC79AAADE8E8F6D5DE940FECFB89A49E7ECC8FEB496853B5F779FE197116D72D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............L... ...`....... ....................................`..................................K..O....`..4............8...(...........J..T............................................ ............... ..H............text....,... ...................... ..`.rsrc...4....`.......0..............@..@.reloc...............6..............@..B.................K......H.......P ...*..................hJ......................................BSJB............v4.0.30319......l...@...#~..........#Strings....L'......#US.P'......#GUID...`'......#Blob............T.........3..........................................P............... .................k.....H...........S.................G...................................+.....m.S...0...................x.....x.....x...).x...1.x...9.x...A.x...I.x...Q.x...Y.x...a.x...i.x...q.x...y.x.....x. ...x.....x...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50840
Entropy (8bit):	5.735256697651133
Encrypted:	false
SSDEEP:	768:2vuoy1c6A2ZX8TRNH5JVbOd502zq1TntV6fjrhTNx9zz:2vuoO3ZX8Q5jzC36Lppzz
MD5:	DE0A04432245A6F4D1BC898B2A0D448A
SHA1:	9BA069F381D304917B619B071D6C6B6F2719EFF5
SHA-256:	60D24C5223E513AEDE08B2D80D2BEEDCB7618E812568B85FD3585B0A7E01B377
SHA-512:	8A8B1967A0930093D39F3E33FF13CD7B30EC8000FB87CA894074B279B49B69AC157A0E189FEE2EB5B0361197EF764220BFFCBF0A9A38232FC6EB077DA86BA2E2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\System.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.....................................O........................(.............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ......................`.......................................BSJB............v4.0.30319......l...$;..#~...;...R..#Strings....4.......#US.8.......#GUID...H.......#Blob............T.........3................................/......................=.....=....J=...=......V...}.....h.. ..... ..... ..J.. ..... ..... ..... ..1.. ..j.. .., AF..a.AF.....R..e..=.................;.....;.....;..)..;..1..;..9..;..A..;..I..;..Q..;..Y..;..a..;..i..;..q..;..y..;.....; ....;.....;..

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\WindowsBase.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17024
Entropy (8bit):	6.665328569486409
Encrypted:	false
SSDEEP:	384:VpDduasEWQAE2WVcWqsBlHRN7+vLMB+6R9zctFw/C:VpdJnf7j+vos29zDK
MD5:	9FB16B590D40D12D5D21BBE9CAAE8078
SHA1:	027DAE80E0A6C67F88FD42B1023921BBE07E6C22
SHA-256:	EF4A50906888AF2BDBCFE2EDBB9E4A313F6D3FB6F025B7BAE8F595BCB1C2C5B8
SHA-512:	049B4F4E05877058A6D4BFC770FCC8208FB64ECD2DE34796139B08213985F9B5C5A6C6324BF1F4FBA1667FC35380C7F1B39C466469719AEC9743148536B831B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i............." ..0............../... ...@....... ...............................>....`.....................................O....@..4................(...`.......-..T............................................ ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B........................H.......P .. ...................p-......................................BSJB............v4.0.30319......l.......#~..$.......#Strings............#US.........#GUID.......D...#Blob............T.........3..........................................f.........3.................'.....0.......v.....................l...........I.....f.....S.............i.....i................. ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.61377836696546
Encrypted:	false
SSDEEP:	192:ZsxEWvhWTWYnO/VWQ4eW+SZ5CDqnaj8F0qzw:ZsCWvhWTUjlAF0Sw
MD5:	A66B267FA68F9359AD73580F9B093153
SHA1:	A159FFAE590F8D47B4748A5A82AAFD2D656CB6B7
SHA-256:	8999C2F6FE64D99BDD26A0663CF8A06ADF5B0B8A08D408349611753E924E4BF3
SHA-512:	2EA48CCCD477C5B2E7DF421987E068088820A56AE83D7633FC42CC1AA84AB49959E4F9B08B4638D7D9C98D4FA05BF37A6C70CC85478A7F5EE0060E2DEEE478DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....o*B...........!......................... ...............................@......O.....@.........................`...+............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.660636539452411
Encrypted:	false
SSDEEP:	192:NuGh80WvhWuWYnO/VWQ4SWT6QfX80Hy5qnajsBkGQ:NugWvhWUUVYslEHQ
MD5:	734E965A9E9F046661D235E2F85C1641
SHA1:	2F247B5023C397BCAB2A3F1F9F5689C8BB165AC7
SHA-256:	DD3E0DC1E5A98F0B8FB90D8898A464B2562B11BB2905BD8AA4E9AAB8F93E9E5C
SHA-512:	10A7B3178792386A9EB9B0699C5605C652F63DB9C7F9317AD6DB0DB37BB26412A16AE8E3F70AF152146F093CCDD300A5E559772F507AE2FF9470A3579193F595
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....$=............!......................... ...............................@.......j....@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.618904716069637
Encrypted:	false
SSDEEP:	192:waWvhWDiWYnO/VWQ4SWLNYtkqnaj6MtTl:waWvhWDYUWlWMRl
MD5:	41E0E8F317014F7FB00B82D29A4190F3
SHA1:	0E3E38D714320210ED30E7FAB3B680CE5275545B
SHA-256:	9D71DA7A8F8FB4288B3EC612D8153705DA2F80019334803FE60628233B93BB2E
SHA-512:	0D3ACA78A404190133FE5609CF43FF37AD5B310D28A8F44EF491AB60BBC063D61D3D29CA9AE6A65CAB4D52AB26B24EE8CC48ED264ABE3F51EA58D6798C37A96E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...34C............!......................... ...............................@......_=....@.........................`................0...................!..............T............................................................................text...p........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.623210670580151
Encrypted:	false
SSDEEP:	192:7fWvhW4WYnO/VWQ4eWqRX/nRhiiQqnajToH+DF:7WvhWmUFRhKlgH+D
MD5:	878FA5D912DCCED530ED2E32B2DF0EE4
SHA1:	08E0FE9709B769705D18A8FEEF047C98D1C7D4E5
SHA-256:	ADD3969501CD57C2E159E8F73F12A74D927EC96A3CA1FDEA24B255B6429AAC38
SHA-512:	50C86B53E4948B81A53FEBD24AD185ADE5176A2DB38F5E78DED202F71EBDCEA0D2ACA4907EAF0BFE00E0392EE988ED64E4249150074ADC741564C67E311200F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...{........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.68058760201623
Encrypted:	false
SSDEEP:	192:rTYimxD3/WvhW7WYnO/VWQ4SWrnd4iGtkqnaj6M1:rTYi8WvhWbU04glWM1
MD5:	C26D4AE5DB8C917C2C17000A2B67D664
SHA1:	CE4ACD2DFD379B566C2AAD3534AF82809B02B6FB
SHA-256:	41C585A0A71D6BFA24E952E98A7AD20E5170BF66B4DE06FFDBF15F899512F218
SHA-512:	38EA2536B0FEF37448AD11105B76208EB3EA40DEB378899CFF547ED6BE8385E5003F4BE253082170DBE0CEBE2855C885D75820A7E90CCBD62B41E4EAA7BC551F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......L...........!......................... ...............................@......).....@.........................`................0...................!..............T............................................................................text...&........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-fibers-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.60317892765155
Encrypted:	false
SSDEEP:	192:otWvhWLWYnO/VWQ4SWLrwN8uUgxfzfqnajmyY3zF:KWvhWrUSIrlSpR
MD5:	E91E92BAF545141C6A83AD0ED945B70C
SHA1:	EB77FBCD7A4A748E8E7CBC81B1CBFE7FA5F285C4
SHA-256:	1A25FC1A1E26AC630F7B1A8D26A1AB5567A83860802FF14DAD525E73564F0FE7
SHA-512:	6DEE748632614952566D7F0F7A9201CDEAC33DCE5E958C96EDDE3E05171FDB82B5C6AF8B2DE56210323C6A3F7647DB8E3127D3FD5243054B1C12D3AEBD92BB93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@......R.....@.........................`................0...................!..............T............................................................................text...H........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15304
Entropy (8bit):	6.570258552899837
Encrypted:	false
SSDEEP:	192:oUSYPvVX8rFTslWvhWJWYnO/VWQ4eWolzNcA5E8qnajCOZ:1PvVXXWvhWJUxzNx5E8l2O
MD5:	7A6B7DFCF35130FC046D53DA825774D8
SHA1:	112FE3C6F3CC4CD34F54AB084A6762528552F22F
SHA-256:	0F3A6F749B7D56C0462F7780945BE75CBB475627D5A037FCB0F3816127FC8766
SHA-512:	0F6382EE0A38D8627204FC327B86139A86F0F23923C1E428D618D1E58BCB594E654EAA001FAEAB3EB3941020DAF49E72E90CBBEDFED29306236238384B3AE074
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M............!.........................0...............................P............@.........................`................@...................!..............T............................................................................text...g........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.6422994581271775
Encrypted:	false
SSDEEP:	192:YWvhWDWYnO/VWQ4eW094RGV+9N8qnajwJpXmU:YWvhWDUd4RGVhl8JpXmU
MD5:	2F3ED68E88962A3DB91FDDFF116043C6
SHA1:	F89F28CD1A2AFB247C483EC5D3373687ACD9F0F3
SHA-256:	94285B076BC56F70B600340CB8E462FA860745A4E259A01A5FAF200365B626EB
SHA-512:	99965F02106A278CCFFA953849546008595A38EAA21E81F6B72D8635931B6E32BDB44C96E4ED52DF374ED765138FF5E2A97D6DD1878E9BB062D7D5B7332BD247
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...@.E............!......................... ...............................@............@.........................`...L............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.744886998989738
Encrypted:	false
SSDEEP:	192:bnTWvhWRWYnO/VWQ4SWcQRJ8uUgxfzfqnajmXYk:PWvhWRURIrlSIk
MD5:	5EE963BEEA8AB70E4837B3DDC3DFA780
SHA1:	08D253B2D5D44F4F01C5C8CD32A53202F46EA050
SHA-256:	7EC7FF7C30D637A2B2BDF202BEFC401D9840BD38AAF10633C7CBF03AAED80BA3
SHA-512:	C1CFC308A25196C1661E579F270AEBB40685FBB478590BE155A65CD79DDA03D70EF53211FFF6E1FC0C07B620EA92E05DB8529B707C41E0AA7F3F82F23D764FDF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...X./^...........!......................... ...............................@.......O....@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.650187605022896
Encrypted:	false
SSDEEP:	96:0aZ/d+4rTJGEWvhWwezDEs3fDHDsQYQ6gLgmVeDD0ADEs3TDL2L4m2grMWaLNZDC:bWvhWmWYnO/VWQ4yWZjOk9qnajNA1wGZ
MD5:	590C76A79CA08289A7987DDCA5021A63
SHA1:	DF1D7FB7F622EE3908C8089E9AB9A6EAA88BB042
SHA-256:	5488EB4CF58105F969A89A8D6965F26DC77493D6C38F13D8C1C3920A8CE89AE8
SHA-512:	7B9BAFD8ABB9CCCFCB29BA8F9C78A7824BFBC60B6E3680060AD3F261059CA5C513242ACB487940E3DCF33C706F2A5AA509B2E616DDC10131F3E0045540FBF412
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@............@.........................`..._............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.597098241073863
Encrypted:	false
SSDEEP:	192:ulCWvhWcWYnO/VWQ4eWx4Iia4RGV+9N8qnajwJ6m:ulCWvhWKUAR4RGVhl8J6m
MD5:	AB886001F13F3200B602DA3911DC6BCA
SHA1:	B38BD2310BE81A381ECD160FE60A5763FC39AA8A
SHA-256:	DBD440820B52AC701D190B011CC77BA8733E0C72DB319FE6DC9B275011CE2360
SHA-512:	DE7D2818BDBA08BFA8D2C6A060D9B086D18CBA73EAF912A758F71656F4752B320DB14A72FFAE9CB4BF8546B35F94EA14C93E68ED2C2AE45736120C34A3DEEEE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......0...........!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...h........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.638668525799035
Encrypted:	false
SSDEEP:	192:P/YsFAWvhWuWYnO/VWQ4eWZsxhiiQqnajToH+JWF9qv:3YsFAWvhWUUZxhKlgH+4K
MD5:	64D161EA10E73AEC4C2FBA0D87D36340
SHA1:	FA2814B107AD3DAE5D58DFD21F299FC3A4BA5B45
SHA-256:	D13C0DE3C15C28296FB8CEF3A78BDD99402B52BBE47DC8F910D3A138CE4819EC
SHA-512:	1194A95597A1C2C8B2E8F67700E925221133F48B0B92D0A680B5593D73A02022B02AA47BC00A1AC4B68C483F9F710DB196A7A3D4AA852226BD08E6706F2FCFAD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...2..............!......................... ...............................@.......g....@.........................`...Y............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.604901535190525
Encrypted:	false
SSDEEP:	192:UxvuBL3BBL4WvhWeWYnO/VWQ4SWLa5su80Hy5qnajsBkjyi:qvuBL3BSWvhWEU7slEOyi
MD5:	827FFA70465991E720A36D394A011676
SHA1:	EEA9195BA54013B7BBD36AD4936550580C4558F7
SHA-256:	E72460E5C465B83DD469EC964A4B1707E16CAA80BE4D51977573DCFDB3841F65
SHA-512:	50BFFB83DA2FC5D79D6B31F63D20B5C7661CC03AEF766D6EB840E26CC9506597F25FF5F3019FAD0A89351C368085BC6DCB65B3C815020B28F4A517D4597E1943
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....p...........!......................... ...............................@......Y.....@.........................`................0...................!..............T............................................................................text...n........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14816
Entropy (8bit):	6.535590817199551
Encrypted:	false
SSDEEP:	384:jOMw3zdp3bwjGzue9/0jCRrndbNWvhW9UuslEaLy:jOMwBprwjGzue9/0jCRrndbKml0y
MD5:	1D309498972C67DB409BFF7C34AD30AF
SHA1:	0BC9A4D52E482129BB3E52AD6C6B12BCB3F9F27F
SHA-256:	2F0973102F1D2E78158E80B0EEA8A5F63085CB3088624227BC89C337DCEA96D3
SHA-512:	933380E33119A42DE01D06EA2AA9970F1DB5F3A9A9DCDD08D35E18ED6365F75B94CF3A146F11E6F3F3C8DA118F46A6224F3FD0E2C1736C9D667B948DCA794D4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Tv.,...........!......................... ...............................@.......I....@.........................`................0...................!..............T............................................................................text...'........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.636812879757982
Encrypted:	false
SSDEEP:	192:XlxpWvhW6WYnO/VWQ4eWixzhiiQqnajToH+/FR:bpWvhWQUXhKlgH+/3
MD5:	03DB11CE31048C8195523527A94C3755
SHA1:	3BFA91AEA60D2D99538E813EA4AB796ECCD21F77
SHA-256:	95D30FF537A8040469914BF830B3AA431ABA1C86B229C6AF31279938220638BB
SHA-512:	84548E68D69B20466A38363B67BDB9E566593C339AF562A39C3BCFE695022EC40C82E90055530F3236E2860CF61166D6E16752E69735EEFFA43DBBBA696C9F07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......6...........!......................... ...............................@............@.........................`...l............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.745904584672996
Encrypted:	false
SSDEEP:	192:UjWvhWKTQWYnO/VWQ4SWsCh80Hy5qnajsBkbM1/1:UjWvhWKT+UCslEWM1/1
MD5:	FD5886A8EE0B4CB52F271240F90E42FF
SHA1:	5DE86C3017091401BD4360902E2E5A184BABA7E3
SHA-256:	99D81E6596614E05D77D73688BC9FA492CF14E5FD72F33612380AA5D4A627C36
SHA-512:	F4995B7912A039B933BAB773D4E69CE88B67857D637E28DB04BE9B6DBF46CEBA534DF21504E2A0B57A60A80EF8BEB0DEA968774CD904DF03855A1CDDC6140491
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Nc6............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.610914265945029
Encrypted:	false
SSDEEP:	192:C7LWvhWKWYnO/VWQ4eW2m4RGV+9N8qnajwJdOmZw:C7LWvhWgUk4RGVhl8JdOmZw
MD5:	8FD7E2CE901C757598708774F2B94232
SHA1:	F83B900E426725D6371DC64D34A0FA1E5E7FACDE
SHA-256:	2851710E5B199C4D6E399D43CB00984A9E9055686D9C78FF43D5AD010C7BA6A7
SHA-512:	9A9023BD16ACBFF13C486B7B6AC7CE9C653A0E257A0F8B09816F92BE0D7C1EED71606FEE28F2B2E6314D954CE1B2E006E844BBA04FB6287A8510F2B482795E57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Q.B............!......................... ...............................@.......k....@.........................p...G............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14304
Entropy (8bit):	6.52723062493881
Encrypted:	false
SSDEEP:	192:mo/8uk1JzX9cKSI5WvhWx2WYnO/VWQ4SWLyiuUgxfzfqnajmgYm:mi8uk1JzNcKSI5WvhW+UYIrlS/m
MD5:	41FE1C31E12148C345F5C786147D4E9C
SHA1:	3BD930D1E9C46E4D0079CCF5BB3901F6565FF66A
SHA-256:	01602945455A1D6C79AE5EEBA3C8C85D712EFB549270C8E9D8C46716DCA0407E
SHA-512:	9696192D0271ACE94669EF19633122747E9521B99FFD6E818AEE0A53F7B7BCF23276F72AF6807CF4B2EF93148C35F9D261B80646BFCDDD8A62EF57BB3A7E126B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..../.............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...C........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.673798306874702
Encrypted:	false
SSDEEP:	192:eFhgDfIehWvhWoWYnO/VWQ4uWyshiiQqnajToH+lhFPtG:eFhgDfIehWvhWWUKhKlgH+lhfG
MD5:	3041BE8B8F3E2E99D6F7FAFCAF428648
SHA1:	9FF03D218278BD12FC1406D21D58F5C4DCA8E3C2
SHA-256:	7F1A83C6B5D0A856EA8C7952FD4C637A9AC7E663A620571AFDCEC7AF6C68A960
SHA-512:	DCB59DD2EBAFA0AC64FC35DBF6B9CE3C22BD857A93E64BD64B53C9C35DEC3C026B6D25C9A848968DD00CB8DD01B4B6755FA2273B540E1DB7CCFCE32A2A97F112
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../H)............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...:........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.596697118881818
Encrypted:	false
SSDEEP:	192:B+WvhWLkWYnO/VWQ4eW6tk4RGV+9N8qnajwJkm:B+WvhWuUjk4RGVhl8Jkm
MD5:	D02BD3ADAA95436F32E28EAEEE20BEE0
SHA1:	9D6BD84CD81E0F09934A1B08CE794FB08CD8DC81
SHA-256:	D043B50CA15CA801AAA825F39073D4A54D186E12CE36ABB6F72651C726133192
SHA-512:	944FEA823447138CD1091634579E2CEA4335B5EEE4C9E5FD218E8B6C6394B300ADE8B573C10E2B01DAF171C97C1DE1F1F74FB119559C8F93A2C4D0E91D895EFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...h..............!......................... ...............................@...........@.........................`................0...................!..............T............................................................................text...5........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.606677109476973
Encrypted:	false
SSDEEP:	192:xGtWvhWocWYnO/VWQ4yWyhSfvXqnajeCqxt:xGtWvhWRUsXlXa
MD5:	9416676D65F821608B4D381DCFF7BEC6
SHA1:	A39E5F7A812A169162362CF9ABF4D5E1C970CECB
SHA-256:	1C51A6692F8D4EEDF3FDE28ED7A94CB41FDFD39D96C9A230C17958D713215EAC
SHA-512:	66C2711AB7EBDF2173091C72B01CFA96815FC0AC0BE46D9E36651B9AD6AB98905E6447B1B454D7F3818F0D2FED98A99BDA94F36A5A05CA093DAAFBF11F9F0208
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....O............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...H........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.700617906232227
Encrypted:	false
SSDEEP:	192:BDU5yyMvhWvhWL5WYnO/VWQ4eWbS5wtkqnaj6M:FyMvhWvhWL5Ur51lWM
MD5:	1BDEA5FEF3C5A84CBE246A6D78D03C17
SHA1:	53D78A10C699FBF940C1A21F2108E2DC304F196D
SHA-256:	BF4CFAE8BB4E8DCE63BDD25DC45FDD02E3529BAE3D0BD5E2D00A6D4479E1F06F
SHA-512:	1AFA2E704A34960786CE7020A59C1DCD35E1DA79C7FAFBB08D27D437A78A623E4530695C46B4615541AACF71491270AB5E3C3546E86FFF2958E3FD1875957791
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...6..............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...R........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13784
Entropy (8bit):	6.598391100595922
Encrypted:	false
SSDEEP:	384:FdAdv3V0dfpkXc0vVa3WvhWGUu4hlxArs6:FdAdv3VqpkXc0vVaMdN4urs6
MD5:	476FA601902B6C018DA8C6FF0CBBF6BA
SHA1:	64C11D3EAD36423B53E66954C393B6374F5FE841
SHA-256:	60CA3E0ACA22DF8F03594D32F7EBF7F9A544FF3E07366AAE95BA19483CDB98B1
SHA-512:	2313335E9128315EF08527147983427675B73747E3D6DA390172B26F7CDB1CBE4C07B7984A28C8E842EDF357AE63F2C76E431C8741A2EAE15E966E9AD9E29877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@.......h....@.........................`...V............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.718477301219918
Encrypted:	false
SSDEEP:	192:d5tZ3QWvhW2nWYnO/VWQ4eWtvhiiQqnajToH+KkF:DtZ3QWvhW2XU6hKlgH+l
MD5:	E162B53FF1F872345471989D20374F36
SHA1:	232C1427096188E791AB0DB44BF309CBEFE20413
SHA-256:	3F61C83E3DCBE7F03195EFCBABD9FD1CA75EE6359828E45733A53CC1FB1183F6
SHA-512:	2D60D609CB281CD4F2FA1C6369D2F75AFA0D9F43DF681A5F42E85F51D5BF57BB4E23C8E041B3FBAE703706B8F82DB9D27D1F650CF5BB9088E4F222CE1734FFD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....dML...........!......................... ...............................@.......0....@.........................`...v............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.618608165391274
Encrypted:	false
SSDEEP:	192:ASWKIMFkWvhWrWYnO/VWQ4eWrAqhiiQqnajToH+lFXx:AvJWvhWLUVqhKlgH+lX
MD5:	B1C910CFDF6117FC45473C7C83756B95
SHA1:	4A62C92A507C9100CFB2FFF7238E2A1BA02F5D15
SHA-256:	701A1578E6B043021EA72F1ED693F92FF0219096A1011563E8BF0A1F0A2840DA
SHA-512:	B3300C7F20AC37151706AB44078E1A42C9362514DC15124F7DE80580EE53327C8CF4F410A15B7C84A6DDA059092C72936F3FD6325AA2C9CA8E9C78834782645A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....LO...........!......................... ...............................@............@.........................`...E............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.712155125402916
Encrypted:	false
SSDEEP:	192:QHWvhWL6WYnO/VWQ4eWxYYXsmsqnajd1G:QHWvhWLQU+Xs9lR
MD5:	A99DAFDD0EB1668AE60D4898338DBED3
SHA1:	504687E909F0730E3C4DB6EE14578B055E99743D
SHA-256:	ED383BC5365E2D9FF18C0867D4E2F8682CED6E45B0875B55CFCFB7BC87E6B301
SHA-512:	72AF70F554A66280D6AC53A0CAC342DC6E0B7FB8975757A404576101FD0F7445A1BCC8778FE5D7084F382A843710AF4C94A9FCB9C230931B0B8B5E5AD3DCFA53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!......................... ...............................@......$@....@.........................`...E............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.629521303917396
Encrypted:	false
SSDEEP:	192:SWvhWTWYnO/VWQ4eW/Hs4RGV+9N8qnajwJXomv:SWvhWTUX4RGVhl8JXom
MD5:	D1EF3AC0691175E3AA6631E328AAEE1C
SHA1:	72674755A67DECF82EBFDEA16A3900E28E976C1C
SHA-256:	CD1B70E44FCDF746A40EBD8DC028B6B91E8759362CFA9D79BC02BBC50D10D896
SHA-512:	B268BD64150C05B050FB00D37D464180966D874C32CB283CE72C8D079BF849C30E1AB59C534C6F8985D0DA572CD50351080C421AB7D8D66B25B4AC001A3BC40E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...^yk............!......................... ...............................@......B.....@.........................`...9............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.643933203250526
Encrypted:	false
SSDEEP:	192:ZXwnYmCWvhWSWYnO/VWQ4SWdLL1680Hy5qnajsBkGtd:7WvhWIU48slEvn
MD5:	843FA7BBB58F9C01498341BCBBA66C22
SHA1:	BAA1BC6157FB0E6392BC65C2B74D65E6481E539F
SHA-256:	B13CD1341057C9D41E54DA288FF4E491970A2FCF24CE0395B0DDB19F709B73F9
SHA-512:	A0224782091EEF732448277F51BBB9020B2E27E8209F0775A703E16001BAD8A9384CE10DE6A16E9D463111A913353675ECE52262197B77673BA6E4693305B035
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....2.7...........!......................... ...............................@.......1....@.........................`................0...................!..............T............................................................................text...P........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15816
Entropy (8bit):	6.454256458054684
Encrypted:	false
SSDEEP:	192:I21T7cy1WvhWFVWYnO/VWQ4eW7SshCDqnaj8F0s7k:I21Tgy1WvhW3UpsMlAF0s
MD5:	B42F3DF73D062DCF7C61EB3E455FE1C6
SHA1:	CDBA01951DE434F36B9100C7DB2316BD0728ABAC
SHA-256:	3D205605ED371704D2DE5FA0511FB4AD2F791C81E5781ED3C4464881EFD8523B
SHA-512:	B70C49F8494B600483A858210A5BB73C0A052460E34AA16290F32EC6AF68095B38B7436FBAE34273048ECD058C7FD40CE1C6184EA21171AFE291C29E249253F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...w9.............!.........................0...............................P............@.........................p................@...................!..............T............................................................................text...^........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.610776982227535
Encrypted:	false
SSDEEP:	192:sFWvhW2WYnO/VWQ4SWcQk5e80Hy5qnajsBksw2b:sFWvhWcUIoeslEJR
MD5:	47A4BC68217B92CA3582224F1024E51F
SHA1:	82258353279AA318B7A6208A9566B05A2F4961FC
SHA-256:	D50963D7B4F67E41FD7D50CAF4D662B04688B66799F7AFF7BCC632EDE8D7F5F5
SHA-512:	AE3351B980EAC6B0D5D3A132F06E033611302D398CED3C97C08045BACC4D453FFC49C5C49D90D48CC049828F81151CC1BADEF5BF789FE208EAD321004577F046
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....\|............!......................... ...............................@......_.....@.........................p..."............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14304
Entropy (8bit):	6.514733036469487
Encrypted:	false
SSDEEP:	192:SlnWlC0i5CtWvhW5WYnO/VWQ4SWXmz80Hy5qnajsBkVQ4:SlnWm5CtWvhW5UtslEoQ4
MD5:	E795F694529FC430E0B0E25884E6A24E
SHA1:	6C86A0BD746F55FD731A30F378E5F21C4FB2E2B7
SHA-256:	0EBAE37459EB25EF518C47C454E6AF81B076D0FDC5FED1674806551259435584
SHA-512:	C71622D473C68D7AE87CBA663F38C08FB1B4EC0786E364F6863FBDF2711A7FAAC1E5CD18BA0912C318627CD58D7FC836EF0DD993A9444C846EC298502E04FC66
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....q.\...........!......................... ...............................@......)X....@.........................p................0...................!..............T............................................................................text... ........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.588576250919747
Encrypted:	false
SSDEEP:	192:HveY17aFBRIWvhWAWYnO/VWQ4SWO02DZ180Hy5qnajsBkFyB:Hvz1WvhWuUD1slEc+
MD5:	FB887FED29C62E516005FADB6838D521
SHA1:	C1B783800F33AED8F67953E0816C1792E976C62A
SHA-256:	F989DE398E969DF49C108EF53F5E152EB35F7A7D0E19974AA9F24A995E5C9E11
SHA-512:	D895E2C83578400174BD0D316E790B1B5C7400B7E24F8AC4AB1964701821F4AE7FAC4EF308E4BDD09AD774CFCD54B1F0176DA0911437759439A1E2A0D99CB13D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...g.[............!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...v........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.7084641078484415
Encrypted:	false
SSDEEP:	192:2CWvhWVWYnO/VWQ4SWZK0kXuUgxfzfqnajm9vYL0BZ:pWvhWFURIrlS9AL0BZ
MD5:	49C9AF5961980346905239D9988CD041
SHA1:	D679539617CF74EC04D75F450EF93D94ABECAC28
SHA-256:	F7CB5D3347D5A13B8BCCE06821BA75043FCE87F298131E23155753B56A48297E
SHA-512:	F2E04AFF6D502D47946D8F0F9337E81FCC9C23608163D276C3CD304B3EF42E4D07D6F00E3606A6C2F2EADEFC23FDA3AF55C1CEFB7912DEF815E5C339208719B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M...........!......................... ...............................@......<.....@.........................p...e............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22472
Entropy (8bit):	6.2015249385339315
Encrypted:	false
SSDEEP:	384:RQF2KmbM4Oe5grykfIgTmLKWvhWGUIYQx5E8l2O7+n:RtMq5grxfInzZAQx5E7
MD5:	B330487F1CCD5FC821FA117F8B57A5B4
SHA1:	C32A5DF20C4380AA5666011D860C1CE2FBFD354C
SHA-256:	5E40B97F5E5A1577BF30E91DFACC0E74E1CFFB6C2BEB270777CC0A5DB065947F
SHA-512:	A5E4F57A94EC1BCA577288458413627EC9B2C5D7B71D5F27A2C153002A9DD4DBDD128C89C35623B3F038A94844A50622FF65751476A5EEF932765A96CB3ECC1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...\|.LI...........!.........................@...............................`......S.....@.........................`....+...........P...............6...!..............T............................................................................text...7-.......................... ..`.data...@....@......................@....rsrc........P.......2..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19936
Entropy (8bit):	6.206347728864468
Encrypted:	false
SSDEEP:	384:K7aLPmIHJI6/CpG3t2G3t4odXLJWvhWGUflWMR:CwPmIHJI6ARC
MD5:	259EF62E91A242FB4A58186A6E9338B2
SHA1:	8C1692CFA61F1160F2F221F13F70007EC3C27F11
SHA-256:	9AA76D84DB69B3AAFD63702277FE54DBDF955B67D904D4F2008D6978E4756E5E
SHA-512:	C4174B4734E42767BF748CC3276FB9CBA1A54893FA3BEF9FDB2226B0FE5351AED267B93089CAB7588E2A1AAFA2CD7DDD513E114150B9FE3F983013D640647641
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......F...........!.....$...................@...............................`......`.....@.........................p.... ...........P...............,...!..............T............................................................................text...d".......$.................. ..`.data...@....@......................@....rsrc........P.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66528
Entropy (8bit):	5.528523630660762
Encrypted:	false
SSDEEP:	1536:48tFDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPer6:7rDe5c4bFE2Jy2cvxXWpD9d3334BkZns
MD5:	E7EB588ADB7DCED01FC1C98B546F83F2
SHA1:	782F8A84408327B67FFCC7333DA62D68571291FB
SHA-256:	0ED8ABB4E2491368A91A755FD5CA82BE93615F4A995326ED19AC56708A8BDE1E
SHA-512:	DAEF7C4F07931454104C28BDC10EA2A7EAC0362ABB86318837B85E9619C4F7D9B9D490EDC06C01775338E92A4666CD88245A0A6CA7FBEA591E5C976735D2847D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../.1............!................................................................I.....@.........................p....................................!..............T............................................................................text............................... ..`.data...@...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12760
Entropy (8bit):	6.615710187362648
Encrypted:	false
SSDEEP:	192:wriNwF5uSqjd7VWvhWm5WYnO/VWQ4uWL6ztkqnaj6MrBy:5NcuS0WvhWm5UwlWMrw
MD5:	6EA1AC1D1342EB4A09D44A9BB514EEFC
SHA1:	369A9541D76739782F4EE96FB1FCD14B60C33279
SHA-256:	EDF54C26E8ACE43DDDFE0E577B0DAA8C4CA45A40E479B818CA14F4DEFEE2ED97
SHA-512:	F7C3B7F4EBD54A5A97372819CBED70D65FE4E546E390FBB88E87FD5296D8A2DF65D274DE26C2D2C28B4DB7DD58976C24AC29D3FF3D8C37930F2091E54B34DBB7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....#.~...........!......................... ...............................@......L.....@.........................p...x............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16840
Entropy (8bit):	6.37438013501528
Encrypted:	false
SSDEEP:	192:1ZOEz9DMjOOfhrpIhhf4AN5/jirWvhWWWYnO/VWQ4eWZ3KF/pm4RGV+9N8qnajwr:V9ojOShrKgWvhW8UHpm4RGVhl8J9mL
MD5:	0792930CCED35A6B7AFD0548A380D5D1
SHA1:	45139B80525961C5AADFFC3B4E44720F144DA878
SHA-256:	F0E0D8B65A8CF88355A7C2FD401CEE5FF4BCB7965A888F4361AD14A054517FD7
SHA-512:	DF1CA5B417E5EC7A6600EEE4E5EBB8DE557CCD7883174CA47E4B69E0138C6AF4AFEAE0CB2D2F8C3B32C128E92C725DCD4739D40911E15571BC5573289796F3D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!.........................0...............................P............@.........................p................@............... ...!..............T............................................................................text...5........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17888
Entropy (8bit):	6.407550218596736
Encrypted:	false
SSDEEP:	192:/Ty4x+m9uWYFxEpahrWvhWGWYnO/VWQ4SWZpdPqqnaj+Hm:Nx+tFVhrWvhWsUQoliHm
MD5:	38799420C40507472FD54B3BA205DB3E
SHA1:	84D04A2E360F16DA027B84D51AAB649154979232
SHA-256:	EEC15EFDF7CAA058CB7F721A1C4E5D3F1C97039C4B6BFE2B32F789E10756106F
SHA-512:	CDE6FF6B3DC908DCF932B4E308C99589AF3BCFE8AA06A416DB107E948616BA7517C3EF882A59FBECF2B3EA92290F90123D5A6F4C355BC1D89A5F4745EE886833
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....V2"...........!.........................0...............................P............@.........................`...a............@...............$...!..............T............................................................................text............................... ..`.data...@....0......................@....rsrc........@....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18392
Entropy (8bit):	6.290893776368227
Encrypted:	false
SSDEEP:	384:7KgSx0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WvhWeUi0gXlXud:Gx5yguNvZ5VQgx3SbwA71IkFPtJ0gAd
MD5:	2C4F5369A8C60A6D8107F474D2942859
SHA1:	9E52AE6E0397672FDBF251217CEA25201F11004A
SHA-256:	C8138031537A27FD364F359D48DB88485C4A0D668ED2983FF5F6EDF0BFFCD91F
SHA-512:	EFE27D138CDAE009E4AEA9AAF31C899CC60389ED644F042FF3B656C3A24FC8A98420D90AD86FA16EF95BD14B918EAAAB926F2AD20AD47E0831842EEC2B136A29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...3............!.........................0...............................P.......;....@.........................p................@...............&...!..............T............................................................................text...O........................... ..`.data...@....0......................@....rsrc........@......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14296
Entropy (8bit):	6.557973934202439
Encrypted:	false
SSDEEP:	192:90e3ugzjVDKWvhW6DWYnO/VWQ4SW72Xg4jpC52qnajRwz:9J3uAIWvhW6DUNhNllY
MD5:	E78951B33F1A259B3B9C0B406AC816A4
SHA1:	22AB7641FEAB19E0D3C2992F377C4164E3F7E74B
SHA-256:	62886805AD32F151B6230358E1DA74DB1BFC8ADBFDC316FDA111CB8431A733D8
SHA-512:	9F6D378326BF9102B9983053F105C51AD09CB80F478AC97AF9269BFE2633F3210A9AE56E55DEE6EADC00F5F7841654A13F1D274BCF590DE56CEB3E68674BCEC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...,.zo...........!......................... ...............................@.......+....@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.70483590552591
Encrypted:	false
SSDEEP:	192:PanfHQduHWvhWRWYnO/VWQ4eWQFYI1kCDqnaj8F0JVK:AfxWvhWRUtFH1nlAF0JV
MD5:	1D8042874EDDEBE39E60FBF8E1DFD3D0
SHA1:	AAC2EE2EA006022646B6C0D7CEA93E248CFF62F1
SHA-256:	4E71C955DE0A9E71ECD6749D73F6F07364BEA34C125A61261A9EFE2B76BA98E5
SHA-512:	A74EAAFAF0643935A5DE9138059B08D972A05CAE3F859FE7DA28A370E2A4FB46AE00D8B986AFA06F353EEF2DB104E60A5F40F07A5A87CCBE644E8F433B29B621
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....x............!......................... ...............................@.......I....@.........................p...^............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\clretwrc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304792
Entropy (8bit):	4.2342678712156605
Encrypted:	false
SSDEEP:	3072:5QX9Xit++0PJSKtOJsgI3mwNdmLZ8mTQfsqxiQyv9:e9xacWIfsqtyV
MD5:	599D4E6187DC1FC6C40EE80384EC5CB1
SHA1:	6DC0A368FD08F3CDA0925234B3B25E674BB7D672
SHA-256:	0DEBDD5E0A5CD8EF581BF9D6CB00B13425C0B302100AF8AEC48A907F1A256AC0
SHA-512:	342716355952A2E2075D1D31C505F6F302FBF6BBCDEA511B0D6977676CD3AF9C52750CAE912FC803CFDCE4F08106FA9A997DD410D6A2711E9B082582919445FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Uj=...S...S...S..~....S..~Q...S.Rich..S.........PE..L....q/b.........."!.........\|......................................................X.....@.......................................... ..px...........~...(..............T............................................................................rdata..X...........................@..@.rsrc...px... ...z..................@..@.............q/b........l...l...l........q/b.........................q/b........l...................................RSDS.F.i..C..*q...\|....D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\clretwrc\clretwrc.pdb.............................T....rdata..T........rdata$voltmd...l........rdata$zzzdbg.... .......rsrc$01.....!..`w...rsrc$02....................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\clrjit.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1218712
Entropy (8bit):	6.631905280825866
Encrypted:	false
SSDEEP:	24576:J7Vnhu5VTuBkq3VLs0yjauSjl/ghuZLlqH2Dl0SUpUzb4NCJt6sGO:9CVTRSVLs7RAl/6WDcgJNGO
MD5:	56ECC69FBD377B1FDBC716E2CDDCE562
SHA1:	3C342B11E7CF5ABEA2F84A77A4C0DA7B5AF16D2C
SHA-256:	A41A368D79DF947B4AC77D3AB5542E8344929BE3DA9D29F4C796B76F0AB58557
SHA-512:	7FC71B1DD9DEE51586A95C351709681B904DC284B7357DECCBEBF489E1FB863C8CAC333339F80243560CC69C245FA37D5E78B77A8D4D24D3E30581C7F553A188
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..\|...\|...\|.......\|...}...\|...}.\.\|...y...\|...x...\|.......\|.A.r...\|.A.\|...\|.A.....\|.A.~...\|.Rich..\|.........................PE..L....p/b.........."!.....V...8.......@.......p.......................................@....@A............................t...D........@...............p...(...P...p..8,..T....................d.......,..@............p...............................text....U.......V.................. ..`.rdata..t....p.......Z..............@..@.data....5..........................@....rsrc........@......................@..@.reloc...p...P...r..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\coreclr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4309648
Entropy (8bit):	6.693745628542388
Encrypted:	false
SSDEEP:	98304:8z2r6dbSDeoj488FIYbPUBy91Zt8c0zCl3icL:86mFSD35KlbPUw1ZC3Cl3f
MD5:	C996E832304D477A29E69731A5D76A46
SHA1:	B39BD1A521E7D9C18D88CE45DA531E2222C19E69
SHA-256:	737D4FD79845ED75C99C101A29FB3389BF7949FC0B76DEE89246D95DF92C1ECA
SHA-512:	1F9792390B925E039BED288E88AAC1FA5CA504765F74713AE79C1A9D1B735C638AD7AD8FEE769228FF976EE796421B034F110EB3658AE7EDBFBC48F3C1D1672B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...8..8..8.....8.d.<..8.d.9..8..9.#.8..=..8..<..8..;..8...;..8...6.x.8...8..8......8...:..8.Rich..8.........PE..L...Vr/b.........."!.....P3..F...............p3...............................B.......B...@A..........................=.D.....=......@?...............A..(...P?.\:....5.T...................@"6.......4.@............p3.......=.`....................text....L3......N3................. ..`.CLR_UEFG....`3......R3............. ..`.rdata.......p3......T3.............@..@.data........@=..$....=.............@....didat....... >......B=.............@..._RDATA.......0>......D=.............@..@.rsrc........@?......T>.............@..@.reloc..\:...P?..<...^>.............@..B................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\createdump.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45776
Entropy (8bit):	6.716311042748186
Encrypted:	false
SSDEEP:	768:HrIzvgtifNyzCzm7WI5SyW7/Ibt5M+f7jORg9zuR:HM7iifZm7zTbrMwfJzuR
MD5:	266B24D93DA80D606275EB699BA5CD10
SHA1:	9D3362907847B8F7411E24E78DFC143408CC92F1
SHA-256:	F5156909E56FB707474871F1ADC2ADC189F54918E2D91040EB65867D7AB0DE5A
SHA-512:	DAF57C97B50EB653FC1ED0B74BE9778D81F85F2B733A44E4B06B2FA1A5A7F288C0A82848CB22DBF736B095F4E15DDECFE59D61FD9862F1D08781949EAFC0BF6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dD...........}......p/.....p......p)....Lw+......+....#p#....#p.....#p(....Rich..*.................PE..L...mq/b.................P...6......@,.......`....@.......................................@..................................}...........................(...........r..T...........................hr..@............`..P............................text....N.......P.................. ..`.rdata...%...`...&...T..............@..@.data...8............z..............@....rsrc................\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\dbgshim.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123024
Entropy (8bit):	6.605677402798977
Encrypted:	false
SSDEEP:	3072:+OU7AJ08LNSedQYhcM1QZV0e0ux64dSqF:JUUJ08LLdQlM1dl47
MD5:	E531F3794349C1AE52D0FB044DF7DC16
SHA1:	C66D9E3F32F2184FD05FC04982E24614BA44E80E
SHA-256:	3E6954B72D3B7D95F55CDEFBEB6125B66586874CC8C98E5DFDDA79C78FE2B1AD
SHA-512:	E7B2314E67D95E43381D2F1C3DC17DE23A4BB640CE00449A59C04311243900173361E2A2E336C10855D63A6EB0605360A86AB37000B08B28478367D52ABAFBEF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Xk..9...9...9...A...9...L...9...L...9...L...9...K...9...9..u9..gL...9..gL...9..gL...9..gL...9..Rich.9..........PE..L....q/b.........."!.....2...................P.......................................G....@A............................(...............................(...........}..T...........................8~..@............P...............................text....0.......2.................. ..`.rdata..pa...P...b...6..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\hostpolicy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	327312
Entropy (8bit):	6.499781675224189
Encrypted:	false
SSDEEP:	6144:a7e+Hiv3UzACiJtCE2Aj7NsVLdkx8rilHCxjyJn+m98:p+r5i/XD7mRdkSjywm2
MD5:	47C7B65133A317FB18730109EFBF0A1E
SHA1:	9AFF92B323F74766F1265DA5CB1B80441A9205FE
SHA-256:	475B523992CD90E919912581A893E2C5364569A80348044257E1181C8095C06B
SHA-512:	824AB592EB8F41390917A4D65DFA3E30ECC73EAFF86CAA567A6B44C338AB00B7D2CC6E92E67F7825058FD7C814E43D0331CE425482E5168C9C5B12799384323D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gc............s......s......s......~.....nt........v....s......s......s......s.....Rich............PE..L...oy/b.........."!.........@.......B....................................................@A........................`... ................................(.......)...V..T....................X...... W..@...............x............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1280904
Entropy (8bit):	6.403116777751298
Encrypted:	false
SSDEEP:	24576:SUnF8KeTnkXQfDZ2oVe4qlkeCSUZ0qc8ix7VNG+B1IdRMsFUG:ROnkXQABFB1IdRMsFUG
MD5:	5D65F57385D8D0C6C4F0A581C8096CA8
SHA1:	369FFB1254120D9716AD74746F33818FD1814F31
SHA-256:	F42890248C948483233B09FF2876F9F78B9292EFD9DCE955467C7884A2A3478D
SHA-512:	15C1FF74339D1CAA305D2270AC80A538C4DFCB5C7F5D2E0D530784B95026D7C6863C68B34F5414A8FF3DF7CCADE02B4325B400EFB58B47BA896C46C38E14AA5F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5s..[ ..[ ..[ .. ..[ ..^!..[ .._!..[ ..X!..[ .._!..[ ..Z!..[ ..Z ..[ w.R!u.[ w.[!..[ w.. ..[ w.Y!..[ Rich..[ ........................PE..L....r/b.........."!.................%..............................................7.....@A.........................n..p....o.......................f...%......L...0...T...............................@............................................text...L........................... ..`.rdata..............................@..@.data...t............n..............@....rsrc................x..............@..@.reloc..L............~..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordaccore_x86_x86_6.0.422.16404.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1280904
Entropy (8bit):	6.403120193337707
Encrypted:	false
SSDEEP:	24576:8UnF8KeTnkXQfDZ2oVe4qlkeCSUZ0qc8ix7VNG+B1IdRMsFUk:/OnkXQABFB1IdRMsFUk
MD5:	2C6DA9F93637FDDE99F22D7D82C7CDFF
SHA1:	79F5761D89A82687F342C35A40C25263B21CAAE9
SHA-256:	8538CE8AFE71295AFEB5908DE43F6CBA4F959FC45A25C4776FCE8604A507BDD6
SHA-512:	C91A6145F0BBD8BC0EA2FECC5AABBC683A5E5A5555CBBCFBE21F078660A155B76C1FC5C16C3E2EB17062AB151E15E790431E9D4708F2FC3DB0BDBE49AE79E0F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5s..[ ..[ ..[ .. ..[ ..^!..[ .._!..[ ..X!..[ .._!..[ ..Z!..[ ..Z ..[ w.R!u.[ w.[!..[ w.. ..[ w.Y!..[ Rich..[ ........................PE..L....r/b.........."!.................%..............................................F.....@A.........................n..p....o.......................f...%......L...0...T...............................@............................................text...L........................... ..`.rdata..............................@..@.data...t............n..............@....rsrc................x..............@..@.reloc..L............~..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscordbi.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1219208
Entropy (8bit):	6.427657039389402
Encrypted:	false
SSDEEP:	24576:1zSXeLMbQU3mx+QANjSwce/MOTHL8GxS2ENty:ibQdx+QVPOTrbxS2kty
MD5:	F2679719DE61094641708F264AE8795C
SHA1:	86675A895542DC4977DA4A9B4AAAA638517DC494
SHA-256:	61F69CEE81F29F9C7B7FAE44B0D6A58EBD8C46D6E1B1A8C9BEA7A4DF0E75AE46
SHA-512:	77ADB530DAC33C37A24B58603712AE690FB9F8D246F167945DD45A3756BE937DCC302262D413E60E01C1D1A6E9DF413AB70EB993026C2AE4689023EB165CCAC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Hh.G&;.G&;.G&;.?.;.G&;.2#:.G&;.2":.G&;.2%:.G&;U5":.G&;U5':.G&;.G';NG&;:2/:.G&;:2&:.G&;:2.;.G&;:2$:.G&;Rich.G&;................PE..L....q/b.........."!................`...............................................^.....@A.........................v..<...<w.......................r...(......X...xq..T....................r.......q..@...............T............................text............................... ..`.rdata..............................@..@.data................t..............@....rsrc................\|..............@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscorlib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58520
Entropy (8bit):	5.642372729237448
Encrypted:	false
SSDEEP:	768:n8zO+8uP8x/A15A4HI4gJl01Qa7ICltVfAjeh7PZ9zV:8zO+8uA/A15A4o4gJq1DI+fgehHzV
MD5:	A245AF7DB9269CF2B52B64D62939E867
SHA1:	96B48C916C973F614E402AD325A790C6C50F8D48
SHA-256:	8FF698686064310FD302474F9536019C63D57C5B5CCB27378FEFD7F86C8FDCDA
SHA-512:	17232DABC2C263965D3DC6CA38023FBB1BC1CBF79B3B824DEFF8846229715007DA8F49C41631E3E6DD0520F9737A8F5BE7DFF07B9002D08288990941D3013AD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0.................. ........... ....................... ......_U....`.................................h...O.......$................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H.......P .............................................................BSJB............v4.0.30319......l...pL..#~...L..._..#Strings............#US.........#GUID...........#Blob............T.........3....................................,.....*-.........#.M...&.M.....M...M....h..)...$'....".2.....2...&.2..v$.2... .2.....2.....2...$.2..x..2...1.S.....S..5..]...$.M.................L.....L.....L..)..L..1..L..9..L..A..L..I..L..Q..L..Y..L..a..L..i..L..q..L..y..L.....L ....L.....L..

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\mscorrc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147088
Entropy (8bit):	3.866571427269775
Encrypted:	false
SSDEEP:	1536:plgZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXXIAHzuJ:plgZ/aSKlZ4ZGnwmUS4ScpHg
MD5:	47FC831513943DDA4EE5838D9E179FEB
SHA1:	231BA645F4CF675E82D06DFDFE339C303039A744
SHA-256:	AF1981F8737F92D092F8DCDFDDBDFAD0A6A67E37CD8B833A97BBB481C544F08C
SHA-512:	94629A208B8ABB549AB7163A06D275807A99C2DB17C5F10C300D1D6E77903C5CAA4B6861AD923B7575547CA039C7127D9E741572BBB1720002370A7502648B9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Uj=...S...S...S..~....S..~Q...S.Rich..S.........PE..L....q/b.........."!.........................................................@............@.......................................... ..X................(..............T............................................................................rdata..X...........................@..@.rsrc...X.... ......................@..@.............q/b........j...l...l........q/b.........................q/b........l...................................RSDSR......I..Zq..SN....D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\mscorrc\mscorrc.pdb...............................T....rdata..T........rdata$voltmd...l........rdata$zzzdbg.... .......rsrc$01.....;.......rsrc$02....................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\msquic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459144
Entropy (8bit):	6.508610680387555
Encrypted:	false
SSDEEP:	12288:fbqdUtdIeEUWMQdSyAIY6Ocm2FdE0h557Tlk:jqdUtdHWRdSWvOOdE0h5F+
MD5:	B85284FAB5CA54DE7B64B659B2359D9D
SHA1:	930857CA9FF3269884C56AA96EF6B75821326D56
SHA-256:	437CC1B0B563D4A053BADCACF26045D022BD86DA0081D45A234B1836DDB0ACE2
SHA-512:	17C922CC0A1BB30DD46A0C13788622152F5E24F87F97B28E0AE841023452C4C32804A913754CB47E9A7A6CCE4B14601E91B5FBD9C2194D3CC301220D1951FDBA
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........c..A.s.A.s.A.s..jp.K.s..jv...s..jw.S.s..wv.\.s..ww.N.s..wp.U.s..ju.@.s..jr.T.s.A.r...s..w{.l.s..ws.@.s..w..@.s.A..C.s..wq.@.s.RichA.s.........................PE..L......a...........!.........Z............................................... .......C....@A........................`...\|..............@................#.......>..`...T...............................@............................................text.............................. ..`.rdata..4...........................@..@.data....(..........................@....rsrc...@...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101504
Entropy (8bit):	5.5000542718300585
Encrypted:	false
SSDEEP:	1536:yiTrnaN0HjO8MZYq5V4bgDHsPdPpwSJ5L3Akcg9QSSrlCznW:raN8qZYe4bgDUnNKSqCq
MD5:	91F3CE203DC10DFD96417E2D47B8EC9E
SHA1:	FA95919A90F7268D0EC2C2745DC8B217593CD028
SHA-256:	F991AE480DB2A705316083BA4CFD74AE9DF833A808ABEED12DA965FD86065E87
SHA-512:	B0A81214E82A59A7B34EAFDBE699B30CBFE27BE1A482F2DF9B0A76649288C6590766E103805D321614F3EBDF98E0999A80EA9C790B6701432E0ADEB5038B2EB2
Malicious:	false
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\netstandard.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>.8..........." ..0..Z..........2x... ........... ..............................j.....`..................................w..O.......4............d...(...........w..T............................................ ............... ..H............text...8X... ...Z.................. ..`.rsrc...4............\..............@..@.reloc...............b..............@..B.................x......H.......P ..@V...................v......................................BSJB............v4.0.30319......l.......#~..,.......#Strings.....R......#US..R......#GUID....R..L...#Blob............T.........3................................U...(......H.........5....;....'8.........., A...7.J..P4U..5#U...:U..n7U..&1U....U.../U..(7U...(U...T-..../-...i&....7................./...../...../...)./...1./...9./...A./...I./...Q./...Y./...a./...i./...q./...y./...../. .../...../...

C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\ucrtbase.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1117664
Entropy (8bit):	6.790214577893185
Encrypted:	false
SSDEEP:	24576:Xh85O5bBi5MSggquSDJls3gvpmcvIZPoy4Nah+:R85mgquSDJlCOa0
MD5:	5FEF2FD676D7A1AC1BBF2CC9BA5C1A29
SHA1:	3716DEEF1BA1915E06111199B1B6AB9E1D0649A4
SHA-256:	1F1CE96469C20279003CF9EC59F452FEBED2DD7F6E6C055AE8019216105C8F3B
SHA-512:	D6EBD0A633075040237BD30447AF9D88672163F40F2ECD4197C9B4FB191225212B789CD514CE2F81F695CC485173705582E4DBF6B8F9FC40C03936A31919E064
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0<..t]..t]..t]..}%..G]..t]...].../..u].../..b].../..u].../...].../..*].../..._.../}.u].../..u]..Richt]..........PE..L.....4............!.....,...................@............................... ......-.....@A.........................^......tb...........................!.........\...T............................"..@............`..p............................text...0+.......,.................. ..`.data...<....@.......0..............@....idata.......`.......@..............@..@.rsrc................V..............@..@.reloc..............\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Accessibility.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.542295488450061
Encrypted:	false
SSDEEP:	384:tBmy0h6gSGRnOcHiuW2/WrsBlHRN7EBsLMB+6R9zctFvJfm:WSsOcHvfjWsos29zYJfm
MD5:	1EF5BEEE8727EB833B181078BB6CF198
SHA1:	3FB6D1DA1E34540A06220279AF14640101A33513
SHA-256:	77A3675B8260EB621CB0668D9A4756D36A09D680B34B394EE25F072263AC4674
SHA-512:	45064B29AA1E3F469E2CC86760C4697586571FAF6991D1DFC1A3BDF93EA42C01F66AC122095A253DC0EA72288128A247532B54BB0F01974CFDF46D0820A6ED31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../b...........!..... ...........?... ...@....... ....................................@..................................>..O....@...............*...(...`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H........ ......................P ........................................T.;.K"N...a..5G3T.D...<..m@O.+7.L8...A...:.......I..[.V.=..@X...j.0J.n.._.z.\2U.>=.9.z.R)..I....."YS\|i...w-T%..~..OZ.YC..[BSJB............v4.0.30319......l...,...#~..........#Strings............#US. .......#GUID...0.......#Blob...........W.........%3........!...........7...................t...3..................................... ...............^.?...y.r...........?...............-.....D.....d.....

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\D3DCompiler_47_cor3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4111304
Entropy (8bit):	6.572840981142565
Encrypted:	false
SSDEEP:	98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
MD5:	5E717C95808BCB5F654BB312D289B837
SHA1:	C69448EAFA40E35424744C28E68CF69CE11A3D97
SHA-256:	E745872DB4DD114A65EE1504F401EA26D879EDB6614E369A07A80CE7AD1950CA
SHA-512:	DC5E6EE0C8FE22897009060821B18BF2F7D0317D30682F7FA84A4C1889358C152D84D22EBE57D0EC8CCC1BE8714BCE6B1257D30671B8D0FEA88309BBD137B8F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gi.C...C...C....t..A...C.......J~..F....l..~....l..B....t..B....t.......t.......t..B....t.......t..p....t..B....t..B...RichC...........PE..L...u..............!......;..(......@.-.......<..............................P?.......>...@A..........................<.u....B=.P....P=.@.............>..!...`=.T.......T...................\|u..........@............@=..............................text...E.;.......;................. ..`.data...`"....<.......;.............@....idata.......@=.......<.............@..@.rsrc...@....P=.......<.............@..@.reloc..T....`=.......<.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\DirectWriteForwarder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	502936
Entropy (8bit):	6.9717266164542995
Encrypted:	false
SSDEEP:	6144:42bUs+dktmeSlZY1pYOcahcr7xUzKTWFQxfsq554L6HZkxT24XdfxtUee:b4zds/SxOcaOx0kwc2TNNZtpe
MD5:	B22E1F0DADA49BE3CE6873744DFEA762
SHA1:	9CE68424C416DE56987B8E7EC09005944548934A
SHA-256:	1E5C753BCA248D9E0959EAC30EACCFC1081D9FC42AF0BDB33A4D31125B5642FA
SHA-512:	6A0F5B1B78E1D10A0C72CA1FB4E043264C8F9A85CB79BAFCAC4DB00308E161B6453148D2C9F3768EAD097505248A6BC6984874BA6E160EAE0E4B5EE5F89404F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.0b...........!.....@...B...............P....@.......................................@..................................................O..P........(...p...#..4&..................................................................H............text...l?.......@.................. ..`.data...%....P.......B..............@....reloc...#...p...$...`..............@..B.................................... .......8.......................P.......................h.....................................................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@......w@..?...........................\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.4.0.9.0.4.b.0...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....D.i.r.e.c.t.W.r.i.t.e.F.o.r.w.a.r.d.e.r.......@...F.i.l.e.V.e.r.s.i.o.n.....6.,.0.,.4.2.2.,.1.6.5.0.3. .@.C.o.m.m.i.t.:. .f.c.b.0.7.d.6.3.7.a.b.f.5.3.7.9.1.e.2.c.5.5.c.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.Forms.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	217728
Entropy (8bit):	6.69884867585377
Encrypted:	false
SSDEEP:	3072:QthD6ODBOfEp5aa3YQob2jF26sS/DLsG+oXYZbDmvTb2KO9G2WZrzMrO7bvQUW/A:uhD6ZfzGvF2cp+LbDm22Eo+pWt
MD5:	72EAA3327A427885D4E21CEEBC6CE05E
SHA1:	15C023426E28BE808C89EF1AAC705188D869A4CF
SHA-256:	0E46F6FED45124E30E62B094BCDCB70D56B93C72FF1504B46815DC72F59190BA
SHA-512:	13B31A469B3DB877DB882B85B572B53AF31EDD30FD7129E6A6113FA7BA765AA149CE3BA1DF2214CA2DB6CC08CF2101E8D5EAFA4E72A449A0F07B18FFCF691CC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z..............!.........b....................@..........................P.......6....@.................................................T<.......*...(... ..T ...#..p...............................................................H............text............................... ..`.data...I?.......@..................@....reloc..T ... ..."..................@..B............................................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...V.i.s.u.a.l.B.a.s.i.c...F.o.r.m.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.VisualBasic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19072
Entropy (8bit):	6.516340235518785
Encrypted:	false
SSDEEP:	384:gxUP0hxLfGsZTxWmHL9QdW1sBlHRN7VRnbVGlD/LVNSR9zuWVy:3slesZzqjLoxLVNe9z58
MD5:	10CAA46B0810EBAE0AA52B9B4D230FBD
SHA1:	9426897B4C6E63C8DAC5142C1AECADECC9BB3998
SHA-256:	9B58B41484B17EC91F1F0F511075A69337FE5AD1F7C2E5D6F21375F3A0AB5848
SHA-512:	FE84B36290D0B1A6476F47A960F5D523429B12CE16B3381E5518CBF68FF949491BB7D44A98614D5004CA2320E51743F2624831E44AD86034C9050B65135C1FD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Wmk..........." ..0..............7... ...@....... ...............................5....`..................................6..O....@..............."...(...`.......6..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......P ..L....................5......................................BSJB............v4.0.30319......l...(...#~......P...#Strings............#US.........#GUID.......T...#Blob......................3................................w.....X...........z...v.z.....................].....v.................3.....P.................,.....a....... ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.-...3.H...;.U...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.Registry.AccessControl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25728
Entropy (8bit):	6.613309200470942
Encrypted:	false
SSDEEP:	384:63WFYrW2lekHZ1PqvIckkGvY+65NHznhnFg9alNsBlHRN7MkJG2teR9zboe8ct:6hNleIZ1Zixzhnm9rjMkJG2tC9zect
MD5:	25723F0EBA6A78FB2915567FCAF117F5
SHA1:	EED0B8793432673286A08C805A7D7ACD17D55434
SHA-256:	38CB5BA8367C275869C0B403DC72257A8689FE06B3837C5C725E8E3D2E6AD643
SHA-512:	A2522621665E6A76BE091E4AC86A526851179684AE4D5E09F220687CA5CBF74825201A926D65DF307D070C639B0FF36AA6544F49A47F0EFC8506CF67E2109D86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....4...................P....@..........................p......a.....@.................................................\........<...(...`..(.......p...............................................................H............text....3.......4.................. ..`.data........P.......6..............@....reloc..(....`.......:..............@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....n...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.Win32.SystemEvents.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80000
Entropy (8bit):	6.638399307757655
Encrypted:	false
SSDEEP:	1536:UnS6dTPTFJN5Coum0C6bYAApXwtvIE62A/Ezj:UnvdTPBvBukAApXCvIE6h/EH
MD5:	965BDC861C1995A4BF193601301B5170
SHA1:	DE84A1E8CB62486BEB83C6C111F72283BC22C71E
SHA-256:	08C95DCFB09421E3AA10A32FBE20BB656CD0E814173F7DDD60889D80BAACCD66
SHA-512:	4E28ED002DAA9A4F2283A5E5192EF963522D9FA99CCD4382483AD695E443F9E09A4533F8EBAFE4341DAD9F23D74FFB44BD0E721288E254A0D1014E5251F7EACE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..............................@..........................0............@.............................................(....!...........(... ...... ...p...........................................................(...H............text...d........................... ..`.data...,...........................@....reloc....... ......................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........0.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.WindowsDesktop.App.deps.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30911
Entropy (8bit):	4.2441884548725275
Encrypted:	false
SSDEEP:	384:a0Q7QMOjK+OiMglXMmXMkXM3n8qXILHchS+hX2eSs9Xw67nTxqOB01nEE7D/NG6a:a0SSgiMg2N/M14hBhX2e5K9mPlF3
MD5:	25487B45FF4DA3BB2A0ADDC44E297E0C
SHA1:	EFB8B6790AC2EE3D47EF362DD7E8E815DA1780A3
SHA-256:	C8A04E6FAACCEEEF1AB2919CE424E54B259511AC5F5A478A819823AB6135F18F
SHA-512:	DE4CF419633374B3B200561E6B7B14783E6E840432129068DF88FBF234391846B59E5833DCD0DB330759D5A18F159E4B913EBDABD57FAEABC3F289E55A662F7F
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x86",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x86": {.. "Microsoft.WindowsDesktop.App.Runtime.win-x86/6.0.4": {.. "runtime": {.. "Accessibility.dll": {.. "assemblyVersion": "4.0.0.0",.. "fileVersion": "6.0.422.16407".. },.. "Microsoft.VisualBasic.dll": {.. "assemblyVersion": "10.1.0.0",.. "fileVersion": "6.0.422.16407".. },.. "System.Design.dll": {.. "assemblyVersion": "6.0.2.0",.. "fileVersion": "6.0.422.16407".. },.. "System.Drawing.Design.dll": {.. "assemblyVersion": "6.0.2.0",.. "fileVersion": "6.0.422.16407".. },.. "System.Drawing.dll": {.. "assemblyVersion": "6.0.2.0",.. "fileVersion": "6.0.422.16407"..

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Microsoft.WindowsDesktop.App.runtimeconfig.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.642096646352622
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkv3Oqo/XCkyFNOJeZS1SReQ6NOCUo+K8EkNTy:dFkv3OqJ5MeU1Khex+K8Es2
MD5:	4EF0609C321D022838923570ADA61FF6
SHA1:	2209FCF35B682CD84817CDB12FC8699CBEDDDC40
SHA-256:	F018C5B88FEB56C07807A97A0E8453FEF9BAFCF9C1F4AD0F2D3364F675BED8C4
SHA-512:	F3743AA736E103D7E88FF8C4B12D31B876818555F96B8B8041266CB231175AC92E4BD0A543918785B999DD8727E0727C38076E9A0777908E0011E6EF843960C3
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "rollForward": "LatestPatch",.. "framework": {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.4".. },.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PenImc_cor3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142992
Entropy (8bit):	6.4380311850491605
Encrypted:	false
SSDEEP:	3072:pq6wZBEfu1sEYtSZc4jHWymd9r1TnaenY47d5hcqHs:6QtQPq9llncqM
MD5:	34240EED94E129C1116698C2D78B9017
SHA1:	7DCA0FBC5A1720036B1FCB6512223F91053E7EF4
SHA-256:	199885F9CDC93392D6F8AA392DEBCD347DAB937EFE17F507D6732155031BC553
SHA-512:	3D16A00FDFB894C59707C29BF1D40C1F6B1BC476DAC7F4A09B6E5278FE01DDE35E1D30854E03CDA0D6D0EF005FF41E31A42558AB43B52F2B8A316E3810334892
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.i}2...2...2...;...8...P../....P../=...P../9...&../1...&../=...2........../?....../3.......3...2..3....../3...Rich2...................PE..L...W.0b...........!... .B...................`...............................0............@A.............................................-...............(......H.......p...........................@...@............`...............................text....>.......@.................. ..`.orpc........P.......D.............. ..`.rdata..Bm...`...n...F..............@..@.data...............................@....rsrc....-..........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationCore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8191616
Entropy (8bit):	6.899541655025578
Encrypted:	false
SSDEEP:	98304:tCEchPSaWfKDzkGjMIi11eAJA/eFkfy1Ajd:tCEchPSjiDzkGjO11B4d
MD5:	DBFF400F3EB4DC7C97CC85216B3CA38D
SHA1:	95716FDAE9A934CA8009961DDD7C85DD142981C7
SHA-256:	38960FE0BEC517B7A0E1F5CC215D0417E1E68E5CDE007DB525750DA3089D63F1
SHA-512:	8C8689F5AAF81BFA781F1B501981112E6BF9BFB4BBF62BE2352741B60E167DA637F029EDA4B12A83BB0ABC3A42A55939F82CBFA390A19525E299FE5A73F2E11A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a#.............!......s..4................s...@...........................\|......}...@.............................................L...0...8.....\|..(... x......g..T...........................................................L...H............text.....s.......s................. ..`.data...Sf....s..h....s.............@....reloc....... x.......x.............@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.C.o.r.e.....<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemCore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26240
Entropy (8bit):	6.737320686349159
Encrypted:	false
SSDEEP:	768:UR/bto/au7+fN73WjzW50ja/NxLVNe9zY:URy/auydWjzWmalnNazY
MD5:	B0367F53CA42DCB48DD1916A4F8BECAF
SHA1:	5B7541425C3C6FF45A0BB4C51F19624E07C661B6
SHA-256:	5D862316AADBF6392A03D8F7E91663FE4F50D118049EF13493C62B76336B4F14
SHA-512:	6224877D3E1BB77B082AC7D6BE2B3E8EFE5575F8CDB33E93E2AC3957E497AD5C2336A39F0A1E6040A9F1515F30F34507FD1D3F69248A16BD90E5F3BC718A056E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....4...................P....@..........................p......O.....@..........................................................>...(...`..........T...............................................................H............text...D3.......4.................. ..`.data........P.......6..............@....reloc.......`.......<..............@..B............................................................0...........................t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k.-.S.y.s.t.e.m.C.o.r.e.....<.....F.i.l.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemData.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23192
Entropy (8bit):	6.764694215666663
Encrypted:	false
SSDEEP:	384:oWihkQ7NiLD1dE/33ovI0Rvo5kaRbp05ypvsBlHRN7r/P/R9zVV:QhdiLYlZbFqjrPZ9z7
MD5:	B98DB4283E857A33BF01D580F346B975
SHA1:	C055F7F146D3A37138712EFC800A0E1E15D60AA6
SHA-256:	5717559616D83E2BB26D93FE2521DA810C5495644D7F2A675CBDF88409124B26
SHA-512:	324435F8B1E005DB943180056F0B12369EE479E5E5F5893BE97C1DB4C4A1B30E9287C8F966DCFC298162FBAD168723BB6293043FCFBC4D12E84DC5212C1B6594
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T.............!........................@....@..........................`.......4....@.................................................8...h....2...(...P..t...t...T...............................................................H............text....)......................... ..`.data........@.......,..............@....reloc..t....P.......0..............@..B............................................................0...........................t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k.-.S.y.s.t.e.m.D.a.t.a.....<.....F.i.l.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemDrawing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21656
Entropy (8bit):	6.7635243137397305
Encrypted:	false
SSDEEP:	384:vW7rQuttpdYI3Uss/prEK9mN8Qgw2/0sBlHRN7OlS/P/R9zVB/:gsStFnYFwkPjXPZ9zb/
MD5:	B9C0CA350B8650571A8DEB1DC4E09F7A
SHA1:	8EFBAF4D65ECE95E91AF1545DA1ED531C12923C4
SHA-256:	D1C2998505C4BF95993A0190D9B648DE5A8BE24ADEBFEB43759A6704F4AF6E2C
SHA-512:	C969F91CAE1801083D68AFB3DD42C2C4758A3C29E6B869FC00A8719C419E3BD29C43E42508E542B12E030BF0451CCB7832F01223A62005886953526ED772B0EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.............!.....$...................@....@..........................`.......A....@.....................................................p....,...(...P..........T...............................................................H............text....#.......$.................. ..`.data........@.......&..............@....reloc.......P.......*..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k.-.S.y.s.t.e.m.D.r.a.w.i.n.g...<.....F.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23168
Entropy (8bit):	6.714497820260192
Encrypted:	false
SSDEEP:	384:gWf4jpVGSK0YEcHI50x+UtH6fDouT09JTXEMOuj4sBlHRN7oG2teR9zbof8Bo:h4jpgoN+q0AkuT0gqjzjoG2tC9zto
MD5:	7584FF185F3686093F06589EB8BD48C8
SHA1:	FF8FDB910F3D6BCBB83F180D0058F417998A1A51
SHA-256:	6B39FAA22F0C5508E69D638A28EAE473982DFAEDB728F3B90EE09B2C04A33816
SHA-512:	DA6C68BC8EC346FA988A11478D6ED04A94F7A6E5156B71CB9F46EB86BAA5B35F38B19321D6310B908D6444864D966AE7D5780201D91034AE77ECDE4C68313F97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!........................@....@..........................`............@.....................................................p....2...(...P.. ...p...T...............................................................H............text...F)......................... ..`.data........@.......,..............@....reloc.. ....P.......0..............@..B............................................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k.-.S.y.s.t.e.m.X.m.l...<.....F.i.l.e.V.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework-SystemXmlLinq.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.665837941142317
Encrypted:	false
SSDEEP:	384:7WrM6eAzR+HklIIzWsBlHRN7wk8G2teR9zboM:sM6r+hIpjwk8G2tC9zT
MD5:	14895D307876AE831179DB147C3496F1
SHA1:	C361DAABC7C601A0FEE781F44FA30C9D213DB9F6
SHA-256:	193EFD48915B426AE49AEF7D03B2C24C048CF1D3881DE29C8F9E04A9189FE9FF
SHA-512:	3839133FD7959AFA289005116BAA4B4AABBB573A29B0BE96B6FF18AECBCAFB17502A715BF5F1C22F04A9CE1B1F1B7818E0ACDBD0856891F53EFF1FB90E23729A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........................0....@..........................P......B.....@.................................................$...0.... ...(...@......p...T...............................................................H............text............................... ..`.data........0......................@....reloc.......@......................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k.-.S.y.s.t.e.m.X.m.l.L.i.n.q...<.....F.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Aero.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	437376
Entropy (8bit):	6.615854117738076
Encrypted:	false
SSDEEP:	3072:iTCAexU/eAnkXFuW6EMxNviuXdyLIk9K19k09Bavak1ZjfWpSHBnnnOMMJe46zrD:dxxnMNviuXdsIk9cKakv0wnnnpLrdZ
MD5:	2958F243323857CEA80EC54A5D3144CB
SHA1:	863BBD25CF5EA11AB377C14218DF99C0CF5FADFC
SHA-256:	09644898C949758464D057DD3B6319678BAD70D824FE8405FC49E62C2D108217
SHA-512:	64372C5B94A8EDDC2BDBF5FCB536464182DEAFABA4DE261447E886183FDA14A3C45BF9F623D4AF4F085CC5C5D9E37525C1ABED8124F68093E0C5CCAE93253CC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W.............!.........T...............@....@.................................@.....@.................................................0Z...........(...`...5..P...T...............................................................H............text...t,.......................... ..`.data........@.......0..............@....reloc...5...`...6...N..............@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...A.e.r.o.....<.....F.i.l.e.V.e.r.s.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Aero2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	443544
Entropy (8bit):	6.612157969273168
Encrypted:	false
SSDEEP:	6144:tEJP7nVEPdTq7Ygmqgwh1AOzPstKakv8Nnnnpwr4:CP7ne1OlmqgO1AussakvOz
MD5:	09D9C97485A40124DBCAA7E8AA1679E8
SHA1:	5BA99E7D4E3623C78350997D82DEE04E0740A1DB
SHA-256:	6DA981C5A001EDC2F1C3B26A16424096A79201D8AC57E7224A414A31968E9B42
SHA-512:	87F563E69B5DC68C3D6442EB7838F0F03AC180D9B274015AE22F97E52ACFABC8C56BF1AEC4D1938FEFFE47AD1FB8A0B67F446AFBA8D11D6A2255FE253E3C621F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wbP............!.....F...T...............`....@.......................................@.................................................0Z...........(.......5..T...T...............................................................H............text...$D.......F.................. ..`.data........`.......H..............@....reloc...5.......6...f..............@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...A.e.r.o.2...<.....F.i.l.e.V.e.r.s.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.AeroLite.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	227480
Entropy (8bit):	6.555154844039846
Encrypted:	false
SSDEEP:	1536:1Lmd/p/uvhHTEk9T7iMwVNSPoV66yEKMtqWC6XOz9MFhpLBS+FN6LsbPCXbPyClv:1SV05HdISwFhU9G9LYlZStcE16zrhD
MD5:	6409FF478C44A687C9079F8E29F49597
SHA1:	87BA3052CEE61958877AF239D672F3BB7782437E
SHA-256:	2C0F6CAC9CA984FE2E67D005A938FFCA516952C98869E275A65715B3A08A3516
SHA-512:	DECE5CABCCAF0CD54DEB5A6534D2CE23DBFD596A52118CF3AAC6343875F7A259CCE202D6196BBA947BCA0FABCE6178F9A557D0DD7777283D5E4C554B584272A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!......... ...............@....@..........................p............@.................................................4&.......P...(...`......4...T...............................................................H............text....,.......................... ..`.data........@.......0..............@....reloc.......`.......B..............@..B............................................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...A.e.r.o.L.i.t.e.....<.....F.i.l.e.V.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Classic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	265344
Entropy (8bit):	6.653584325277015
Encrypted:	false
SSDEEP:	3072:S5X7U01Flqnp0VyafmcxLnNBPTM8rSbWNay:6LU0PonpUyafXng8j
MD5:	817A46D50B6A6DDEEFAC77F1A67256E5
SHA1:	340E0D869767DD8D78DD3B75C9BB857A9860329A
SHA-256:	14386EE70FEE4CD89CCA5EAD958D1DB50932121CE0A8BB8F9B6A02BD1C4891CD
SHA-512:	B811B8D3632D479F22E7A1508FCE1C9D06EEBE93A66EE6EB2109857716FE0CD7553AB1802E457EACEEBA5957B8601AD66BB6368C301A08E50D75CFEE920B020C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.........*....................@..................................f....@.....................................................(........(..........,...T...............................................................H............text...S........................... ..`.data...............................@....reloc..............................@..B............................................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...C.l.a.s.s.i.c...<.....F.i.l.e.V.e.r.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Luna.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	660096
Entropy (8bit):	6.539098667729267
Encrypted:	false
SSDEEP:	6144:MNfaM1AgqQB7GiOKyg1pury1j7SPgqfd77otORaMgwa7Uo6r:M9aMaSLOKy277SPNCt2VgxwNr
MD5:	CD91E5BBB9753A43DFF38E3CC766A2A1
SHA1:	3E06F05CD512161EDFFBDF35A46731B8056CDA07
SHA-256:	F0147956D48DD994CC4172E3BF603B3CE68EAB49BFF29FDEAFAD0778FF9D598F
SHA-512:	6CC849B86B6DF2100FA7D3B143396DC35859E0BF45278ECB82DA3F3D11E62D074A866DCB37BDF3A8220A5B64F5425AFF62737510660B26D665A87351718634A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=y.............!.........H....................@......................................@.................................................LM...........(.......+......T...............................................................H............text............................... ..`.data...[...........................@....reloc...+.......,..................@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...L.u.n.a.....<.....F.i.l.e.V.e.r.s.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.Royale.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	321176
Entropy (8bit):	6.623101703804427
Encrypted:	false
SSDEEP:	3072:YttIPvH96Xcfb81vFdqVdQTUsrpN3qCEgtPEHtBEVu5Di67:qtInd6Xcfg9UVdQT9/a+FE
MD5:	28D3B28CACE130386E6A21734B37C4D1
SHA1:	0992BCA575789EC6A99EBCF2E122DB3F00E871CD
SHA-256:	619B5C5F2BECF9AC378AEB3E6D1ADCF5DE11B8547DB9E7C00FF62051E1016E77
SHA-512:	9979895A9E891CD7B014B645275A201E59053C9930DD4F27381D5512FF070FF756ACCCA7DAF377B22D0DEEB994BCAB457E94E1931972A3EA0DB440C8FF893D0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.............!.........6....................@.......................................@..................................................?..P........(..........l...T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...R.o.y.a.l.e.....<.....F.i.l.e.V.e.r.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationFramework.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15319168
Entropy (8bit):	6.950453142505037
Encrypted:	false
SSDEEP:	196608:6JF+CY/beiG448YWZ7+ep4U82Ly6RwobgHsF9lq6d15QVtczpcaTBQD:s4RAk7xqUzLy1tH+dbQVtctY
MD5:	9649B07CD8C01DE9D403707FF2218AC0
SHA1:	D66858BF8418B853C1CAECF5D770962D9123CCEB
SHA-256:	45584C3624AF54A43C92A704D64ABC7EBAB385B94FE7724B6A0772EA434BEBC8
SHA-512:	2C26A22BE8CE7F3C8B8C0EEBA7E7160D94CE32146C9B6A18A5B10CA224B09F33924FA80E1E742B6FD47DEEEDF4B5023B98EC9F36A33DC2B80963C897076CCB0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}.............!.....n...(....................@..................................n....@.............................................l........T.......(...p...;...K..T...........................................................l...H............text....l.......n.................. ..`.data...h............p..............@....reloc...;...p...<...\..............@..B............................................................0.......................\.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........t.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...P.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.F.r.a.m.e.w.o.r.k...<.....F.i.l.e.V.e.r.s.i.o.n.....6...

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationNative_cor3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	945792
Entropy (8bit):	6.318504450794851
Encrypted:	false
SSDEEP:	24576:wJQpdqN1lIVio1Dh83hg6uG6vwKVS6CbcnHUWfrJ91o811VPTzhv0:wmpdqN1lIViiC3h/uxvvHUWj1N11VLzi
MD5:	D65921703FE4D796E0D16B6D03810E76
SHA1:	AF70D5178DFF1AA3DF5528C620682CE39D668932
SHA-256:	F2C1E09BBC96B937BCE16C513C22A96CE0C87A0E76438E84CA637A81495CA27E
SHA-512:	BF79DFCC21926FD7AFA19C6E6C4F6A88030B8C73E02E82263346E516E5995ABBF2BE52FAC09E71CDF9EC171FB37E7C2B66507DD82C147431AEF2C7F119F5E213
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................s...................................1..._...1......1.......w....1......Rich....................PE..L.....+b...........!... .....Z...............................................p......U+....@A............................\...\........ ...............F...(...0...;......p...............................@............................................text...*........................... ..`.rdata..............................@..@.data...\|...........................@....rsrc........ ......................@..@.reloc...;...0...<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\PresentationUI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1220736
Entropy (8bit):	6.805347646639282
Encrypted:	false
SSDEEP:	12288:tI9Sr1ZJwwGlyTcnsQfoVGd3HyGgmSl4IBNe0HRr8NAULOk:tIEr1ZFGlyfQfoVGd3HXS3B00xx9k
MD5:	9563C597757679B76161B295BEC244D1
SHA1:	F267469EDAE0F6089DA59A7F9EFDCCD8B637C6C4
SHA-256:	B3F4402B6E734AB08EE3B1E9A2DA302A9BB294D9869F77268ADD2A28406356FC
SHA-512:	2BFB5D511E3D8946455DFD4568D29C60231AA20FDBDC5C6D0AEB5F49B3643A8753DFE5369897EC019485BBAD9582CA6D8C77D16334D750C02292AB33C2937647
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.............!.....L...*...............`....@.................................+E....@.............................................<....... ...x...(.......~..\|6..T...........................................................<...H............text....J.......L.................. ..`.data.......`.......N..............@....reloc...~..........................@..B............................................................0.......................,.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........D.....S.t.r.i.n.g.F.i.l.e.I.n.f.o... .....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...F.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.U.I.....<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.2...

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ReachFramework.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1530496
Entropy (8bit):	6.805838609007631
Encrypted:	false
SSDEEP:	24576:R0JYsn2v7kjMo/OqDnBuF16aAxSEDVrFwKc9c5naYWaK/qGET0Rt2hn5LigSSLjd:i2AJ/LjYWgZteeAB
MD5:	A28D273CCA9A2EEE1CF5E3158BF41D29
SHA1:	7511007ED956247ACB4A72BADBE800E126D2A297
SHA-256:	58555B1BBACC2A06A21F4B80D685994BD93F684150D11F4BE0E36A6200674636
SHA-512:	51A26DE1EE95E2481E5FC715CA6C260DC53E77A65690AB1A48E84D91980800701232CDC5249E6B8D5429C86778CC697043E5FA25B2E7ADBD53355D74686B3EE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8,............!.....6...................P....@..........................`......*+....@.............................................<....>..xk...2...(...`.......j..T...........................................................<...H............text....5.......6.................. ..`.data........P.......8..............@....reloc.......`.......@..............@..B............................................................0.......................,.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........D.....S.t.r.i.n.g.F.i.l.e.I.n.f.o... .....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...F.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....R.e.a.c.h.F.r.a.m.e.w.o.r.k.....<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.2...

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.CodeDom.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	434840
Entropy (8bit):	6.683613557352006
Encrypted:	false
SSDEEP:	6144:3DcWcfVpCQ7pk1gaGne1PsJWlqfhF3yY2tS3Ssp1wTyq:TcWKpCQ7p6gaGne1tSCY2tsbpSTyq
MD5:	450C77E7A3220F3FABD97DF3E3C08A61
SHA1:	681E9C2BA2BE8C617ED00CA421D4C43E7663C980
SHA-256:	03364D9F2748684519C9ACF3C76B4431C2F7D6A1B7F771F28A000A53052F5A64
SHA-512:	1C4B2510ABBA3AEFA13C022729FD80A27E40018082FA0D12F9547A13FB0A1D61DA7802CC475D6EF000777407DE6FB5B4661B99638C6F5F615CA9978FA7087318
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.............!..............................@......................................@..................................................k..8+...z...(...@..(M...3..p...............................................................H............text............................... ..`.data....L.......N..................@....reloc..(M...@...N...,..............@..B............................................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....:...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .t.h.a.t. .c.a.n. .b.e. .u.s.e.d. .t.o. .m.o.d.e.l. .t.h.e. .s.t.r.u.c.t.u.r.e. .o.f. .a. .s.o.u.r.c.e. .c.o.d.e. .d.o.c.u.m.e.n.t. .a.n.d. .t.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Configuration.ConfigurationManager.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	894104
Entropy (8bit):	6.814299588643024
Encrypted:	false
SSDEEP:	12288:tOjsJG1pfOsdV0Z8oApKK1sPTdokGH5OTNWLOdqSptDF7zIg72FakfwQ8gILMcCs:0tmf73fg4OxyBwQVXFnvoaA5TpjA
MD5:	B853D80A884A3490314C7093E7B2C1EF
SHA1:	103321C141D612437892E3AE92568B68A649DC4B
SHA-256:	E21516FBE9EFCFE26608C52358E8E45C9C5369121E9A1D96D54D9E393B79146B
SHA-512:	B47CC7A011468CFC00B8E790BD427EE0FF8805140359C1D6875542DBCF335DCF6613F70DABAD859F2B97783F886799A761E8A2C6B2E71F40D904006DB3F95075
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....~........................@..................................=....@.................................................p...xK...\|...(..........XI..p...............................................................H............text....}.......~.................. ..`.data...pw.......x..................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .t.h.a.t. .s.u.p.p.o.r.t. .u.s.i.n.g. .c.o.n.f.i.g.u.r.a.t.i.o.n. .f.i.l.e.s...........C.o.m.m.o.n.l.y. .U.s.e.d. .T.y.p.e.s.:.....S.y.s.t.e.m.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Design.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21632
Entropy (8bit):	6.388953176871843
Encrypted:	false
SSDEEP:	384:1HU9BPrLGrw/ciY/tGA+e1LyWeHWtsBlHRN7LVOY/wR9zQE:14XGrwYtGA+O2RjX/M9zT
MD5:	901D4A024B2A4E1C318E22D3125E15AF
SHA1:	E76DC2504EE533C728721FD62E1AAB1AB3AF7267
SHA-256:	010131C1681B2DAE267D372C55C3BCFA58E8C2D8926C9036668875848FC6784E
SHA-512:	9FFBF331E5140AC0DBD1FD9FEB2262D4DAE54FBA0282FFF0A4B2FE343CE30F4A99F6BE699A25815542948839D0F78FF85FF99D90ED8603739C30C705779A263A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....T..........." ..0.."...........@... ...`....... ..............................z.....`.................................s@..O....`..h............,...(...........?..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc...h....`.......$..............@..@.reloc...............*..............@..B.................@......H.......P ......................\?......................................BSJB............v4.0.30319......l...4...#~..........#Strings............#US.........#GUID.......X...#Blob......................3............................................................Q.................o.&.....&...T.&.....&.....&.....&...;.&...e.&.....&.../...................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6...y.6.......................#.....+.6...3.Q...;.^...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Diagnostics.EventLog.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	278168
Entropy (8bit):	6.821572043244716
Encrypted:	false
SSDEEP:	6144:NU0cZ7p3Xy9KNfKdIybnAgSbbP+41CD8mDeyT:NU0cp3Zl+FteyT
MD5:	A52BE3C8E2D80849F9348237CA69ED58
SHA1:	A7DF4DFA97F2D746B7AD94EC6BB6BBA60FAB0E4D
SHA-256:	040F2E03AF949886D0C124BD35A2882FAE03805204CACEF335466F10666B0D8E
SHA-512:	269C0EC1BF9918A0DBA3C5DB00315D5E19DDB4A2E15158A1EFB8B907AEEE6843533B9A90ACA32E62CA3DAEE1F725F28E7888E4E82C862589E98172DF1E1891E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v............!.........R....................@..........................@...... O....@..................................................N...........(.......%...'..p...............................................................H............text............................... ..`.data....+.......,..................@....reloc...%.......&..................@..B............................................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...4.....C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Diagnostics.PerformanceCounter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	249496
Entropy (8bit):	6.766309955099142
Encrypted:	false
SSDEEP:	3072:ZoKrLYlJ3pm6N/+i+lbvCBCHNHeNhhaHdUoRBEb1qtiFedyUV4KJ5YCZ8yEfrVl:n/im6N/+iEbCM3ZObAikV75JZf0X
MD5:	039E2116C01FDC881C466A45C8A6063D
SHA1:	2DFAD078A24DFC4F723CD2606DBDAB0DE48EABB5
SHA-256:	A3D06A4AF014D349F3765AD93674908BCA4BD77C5FC2E40131EA81FB0B8D4FFB
SHA-512:	E7B16302FCB1E5645A513A0E6747692B3D634B99343EA121FC9EAB2F58B549B322F3B64CFE6D8EFDA4862C619A45E77D9E585D3C209C176E6FB702AF07B6805E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.............!.....Z...J...............p....@.................................b.....@.................................................(E...........(....... ...#..p...............................................................H............text....Y.......Z.................. ..`.data....'...p...(...\..............@....reloc... ......."..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.DirectoryServices.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	939136
Entropy (8bit):	6.770089046039915
Encrypted:	false
SSDEEP:	24576:6fVThSlx46FmdHDy1FCtLwSTRpf4P1wEI15W40+PXpg7P/EdP5:6fVThSlx6TtLwSTRpf4P1wEI1A4XW7nm
MD5:	052C75447C6BB67EA598FF72AE90F9BA
SHA1:	2537156DF05A3AA2C08DA93F8AA9C66F8008FFEA
SHA-256:	C29428E6DDEB68E1B3A7D4C14496C35232C0E387534B13387CF1F862A2C97519
SHA-512:	AAE7E8AD2C3F2E9BF1E5801BDB8F8CA353A97AA895CE519A27AB5C2550F0D16E4238B8BD8A283B5530B98CD1FE0119FCE6F9128B6C39AFD160EF530CFF77CCCF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!........."............... ....@..........................P............@.............................................@...h....:...,...(......l...<N..p...........................................................@...H............text............................... ..`.data....o... ...p..................@....reloc..l............z..............@..B............................................................0.......................0.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........H.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...$.....0.0.0.0.0.4.b.0.....j...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.Common.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	955520
Entropy (8bit):	6.682441891186567
Encrypted:	false
SSDEEP:	24576:Qu2cNZdGnYLQAIG0tQXEQ+t/oQPle+Od5c+kAF:Qu22dGYqQXtMoQPle8QF
MD5:	3DEDF7BE4A1E0228559E467D2424A092
SHA1:	B5901EC38523D7AF2476C5B058047894CEB0DA61
SHA-256:	53E9AE407E591CCD85CF9E67E5B81CFFFDC3C42695C6C8176CC7758D94010B02
SHA-512:	30EB9E2DD30C44CB63E5FC9E67D4A4D1112B46FB65E68D058D75D8E941FDA4766724FB645DD8D2E461B3C0CF4BAD616340F82E1963B9B7D5D04564B02E48FD05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J............!.....d........................@.......................................@......................................................O...l...(..........V..p...............................................................H............text....c.......d.................. ..`.data....\|.......~...f..............@....reloc.............................@..B............................................................0...........................@.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...\|.....0.0.0.0.0.4.b.0...Z.....C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.Design.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.78896180781528
Encrypted:	false
SSDEEP:	384:yW7sTXXtoWmBW4sBlHRN7wvPVOY/wR9zQn:y4umCjwr/M9zC
MD5:	0F563F0BD6D998A042D98AFFD6C5D816
SHA1:	7791E6F71D9E274C0DA0EA2AACC007E3BEB6D148
SHA-256:	32D03FF5CD0FA16A2435172E154C2E9300F3D92B8DEA897F4DE37E5CC4455D2B
SHA-512:	F62F9A642A69D9F179ABB46D34CCA389D1C0222FFDCE35E5759936BDED445E832FECE76C902E469ECC917C71C611130C985DB9444630832F806CD950A3D33ECC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{]~..........." ..0..............)... ...@....... ..............................o.....`.................................[)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................4(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....p.......#US.t.......#GUID.......`...#Blob......................3............................................................U.................l...........Q.......................8.....i...........3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.6...3.Q...;.^...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Drawing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.415830131691814
Encrypted:	false
SSDEEP:	384:jnG5P7VYrYOjT/vnTFvZWbtWhsBlHRN7ojSCGlD/LVNSR9zuF5i:jnvnoPjDxLVNe9zQ5i
MD5:	98D36D0BB9CDD8B2DBC6511638AC6B77
SHA1:	48163BD2654F0B2ECC39A7E54590A798045B21EA
SHA-256:	3F75D6680E3336677B067FAC51631EA9E444410D780E53A67A41E3A412418DBA
SHA-512:	06CF6D2B5B3EC79281530EFD3C6D36ADF334B54312C7098DA5507BF56DCFF773623D1EEED6AF42674FDFD0B0247215A5C44EC5F33EEA07401ADA659C791A4853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............" ..0.. ...........?... ...@....... ..............................I.....`..................................?..O....@..x............*...(...`.......>..8............................................ ............... ..H............text........ ... .................. ..`.rsrc...x....@......."..............@..@.reloc.......`.......(..............@..B.................?......H.......P .. ...................p>......................................BSJB............v4.0.30319......l...`...#~..........#Strings............#US.........#GUID.......`...#Blob......................3..............................................................s........... ...u.......................".....?...........................................O.....O.....O...).O...1.O...9.O...A.O...I.O...Q.O...Y.O...a.O...i.O...q.O...y.O.......................#.....+.?...3.Z...;.g...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.IO.Packaging.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	252568
Entropy (8bit):	6.651513372669714
Encrypted:	false
SSDEEP:	6144:9M642kpPLO3MwEUG0Mi49UQwT98bvP+mPZP9ubGnX:9DnkpPLO3Mw7rMi4mQwTqP+Qub2
MD5:	E807E5F5353C39AEFC5D8F8A90247013
SHA1:	CAB0D3DA142F32A3B5A96E81266342BF333EBDC1
SHA-256:	FD0B48D5F9F9B6421E4AEE83B062389FBEF6FBA366DA97A8FFEBE880F257600E
SHA-512:	76853359C6EBFFEAD784D6038BB35F0D13EE41CDDB6BB654B4601572B68439CAA20D2CA69FA39F669DC5D93BCE0DB7F899A73A6850971630CC3F1391DD8B0759
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!.....P...`...............`....@..................................?....@.................................................,G..P........(......8'...&..p...............................................................H............text....N.......P.................. ..`.data....6...`...8...R..............@....reloc..8'.......(..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....V...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.h.a.t. .s.u.p.p.o.r.t. .s.t.o.r.a.g.e. .o.f. .m.u.l.t.i.p.l.e. .d.a.t.a. .o.b.j.e.c.t.s. .i.n. .a. .s.i.n.g.l.e. .c.o.n.t.a.i.n.e.r.....

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Printing.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	921728
Entropy (8bit):	6.735328593580699
Encrypted:	false
SSDEEP:	12288:eK2qYvWy+GVo/SJULaFTHKjrI8vD/0WUaifPglCJTU0f0XKr3lD:kHvvHKjrIQsPgl+Y0f06N
MD5:	7062610FE5FD891B5094866832BBA8CB
SHA1:	91FCB2928B4AFB94FFEFB7DD0B249A54EE91AEBA
SHA-256:	817082F08453FE94342795A7D4BBC0B24BA2AE5F88356DD04FB55AD8F8FBFDF8
SHA-512:	384FF47873214E20566A39CFE0FCD0C9CD4F9FD75FFFE4ADB5B025EBDC9F3EACB2BA9FD7A45AEC7A1B37A3762DB350D7BB2E8023D5A33CBC12A076E539626A40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0b...........!..............................@.................................k.....@......................................................G.......(..........0E..p...............................................................H............text............................... ..`.data...K...........................@....reloc...............f..............@..B.................................... .......8.......................P.......................h.....................................................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@......w@..?...........................8.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.4.0.9.0.4.b.0...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...P.r.i.n.t.i.n.g.....@...F.i.l.e.V.e.r.s.i.o.n.....6.,.0.,.4.2.2.,.1.6.5.0.3. .@.C.o.m.m.i.t.:. .f.c.b.0.7.d.6.3.7.a.b.f.5.3.7.9.1.e.2.c.5.5.c.6.3.d.9.2.0.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Resources.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111232
Entropy (8bit):	6.711097210336848
Encrypted:	false
SSDEEP:	3072:lzh6zBY7TfwugBPZXsRn4zdfbZ0IML8CZw:NQb/U4zRZlQw
MD5:	D3DC798D416B8F45354CEC9B8049028B
SHA1:	31CCAB018C85097589459E620F1A6D278C4A5B19
SHA-256:	ADA146F5157820E4288344E14BB597CDD6AF79E79C87ED3404122E6A7C927145
SHA-512:	3637345C4C526931B82F612D4F20A5C3A67E99A51BDAF20A71D724F2CE8089E7922E9993DD063565F074063C69ADEEA85406CD8CCCF98BBD75AE8F0E565C64DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.f............!.....`...(...............p....@.................................FJ....@.............................................P....+...........(..............p...........................................................P...H............text....^.......`.................. ..`.data........p.......b..............@....reloc...............z..............@..B............................................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .w.h.i.c.h. .r.e.a.d. .a.n.d. .w.r.i.t.e. .r.e.s.o.u.r.c.e.s. .i.n. .a. .f.o.r.m.a.t. .t.h.a.t. .s.u.p.p.o.r.t.s. .n.o.n.-.p.r.i.m.i.t.i.v.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.Pkcs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	719512
Entropy (8bit):	6.830888255454152
Encrypted:	false
SSDEEP:	12288:qXY8KVuU1H53yc1Dj8FiAnpCDCdBfpiMxXxAsU59Q/34nUryy:qW3ysDwiAnpCOdtoMxXxAsU59K3Gc
MD5:	E3DE3BE396C89BB5BADCB5D26606BAA8
SHA1:	A298E2E075783BFEB8CD8FB68960C85F3A1D4DCA
SHA-256:	2C61473D461352B25A987AD95E837549ACF996CFBE113E62F450D0374E21CC61
SHA-512:	FF89E0C3FD1842899A660700A3FB7BD6EE2C8ABAFECED9A1CADBCC76A7655FBECD0D7E50A04F1B0BC20F40E0BA7090B6A7E003C1D16F8B87BE5CEF5FDFBDB19D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E............!..............................@.......................................@.............................................T...H...(+.......(.......g...D..p...........................................................T...H............text............................... ..`.data....n.......p..................@....reloc...g.......h...j..............@..B............................................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.ProtectedData.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42624
Entropy (8bit):	6.646626898068982
Encrypted:	false
SSDEEP:	768:MGUHnDKvKJ1PoiLYKFMxjJD4r7FKj1pMIw5bbSMUjNg5jxtpxLVNe9z/:MGMnD8KPTLYhtaFC6v5HUjo3pnNaz/
MD5:	02FAEC591CCC6AC32C07D6FD0CD9C715
SHA1:	1BAA7FB568367A3E7910CED052D0260170B3D301
SHA-256:	A3D0606064AF7BD8CEAEDF70FDC9AC52744C512682D171BFEEF1450A6BC27EDE
SHA-512:	D118754431C6B93FA825257724CA694B943AA578B370AC479F31F9F9464C547233CE7F501036385BD5DA1333CD933B1ACABF25E73FD3EC77BD0473FE5312FDBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!.....t........................@.................................D.....@..........................................................~...(..........4...p...............................................................H............text...er.......t.................. ..`.data...9............v..............@....reloc...............\|..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Cryptography.Xml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	394368
Entropy (8bit):	6.721384679750264
Encrypted:	false
SSDEEP:	6144:jPFTB6o3mz8GwZF+UpVEIdYADsJ51xwoqOr/QuEHd8bO5SPSBMXZdYTe:j5B6dz8GwZFTpiiCOIZ4e
MD5:	D003EE3BB9C284106B33346F4327F9A5
SHA1:	E5E10CD163AA2BCA6B0A1BDED60AC350B4339AB5
SHA-256:	E30B9465559458B0D816DB1CC8D984AE5774F752E5608CDA4E5E1CECDF8E02BC
SHA-512:	837E61F58F7F19F22E239FEAA86E663C0A0DB8034361E82EA85DD40A098B34A99267ED58E518FA2438E78AD4C12AD2F50BB36EBDCEF13F7BA2152B518EB3B7BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c.............!.....P...................`....@.................................d1....@.............................................h....{..`........(.......F..8>..p...........................................................h&..H............text...5O.......P.................. ..`.data...FA...`...B...R..............@....reloc...F.......H..................@..B............................................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.o. .s.u.p.p.o.r.t. .t.h.e. .c.r.e.a.t.i.o.n. .a.n.d. .v.a.l.i.d.a.t.i.o.n. .o.f. .X.M.L. .d.i.g.i.t.a.l. .s.i.g.n.a.t.u.r.e.s... .T.h.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Security.Permissions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	163968
Entropy (8bit):	6.246983501565745
Encrypted:	false
SSDEEP:	1536:iBqjlnxBjI1xb/rT3E9WKIdD4VsiIdmx6lEb35saMLTL1X2UZDdRMS41hp+eEeOy:iinv0KId3MwSrAQm+3KBGWjG7rc3KNai
MD5:	6DFCD0DB5D51DCA59D808B48315091E6
SHA1:	451DEFACD2DD197E823ADAB22C02E3ED99008D1B
SHA-256:	53C22D8839C1122D9F7EA15FE95435CC76BD78694AF55E9850096377D468794A
SHA-512:	8F6DCB137E2255C2B4614C140F8917EA0F61BB5B8AD10AA0CAD0D134F99E22129C85ABDC3F3E3FF7C96AC5EBB66CB9E45DCC06AED2FDCE04E2EE7C0AEF54F5B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E............!.....D...................`....@..................................R....@..................................................2...)...X...(...p......x)..p...............................................................H............text....B.......D.................. ..`.data........`.......F..............@....reloc.......p.......P..............@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....6...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .s.u.p.p.o.r.t.i.n.g. .C.o.d.e. .A.c.c.e.s.s. .S.e.c.u.r.i.t.y. .(.C.A.S.).....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Threading.AccessControl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68736
Entropy (8bit):	6.543951356563944
Encrypted:	false
SSDEEP:	768:G9oaDrrBfsrIzXh3OhrIRRCxb3Gu9ffS9PVOISS2z6G2Qgj1pos29zkF+:AZO4Xh3Ohr3H1Sj/cz6G2QA1plCzF
MD5:	57CC95B467E94B5F1C5B660224F5A492
SHA1:	C64C6F69A8382F84EEE7E7163F13A7061B82F077
SHA-256:	0E1EB9EC8FCC2B40F2D4B3321EBCBB3DADBFE12CB9F8C542334809B7E9467175
SHA-512:	ABC7B41D53DAB4D32682656B569E0F59B350425C3E6374ECDEC3D06A139321B7AD63E6A38E91C7BDC87724F70923D2488A2B48783FDBA4328D8FACAA10F14434
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~.(............!..............................@.......................................@.............................................h...<#...........(......\|... ...p...........................................................h...H............text............................... ..`.data...............................@....reloc..\|...........................@..B............................................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.....k...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Controls.Ribbon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1407128
Entropy (8bit):	6.821238240079108
Encrypted:	false
SSDEEP:	12288:DkiFlRYS616HJ6udAE+bMv/vAcN5q1zthLuoE3euAiwI/qTbjpKOtLR:YiFlRYS616HJ6udRvHAT1zPLXHTgOtN
MD5:	D7994E854D4F023AC792E95861D4827E
SHA1:	C838BB4EBEBC85BD3F61CA6EC109EF0172658C00
SHA-256:	1AF77C313495D9842CECD332E3CA4D39097862319D148D84342C4221C7C78B3E
SHA-512:	2E617A71D47956721F88E17938DB603B9422DB731C68ACE28453178A17BBFAB56AAC6135D00389E7CD547CE0F27086C6510C0D38C253FA6BF0F9150C7B1B11AE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9xm............!..............................@..........................p......'.....@......................................................_...P...(......(....R..T...............................................................H............text...{........................... ..`.data...n...........................@....reloc..(...........................@..B............................................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...W.i.n.d.o.w.s...C.o.n.t.r.o.l.s...R.i.b.b.o.n.....<.....F.i.l.e.V.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70296
Entropy (8bit):	6.670555231408415
Encrypted:	false
SSDEEP:	1536:Wn49v4GkuTZTxjvfTb9fdZN9xhadYN7kZVYAA5xjKcFTC2zU:WSvMiZNjsdYGHYVxjKc1C2Q
MD5:	542E0623FF7F8FD36C796C33DD59DF27
SHA1:	F17D0E0D39BA657F5C2092EF8BD7F832A4693A27
SHA-256:	9B3448DDFB14934FA038DF0A3FF6D1A5DDBEFB25EA3BEE2023DA49C943BEFA1F
SHA-512:	09BA21ADB073D16A36A418B522E0035E81ABA317F8E491B22FBBFCA7901BC73326B60554222B8B97848092113DDBADBB893C96ABB00AD81C161C71A3AD53E679
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(X.............!..............................@......................................@.................................................."...........(......(.......p...............................................................H............text............................... ..`.data...............................@....reloc..(...........................@..B............................................................0...........................p.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...t.....C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Design.Editors.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.655659778428869
Encrypted:	false
SSDEEP:	192:PNq/Zn7gxnDW8BWsmZWo0A2j9seHnhWgN7a8WWw5JVOYOg8nK4X01k9z3AvJ9K:P4n7+nDW8BWxsBlHRN7AnVOY/wR9zQJE
MD5:	28C5374C734545C8FD32FE45D9A3F787
SHA1:	01E01DAF73A13BC40F745553D5A42300327B4867
SHA-256:	D344DF7CFA4041A1525AEF0F82EBAEBF4D0DC706C06F2EF4996C4D430D64A696
SHA-512:	62D86B1C4AE7A6BF5E5A145936BD1511B96140C23CBE5C3CE0B5C2609AC82D7C50605665A104B787DA73B1A09155DCB07D631B3EAEBAB7A1EC7200293DE3D1F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.............6,... ...@....... ....................................`..................................+..O....@...................(...`.......+..8............................................ ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..L....................*......................................BSJB............v4.0.30319......l.......#~..x...T...#Strings............#US.........#GUID.......l...#Blob......................3................................................6...........s...................a.....a...o.a.....a.....a.....a...V.a.....a...7.a...Q...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.6...3.Q...;.^...C.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Design.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5005464
Entropy (8bit):	5.908753660383853
Encrypted:	false
SSDEEP:	49152:D0iyKkE3aCz1iP1kAJw/kaw8iAx+TPRgUyiz6eVa:D0/KkE3rsN2szAQyiz6ec
MD5:	330C42FE91B30A165F31B4DCDD1A94F1
SHA1:	8E0E616AB69ED25A507DE99543C2F40F11D841D2
SHA-256:	C5F8455F595CAC8CEBCE0FA3DC861CFFA25EFF71791809939AD8A7D5E9BB9A98
SHA-512:	833A913243C0884A8AAC75FBF987FFD574ABB98CAE93C4A535D29B0CF261CE77615F9F3DFC35D325A947AAD738C86873574CD52C2467C237CE55DF50DA675E53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....RH..................pH...@..........................`L.....(kL...@..........................................................8L..(...@J.0...L...p...............................................................H............text....QH......RH................. ..`.data........pH......TH.............@....reloc..0....@J......$J.............@..B............................................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s...D.e.s.i.g.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.Primitives.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	739992
Entropy (8bit):	6.513578974973474
Encrypted:	false
SSDEEP:	12288:FNlbQpYzbhJX4R8tMRZS001GHi7I5Vp0oDcNSFfyV:flbTvhJW8YbNV6CFE
MD5:	45246507E72187D7C14E3F62E6C43372
SHA1:	C1E255C6FCCD675090B56991B5697BC99E2177D3
SHA-256:	01EEDCDC485EE8C2C1A0F55BD182B7A0871547ECCD2E5C78C28A13C30A6AA71D
SHA-512:	2C72AB17460B55AE243FFB654ED5049E948F855472812DFA1CE6547A7312444CED5839FAF2E9CB2400C839C4F997E067BEEE14206272D44A7DDEA8BD28BD8D26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V............!..............................@..........................@......R.....@.................................................ts.. +..."...(..........<6..p...............................................................H............text.............................. ..`.data....W.......X..................@....reloc...........0..................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Forms.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12487296
Entropy (8bit):	6.5023119254152615
Encrypted:	false
SSDEEP:	98304:iTy2W4/9S8KhJZIvJ+ugj+t/oPL0J8VI1bt7E4IRXRoxmDP1of:yRW4/9S8KZIvJr4+1LQIdt1ko46f
MD5:	0338636C96EF552441C7A44CCC957AA8
SHA1:	E6E3AB427B92F8CB58775D5B1F8C58654084840A
SHA-256:	2FC83EBA72E0FA52ACA96A9892F62ECD1FFFE124F01902D0179C5011DE8BBAAA
SHA-512:	F894614A330172FD97D0C6D9A746B11B7CE9F19F64CEBEBC1B08A6936E3C075994AA2212AA99201605EE4A2365E07A3D7F29876A94D57413AC1132DFB33A6A31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!............................@......................................@..................................................... ....b...(... ..pa...*..p...............................................................H............text...N......................... ..`.data...(9......:.................@....reloc..pa... ...b..................@..B.................................... .......8.......................P.......................h...................................................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Input.Manipulations.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	120984
Entropy (8bit):	6.673220045689059
Encrypted:	false
SSDEEP:	3072:9UMCCGZb9kj4CgLIWstIaXYIj1xZGwMbTyh0Qyvf2:JCCGXkj4CgLIWstIa7jfZGzGHyG
MD5:	26422EE1E4E06B14A6B5E94E910FB744
SHA1:	F88629FC764BD8F54A3045A3AF191C9ECB172EF2
SHA-256:	454E58C7033F7D4045637BAC5072F2FB74BCE2522F79C32B0E3266504C6EB13F
SHA-512:	64000823EEBE134836D1BB12479D6CD599E0AAD82DC28BE7547251435E0AB28BEEE60888552D2FC9DA6202F94480D4B3BC1775BA06CAC4CB8F2EC1E1EDF03C64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........$....................@.................................;.....@..................................................)..H........(......x...`...T...............................................................H............text............................... ..`.data...............................@....reloc..x...........................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...n.#...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...W.i.n.d.o.w.s...I.n.p.u.t...M.a.n.i.p.u.l.a.t.i.o.n.s.....<.....F.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Windows.Presentation.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19072
Entropy (8bit):	6.633859090316571
Encrypted:	false
SSDEEP:	384:qWjE/g1mwpyZVjj1LA4VsBlHRN7svnG2teR9zboTt4x:fEvwULAbjsvnG2tC9zstC
MD5:	254A70C73DB88E5F251507C2FAC400DA
SHA1:	4DE2701F2C8F942177112451A4F5EFAFDC21B24F
SHA-256:	04E250C8AB59F724C3D97FFBCA90ECA6C362AF54F529D76D94FD23FA7D49A255
SHA-512:	F9704512DD5B8130CA737E376CFACB1A1732360C3E46C5FFCB2BA29ED56C9CC3AB8A1069208E635F2648208320F02827B4D0D849C857153201082220BEFB9EDF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,Z.............!.........................0....@..........................P......;(....@.....................................................H...."...(...@..t...4...T...............................................................H............text............................... ..`.data........0......................@....reloc..t....@....... ..............@..B............................................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...W.i.n.d.o.w.s...P.r.e.s.e.n.t.a.t.i.o.n...<.....F.i.l.e.V.e.r.s.i.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\System.Xaml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1302656
Entropy (8bit):	6.77292826367323
Encrypted:	false
SSDEEP:	24576:7ceF9h1499F87Jr1UeXbwViP8dHNs0Z8yXI0:QeoZ87oeXiw0Zs0
MD5:	27FA83CF70C60AE3AF93DF65C1B7B721
SHA1:	7CF98824E1AF1E2EEB0095202218A34C5DD20444
SHA-256:	7FCC0CD8C3CCBB10AFB4E5A45074E3C1BC481030F0425107E001387C2BF3F328
SHA-512:	B57F36A137CDB79E48B3DF78B0C119DFC504312DD44FAEF6E218940C6027CE6375C266B08666FF32BF7864EE3732E35728D22B022B5608AD735215F01DEE9156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;*............!..............................@.......................................@.....................................................0n.......(.......... Z..T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........$.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...X.a.m.l...<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.2...1.6.5.0.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationClient.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	381056
Entropy (8bit):	6.740263262514034
Encrypted:	false
SSDEEP:	6144:iaduP+JxatCRVjLL1V6IFatB9x1s61xNhfpIhaVJJvBg:iaduP+32fjiaNhGharg
MD5:	92B1FB3236D666C290F98B1CF48B879E
SHA1:	E6BA70759BA66B4F4D2F186B401BB8A5C9A8DFFE
SHA-256:	61CE248B79FBE608459F7A62CC4328729DD14325D5745D30956C04E4C8A2C89E
SHA-512:	3EA4B2482CB0AA2454D4F751EE966CA4F67404AD1F6679CAF08C0B9AD7502D5AE750B9A64561A685877731802CBD7D2E25D4F47075EA452FBB94EB6C0B838914
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.q............!.....(...~...............@....@.......................................@.............................................\...0i..H........(.......9...'..T...........................................................\...H............text....&.......(.................. ..`.data....B...@...D...*..............@....reloc...9.......:...n..............@..B............................................................0.......................L.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........d.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...@.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....U.I.A.u.t.o.m.a.t.i.o.n.C.l.i.e.n.t.....<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationClientSideProviders.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	807040
Entropy (8bit):	6.861774761529863
Encrypted:	false
SSDEEP:	12288:dEa6B6LpiX0CSwlXrP4N4eKYSFPNl359E0+Rb/:dh6kLp+0CTD4NrSFFjcRj
MD5:	72F3081EC1A29A731D3845EF3ABA3433
SHA1:	CD1182536321BB24848C8734B5B49ABC34A5B856
SHA-256:	B83E0EE1797369C64F79DAE7670B501DE4D2BEE9EAD87AE5B2E9396F4CBF611B
SHA-512:	FB3194FCFD27A745332074491E1CFC8A7B1B875F3430BDF3349034D2488C99CB9C3A6B1752A109FF7F638CB76E1B61969E1816FF89CF8BCBE2C8770F970FCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g............!.....N...................`....@..........................@......,M....@.................................................4....<...(...(......pm..\=..T...............................................................H............text....L.......N.................. ..`.data....h...`...j...P..............@....reloc..pm.......n..................@..B............................................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....U.I.A.u.t.o.m.a.t.i.o.n.C.l.i.e.n.t.S.i.d.e.P.r.o.v.i.d.e.r.s...<.....F.i.l.e.V.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationProvider.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49280
Entropy (8bit):	5.987107830071623
Encrypted:	false
SSDEEP:	768:+lO300q7PTAWAS7fBk77N7TkAuGdnqjEezLeAsvX44HR7j0q76jX6xLVNe9zg:+liddqjEezh41j0CWqnNazg
MD5:	B1C2F814DEB783436258F063CDE1364C
SHA1:	65A6B472CC2AEF11732EE62A390C8218242DDB27
SHA-256:	907E6BD59CD79167B4BF511D4411266D888E17A6B3F3B9450D3294F63894A31F
SHA-512:	84B59148543B850BF37E9648353DC49673E0CF883909BD793C8CBEBB94B28E8CCB34DF444ACF2294BD7C7836C4878E127492E42DF6AB42489242F7D2513AD3A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[G............!..............................@..................................V....@.............................................l................(..........T...T...........................................................l...H............text...d........................... ..`.data...............................@....reloc..............................@..B............................................................0.......................\.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........t.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...P.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....U.I.A.u.t.o.m.a.t.i.o.n.P.r.o.v.i.d.e.r.....<.....F.i.l.e.V.e.r.s.i.o.n.....6...

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\UIAutomationTypes.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294040
Entropy (8bit):	6.203145734064159
Encrypted:	false
SSDEEP:	6144:uglUX04TMiSa3o4tk4JIdfAnaCNPpcOy2FRLuuvcp:+Miyb2yrqLuUcp
MD5:	F22550257B6D237D95E569FE326044AD
SHA1:	BB0582A3B9293970F9647AC3806DD83DE5D2E01B
SHA-256:	AD65ECF93E9D712C2E2CBC2DD3D56DF83580CE77155AC3AE714407CA09D04255
SHA-512:	724EAE23DC40D305E478972D94178853A2657FF126F79E0335D63141D078A0C28E51EA6492E06D34E9B0F7FAD1ABBB288BA4741B002F3B4912CE88561DDC6347
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B4a............!..... ...2...............0....@..........................p......K-....@.............................................L....3.......T...(...P..\|.......T...........................................................L...H............text............ .................. ..`.data........0......."..............@....reloc..\|....P.......@..............@..B............................................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........T.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...0.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...L.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....U.I.A.u.t.o.m.a.t.i.o.n.T.y.p.e.s...<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\WindowsBase.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2081408
Entropy (8bit):	6.688051291944773
Encrypted:	false
SSDEEP:	24576:Z9mSmRP2z8KwP3+v25KJDEttWn6BnCnXoU1Su16NbtLUSyUk2sWQ8OXc:2SmiI+ucMtWn6qTcu0btLtyj0Ic
MD5:	1D72A110F5F9C73D493C22DDD2C3D91A
SHA1:	4A8DB941E419F32D5A2E9997D929EA1006D47997
SHA-256:	E384BB8689477AD01934E4C16D0EF3D18930241AF7CE8516999FC07072BB72A2
SHA-512:	C6B86F436E4397E47B9339FEECFEBA5DB15B1B316D6028A308B68C68EA05E3A53C8DC53F36069686A7E50AFECD1F19F85089427190CF4FF43236FC2A5953BD64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.............!.....d...4....................@..................................K ...@..................................................\|...........(......D...0q..T...............................................................H............text...}b.......d.................. ..`.data...T1.......2...f..............@....reloc..D...........................@..B............................................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........$.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....W.i.n.d.o.w.s.B.a.s.e...<.....F.i.l.e.V.e.r.s.i.o.n.....6...0...4.2.2...1.6.5.0.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\WindowsFormsIntegration.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189592
Entropy (8bit):	6.682360230623695
Encrypted:	false
SSDEEP:	3072:sfaMDq/J9wNOlafaZemeMVTYXKJ54lTFlpPIUGEpQBW5eVJD4959Tl5qT0B9iKL4:yq/XwNAGQKuYXv5pGEn9RWsAyXUZ
MD5:	6FF5B369597C0E165D4ABB676259DFDB
SHA1:	165470852D403E6A64507C829AFB73563D380576
SHA-256:	47F33C9557710BF36519C02EFD431E91BC49C9F3B434B0D3E98106AB21FD33C6
SHA-512:	5140D1352310FECFE19EBBC217B51CFF7BA9ACDE9DD90C29501BE763A9F8B8455F238E4D737968DE8F0BD967F8635BD2935B70C3E139DB029ECAB04B39D3C79E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u............!.....`...Z...............p....@.......................................@.............................................\|...D8..8........(..............T...........................................................\|...H............text...y_.......`.................. ..`.data...g:...p...<...b..............@....reloc..............................@..B............................................................0.......................l...$.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................w@..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...`.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....W.i.n.d.o.w.s.F.o.r.m.s.I.n.t.e.g.r.a.t.i.o.n...<.....F.i.l.e.V.e.r.s.i.o.n.....

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.343752624405407
Encrypted:	false
SSDEEP:	384:ryVtXSXRaRgGYXdXxa3HNDQuEFX2h3DhT3HvCNszpoaWYHAhQ5W5sBlHRN7+iTN1:ryV0G7tEpsX76yG6jZTNx9zYg
MD5:	A55D1055F0D519EA471FACC220EC9D88
SHA1:	B8D13BB336865684ADFAFA8306B2CD375FC98E71
SHA-256:	7DE0CEA3EE57023DEC485CE25D6D7A12B2EED34CF034D55B6D22A027A395C2BD
SHA-512:	28D371FB419DD8679140149A49988B145A6523136CCB057FF14BD2098178E227676DBD78B72ED909DE25AE32118595667A269EB6FA928BF240FE5090A167E7E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...AD............" ..0..2...........P... ...`....... ..............................W4....@.................................8P..O....`...............<...(...........P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................lP......H.......P ..$...........t&..()...O......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@...................@...............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108672
Entropy (8bit):	5.552731802260125
Encrypted:	false
SSDEEP:	1536:k61jOiudK2xPb47PG3vvyf7oPs7rGPr+vbCh1gGfWlkoJ3Dvcf1lCz8X/:T1iZdK2xPb47PG3vvyf7okbqva3DvCC0
MD5:	DBA285C0D22A69B4D7C34FDE092674EA
SHA1:	C7EE0C87BC3234F8AE260415F0E75D227334D9C2
SHA-256:	E8BA313B3BA99AAC0DF9DBE26DFA8F4276307227CFC4A4745E272DEB5EEDCA74
SHA-512:	314AA00E445A46919B5C241450F022A8EC9D75DAFAB84247798D80B221E147FC59A79E399A22AEF357481722FB4674AE2F8CE10DEEC572CCFFCC2524D7D7E608
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7............." ..0..v..........J.... ........... .............................._.....@.....................................O.......x................(.......................................................... ............... ..H............text...Pt... ...v.................. ..`.rsrc...x............x..............@..@.reloc...............~..............@..B................,.......H.......P ..4............%...m..\.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.Y...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197272
Entropy (8bit):	5.4310490996135306
Encrypted:	false
SSDEEP:	3072:KZbHPmNMzn4KIr62w7irW9gmOlkOVujQi1oDdJQmRagCRvZe8tSwv0T8Z8Qyvu:KTROlkOVujQi1oDlbeZeJayG
MD5:	9ED33E0D3217E81BE3528BA3B6706C23
SHA1:	4FBE810398AA98864522FD4CD023F10C5C69B42D
SHA-256:	3B0A6D18B07B35E8EAB2CC27778958E4B6F519E6BE8FA224EDB288D2AB3623B5
SHA-512:	A9CE1D4AFE6BACD25B79C03A517969799CD129ED2D362BC3BAA6583ABB95189C883A2D97443A44D04D2A505A22783566B05614B6E9BA73BA495B356E622DDEE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... .......................@............@.................................<...O........................(... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................p.......H.......P ..H............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................^...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45720
Entropy (8bit):	5.783026483285544
Encrypted:	false
SSDEEP:	768:cH+UU5rEkDGt95ZHI7Q+COorA23FgdAbyJsZTd7miF4NORagVLA9OWy1jaTNx9zW:YU5rEkfk+COorA23FuAbyJsZTd7mEaQH
MD5:	F27C45F177D2F48B5C562D6C4B94B5E6
SHA1:	3D1636DE3D76FA10C7BC4751697F714C9C50B71D
SHA-256:	5257E4E96B04F0C84B84FE101645F5E83DFFEFE0D5D277C67B843E74CBD4ED51
SHA-512:	7D926805D8300E53B9D6C1D7879C6C3C6625BB3DC7039B4293B2E948CB854C1B4503A2571EC4F93691A4BB03CD1538EE76C61F891A9818BA13F16270B806195C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T............" ..0.............>.... ........... ....................................@....................................O.......h................(.......................................................... ............... ..H............text...D~... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B................ .......H.......P ..0............%...w..P.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.W...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39040
Entropy (8bit):	5.892687257539365
Encrypted:	false
SSDEEP:	768:24SzmZ9ewDSc2PpTzggPY2hn3sK3jjRsODMhlOLYIfUVrRGKUPGm4hFf7Yreyojj:ezmZ9ewDScDyc7y4zz7
MD5:	66E0A60DC8C9599FCA189A1E6D3706D3
SHA1:	D55E1E24720A61E484E849FC34823FEF1869F1B6
SHA-256:	715289E9C47A1747F0CCCEEFE85288151337E75653862EA220CAAC99AC751BC1
SHA-512:	D4A243226859EFF12046489128C83C77031353E7B3FCDE9B122BEE6539CE2879EDF8B2360082F09E003F1D8E99881BA25F0D5AE0B4BE066125AF351804FFACAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u............" ..0..f..........F.... ........... ...............................1....@....................................O.......h............p...(.......................................................... ............... ..H............text...Ld... ...f.................. ..`.rsrc...h............h..............@..@.reloc...............n..............@..B................(.......H.......P ..X............%...]..X.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.W...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.58035903577569
Encrypted:	false
SSDEEP:	192:UxVRzQ+7n8yzrEoEW1InxoWxC+Wo0A2j9seHnhWgN7akWJ6ks9gICQX01k9z3AF1:mh5hznuoWxCUsBlHRN77/P/R9zV8f
MD5:	F6918E8F4F98D4C2FE154324017C8FDB
SHA1:	614E5EA7A43C141681CF63D78E926694A4C0AA14
SHA-256:	2EE4B2FEFE8FD2FCB716C993C46AE3BD0F3F96831E1E485C5F8D9748369BEC07
SHA-512:	6398346B1F0264FE0562B88A96BCA3FFE53AAFAB49983830B1AD73D3B434F22D7DFF6960812A4D0C5F1834BCD49218740916B94F96F5D1062B7C6CFF28B7F43D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b............" ..0..............5... ...@....... ....................................@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............,%......,4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................g...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142464
Entropy (8bit):	5.52774799338215
Encrypted:	false
SSDEEP:	3072:k3R9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yn8ZCeLo98bB2Y3eRhwvMhAUlEL33:kCEL3eAVR6Ne3nzde2
MD5:	AFCDF8DDFBD9F0E2D3885763F717A3C7
SHA1:	8774657C89C22629867CB7936E3212F7A845648B
SHA-256:	066ED89A0E9D84E35D0285E2B56875891221418ABC441EE12E8E698676A9B4AF
SHA-512:	178D98CA7F165EB0899B39C54F9EA425CF5F9259360B77EF6AD22601A5EBC7221E37349BC411BE9A7205B64C3ACEE28FC31F0DA2F05FBB4FFF2C939610D9E18F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1R..........." ..0.............^.... ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H.......P ..P............'......p.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.772876299020861
Encrypted:	false
SSDEEP:	192:2T3ZNWtiWsx4Wo0A2j9seHnhWgN7a8WUT5EPCmJVOYOg8nK4X01k9z3AvLZpaH:+3/WtiWBsBlHRN7jNE6WVOY/wR9zQtpi
MD5:	B7654F5B88F4917B66B58828F4224B4C
SHA1:	9122D2B95FE46856ADE1E4A59823979A19A26553
SHA-256:	869892207ED85B20322249AE956D05A5B9DAA7817C0E621AB0ABD68FB4588C23
SHA-512:	948FEB3CDD5402B940B0CD23D9B09D963C35B1300B013CEC6CC2A421D08D555F5822EC1C964A7D61BD56084C82A3FC94B36703B7624BFE811C680423DA330F13
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w............." ..0.............Z)... ...@....... ..............................T.....@..................................)..O....@.. ................(...`.......(............................................... ............... ..H............text...`.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................<)......H.......P ..$...........t%......l(......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359040
Entropy (8bit):	5.389517801158498
Encrypted:	false
SSDEEP:	6144:z93jF6Lh0dj5lBWZ48i2sj0ReraGwYXPixp8cKgPRXl0Y9rniVTSqA9A:zxSbAY8JgPRXl0Y9h9A
MD5:	EC951302C864850E180E6FC171CCB3C5
SHA1:	B485A67FAD9CB2555E6B790CB76F3684C5038432
SHA-256:	C989D890CD279059F351B2C523B4ED311CBD19501C68B64AB50467E8229DFA07
SHA-512:	74769B7EBD091708271E8F7C3E178DFF3E2614DED99D5B8D88844B0DC11CD4EA0051409EBD8BFA9F0AD6A6DC6FB6F58DDE98C270026C77E6EC6EFDCCF8F1336A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~..........." ..0..H...........g... ........... ..............................WC....@.................................tg..O....................R...(..........Xg............................................... ............... ..H............text....G... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................g......H.......P ..`............%..(A...f......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................z.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.691495806018483
Encrypted:	false
SSDEEP:	192:tc4XIbUv+tJ4EjCH99ojH4WdGznWo0A2j9seHnhWgN7a8WCqL/JVOYOg8nK4X01E:lzmGyYWdGJsBlHRN78LRVOY/wR9zQjqN
MD5:	7EC41D4680630899729CB4E235D337E8
SHA1:	32BD73953AE69770E7DA14570BE6B03CA0C606DB
SHA-256:	C5277801FECC99C1995A160778322F9B55DAD04E442CFADFAAA5C4370082A082
SHA-512:	729EF67C6DDC024211E25EE0C20F5C364EAAECF94533A9FB304B22CF4F56040D3357FD74CD7C571DCE1D72B3D895A8110332121C001D48C64C8E76DEE695C974
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7............" ..0..............,... ...@....... ..............................%.....@..................................,..O....@...................(...`......\|,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............<%.......+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................k...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65152
Entropy (8bit):	5.832074675873154
Encrypted:	false
SSDEEP:	768:RoOCK7e4VKEoT/pba9wcfRm+3l1fF/gD/F4oGiYspNqHMK/xExeCh4o6Nx+tVx0j:TljVKK3fFC/4i3p6xV8ws/aBI/nNaz11
MD5:	E899D8F5B09CF321B9FFFCBC6C64E216
SHA1:	2FEE8FAB689526D71D30DBB23B786AB61C0152BF
SHA-256:	5E15D266436392893BDCCFF85568BBB5B7F4B28A245181DB914A695EB07F36EE
SHA-512:	8D2C77564D78A5A58E0B5B5C95878D56D70CCAC811A6DCBA6DDFB548347A7DAAA144D7977B301EEBB5C8D7DFD1B873727F8D5EC3E3BD8ECE61347B0B67FBC4A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T.v..........." ..0.................. ........... .......................@............@.....................................O.......H................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..8...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.T...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.53359517677591
Encrypted:	false
SSDEEP:	384:zV5fl/3YTo9rbJTTHWWwJI8QWSmmMsBlHRN7VV8/P/R9zVfkt:zVxl/3c0TbWWf8zm3jVmPZ9zC
MD5:	84F0E4F0059E31132142C852802D00F5
SHA1:	1B639084CC998674DBF6F32B780821860853AA6A
SHA-256:	101343E6EA54C22A5C0EE7EB73EEE13CD417756C3ACD1AD2BC47624F1D4C3866
SHA-512:	CAA32C605D44B6CCDAED1005792A017B6CE32CA0699B19DCDD5E08FEC9FD953A4247ECC0D4848C8E8EDE76A43418454C5F54E4BA9C2D4785035325EE517F1ADE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W..........." ..0..............:... ...@....... ..............................6.....@..................................:..O....@...............&...(...`......h:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..X....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.......................[.............................~.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.360790133901288
Encrypted:	false
SSDEEP:	384:BNAMEXIoYk1fkvFAwmEoWmdhsBlHRN7k4YNzTN4tgR9zJNOHGw:DAMExYk1fkNACMdCj7YNzTNx9zXw
MD5:	30023639AADB5DF178194A296B19C277
SHA1:	BB9E95DC501E97E5CCE395BEAB17587644ECD06F
SHA-256:	B2F3870F8EB1C5599BFFF324E22A97A78865DAC4EE501B89BBDDAB5870654A63
SHA-512:	D33C36B56C2883C888B6E3BD63832B571D1A7C59FF0032A148766C11EF15CF9090890C56B93455354A029EFBDC3F8DFACF791A823F931F19BCA29A330D7742D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....;..........." ..0.. ...........>... ...@....... ..............................x.....@.................................D>..O....@...............*...(...`......(>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................x>......H.......P ..............0%..x....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................h...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.694659463779642
Encrypted:	false
SSDEEP:	384:olB2mW/os/sBlHRN7MLMB+6R9zctFeGhC:Ygos0jMos29zh/
MD5:	0F70374EF2400D0DB90196B6802EE000
SHA1:	C41B1BBBCA684382F038ECC46F657C3FC1FE0771
SHA-256:	780CDBA57C5D11E3327A150E7EE1E886E5A8849D4DBBFDFD19EA81E7240143E7
SHA-512:	DF77A469EBE9D4F99FE5B8FE369377597A621BE1BF5C44FD63932456430812CD73736A0945D5208EF7C70300FC2D0638ADD022A50CEE3DA24B016A30E7FC565C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............" ..0............."(... ...@....... ..............................[.....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D............%......4'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................]...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.486399030393814
Encrypted:	false
SSDEEP:	384:WBHqQrFhHwWcb9sBlHRN7kUj05seyR9z0VuIu:CHLubejJj05sN9zAtu
MD5:	74E435AB2FE58DD92B34AC0BF8CE2AF0
SHA1:	9C2E10A515D9B91B4727F6B021550699E7AC2F06
SHA-256:	626B58A40CEDA1051B510B0E4C609634FFE8DBA0E9E162D622D761292609E4E3
SHA-512:	218F206721A89708A957D9BCF804505328A6E8AC88297E35A5EFBA8E5EF54DD8D63CFFB50C823B218FD54196A5A8FEE465A9AAEE03C2152DA8A42142F0B879D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............" ..0..............4... ...@....... ..............................;s....@..................................4..O....@..x............ ...(...`......p4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..8............%..h....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.......................Z.............................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87168
Entropy (8bit):	5.61960214495225
Encrypted:	false
SSDEEP:	1536:+D1u7XRzwAFWsY6kmnmmUIaRQoZk67eEPPdVYFWsxG5nNazx:+U7XRzwAFKmUOwdPs3cNa9
MD5:	12DC34569DF4DFFDE39C984032644279
SHA1:	036E3AC0C4442BCC563E9A75B5D518EA29856D84
SHA-256:	4BE17721DCDD19B97676E0B4B6DA954D51FB3664140A1B4E0D5A39DC93F55E28
SHA-512:	9C303E6CE7640511AF070E7A1817E73B25B3D6E4E9A7B59910599874D1F1AC6AEBC0B60DCE89547FC6F50B64BD385F0AE146D26A95A0B127631C2103A3C83B2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....kE..........." ..0.."..........^@... ...`....... ..............................'.....@..................................@..O....`..H............,...(...........?............................................... ............... ..H............text...d ... ...".................. ..`.rsrc...H....`.......$..............@..@.reloc...............*..............@..B................@@......H.......P .. ...........p%......p?......................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.T...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\cs\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.736410191997931
Encrypted:	false
SSDEEP:	384:3K3LFLHVgW2DkW+1fsBlHRN7wLMB+6R9zctF9UUG:OZHVt2s1Ujwos29zEUp
MD5:	05D3A2E36028C2AA0FFA628E88128BF7
SHA1:	38FD14D26642E70D88559788C54632C82402CC68
SHA-256:	51D8CEB3628A36CB4B13C9FC94812819AD1CEFEB6247B9819CB855394ACB8DE0
SHA-512:	5ADFE923D6A9885EED3F99706DC6BF74B68B6B22C35F4C40B97E7B770BE343EEBB7BEBDC1187CB88F3B2FA625C3D1F4E66E6C58CA9C90A93A21D8F7D4927BA33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J..........." ..0..............+... ...@....... ....................................@....................................O....@...................(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..P............%......(......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................`...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25728
Entropy (8bit):	6.33447040527714
Encrypted:	false
SSDEEP:	384:0AhGXSXRaRmIPXdXxa9G/Quw22zdXhY//QxpsJpHoaWYHAhQ5WlsBlHRN7HXA9GI:0AhTIOGIR3o/oeoGj3A9G2tC9zgn
MD5:	EF71FF325F7702DFD394D31D4ACE26EF
SHA1:	CF8B08A48CED2D0AA2799BE0D3BA4A479D553C91
SHA-256:	996955AED9ADB1D075E1591EF776C62E7FD5B85CD47DACE0ECCE3A282510AE54
SHA-512:	B4E227867E6375FF89D274280F5CA04375EC079A51005AA3188CBB8F951DC1D458717CF3E382F83A35E22804B59B73660AE7FB5B231E94B5046DA61B14085762
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Gb~..........." ..0..2..........jQ... ...`....... ..............................nD....@..................................Q..O....`...............<...(...........P............................................... ............... ..H............text...p1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................LQ......H.......P ..$...........t&...*..\|P......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3......................................2.......................t...i.......\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C...............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114304
Entropy (8bit):	5.426100757341675
Encrypted:	false
SSDEEP:	3072:81iIo6VUKq2tQhQA/R4gXE+ipMzYbiEjaFEgv+Eil:81iJ6VE2tQF/R4gXE+iyzYbiEOF/c
MD5:	8EA42D3271C5CC3E32ED4216BA78140F
SHA1:	8CDA632CBFB0092B1BB944D4BBAFA2C962E2E71D
SHA-256:	48690DD911E5D307336AC6E0261E1D7770499D2B2C22655BB94D370BBA036778
SHA-512:	268D0C37D3FA55F7F8F0FEC6AC9E0682D5C04B60BB0E35084AA7971231F4CFF746E667E100B629ECCDFC35632DE3CF7B80DE20D34E3E9DB37649A70EF7D2D69B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9\............" ..0.............n.... ........... ..............................X.....@.....................................O.......x................(........................................................... ............... ..H............text...t.... ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B................P.......H.......P ..8............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...G.4...d.4.....4...0.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214168
Entropy (8bit):	5.290095277084123
Encrypted:	false
SSDEEP:	3072:3Z3pPMKCjcKNI3DPzjPZTBS6fZquXuWHnTdTm+P2rM2fhpHLzZYWApy7eLgArcKZ:3fhquXuWHnTdK/RhhZYWApUegI3
MD5:	413459E48F4F1E85527200EA105D0468
SHA1:	8A4D82CE416341DEEFCBA0B274AEA539737558F1
SHA-256:	65F385CCA25089A249E1D0F59BD37BE944D80329757DBC1DE99BB846EF84E4EE
SHA-512:	486EDD285ECE640C820CFBC2E191078FB1A9603ABD46632E0A915FD4563161AA21CF0E15C3C5633C8170447937D1A87ED2998C632BAFD0478C001E6E6B8FD6DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t............" ..0.............R0... ...@....... ..............................t.....@..................................0..O....@...................(...`......./............................................... ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................40......H.......P ..L............%......d/......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...G.9...d.9.....9...0.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47256
Entropy (8bit):	5.6644470676057415
Encrypted:	false
SSDEEP:	768:5p4ICj0Yq+OlNxbf49Re1sqwa3DsFDOgvOeX0e+W7goew5BmPm3hOnWhW9pnGUXt:74ICj0YGvsqwa3DsFDOEOeX0e+W7goeH
MD5:	D0AC782D8955DCBF63A63AA06757171A
SHA1:	81F57EB846841C07F2C497386AE4DF81306CB7F1
SHA-256:	72CAE60F750ECC8BEF05E27011398E37B6697AF8FC950A852FF7D6E7796CB823
SHA-512:	5D153E8F8ACFBF8048B685892746C52F93A64354E189B2C32635D3D3384E82262A1214123C39E53182447947E0F962D3DFC36D44575089B7B36A0ED6500D1EC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{.B..........." ..0.............6.... ........... ...................................@....................................O.......h................(.......................................................... ............... ..H............text...<.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%...}..H.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39576
Entropy (8bit):	5.8388679009554885
Encrypted:	false
SSDEEP:	768:fO/ENueEDeiW9c/Fb5P+2Hi45s7j5fF9zw1EOb4mjpbjlhewSRACReCnyBjbCj03:2/ENueEDeiKnACReCnyBbCQyvzU1
MD5:	D69A2A54F045A67AA40E7A6FDEB5A8C7
SHA1:	9B519274B89729988E141C555F88CAA611C811AC
SHA-256:	EA3990ED00141ED73B45EA378D1D6D5C000375D9AB81777C6A7B7170068B7F50
SHA-512:	AB211D2296F2E9276C0D051E5364D499F6CAAA2A861CE38A891B6A8D1B37E806883A4A7A6B1637E612C938BA8B24C521AD5A6AA0603199FCA24A25766ABDC69E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..h............... ........... ............................../W....@.................................P...O.......h............r...(..........4................................................ ............... ..H............text....g... ...h.................. ..`.rsrc...h............j..............@..@.reloc...............p..............@..B........................H.......P ..\............%...a..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................................................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.562554043651108
Encrypted:	false
SSDEEP:	384:vBhihsp18LEoWxC8sBlHRN7EkGlD/LVNSR9zuvF1:Hqs/XCHjexLVNe9zM
MD5:	D161CAFB640085566922B3DDA7EE2353
SHA1:	29FA23525FAC56AB7F1B8E1C00DB76678402A5A5
SHA-256:	769CCC3FAFF0D76C6F4B1BA13C481698B83E90624E86BBDAF7BEFC44E590519D
SHA-512:	3FF3D22DEC6F8E502E54CFB74ED78D179E2CFF6CEAEDB2B515A9B11DBA0B4215B7CA824B043CD7B2DCC6DDDA463E71A275585ABCCA6AAA85536AAB28E54ABA65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U............" ..0.............B5... ...@....... ....................................@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$5......H.......P ..............,%..(...T4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........B.....B...G.B...d.B.....B...0.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142976
Entropy (8bit):	5.444572158021721
Encrypted:	false
SSDEEP:	3072:nR9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyf6pu39kP4TCTEWFy5VuJ27/A0NwMeo:BNwMeyXv4He1P9b
MD5:	3B3E6AC8DF3971FEA222808ECBF12E8D
SHA1:	CBCA3C32234E7541846B5F1DE41DE4BB9B3E2BF2
SHA-256:	24D30FE77D83FE7064DE1D230E2FE5D2D9A20F1A50597077AA6277F2F1D77484
SHA-512:	9E3CC1467CE647C9612F13CDC442A9CF6238D2BBA27E930BEB5985A1070E097E59699FFA3ED57E01C13567A569DC8D4D762D0C6B957DCD0A81AE6D49D1B32B85
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............" ..0.............j.... ... ....... .......................`......P.....@.....................................O.... ...................(...@....................................................... ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................L.......H.......P ..T............'......\|.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3......................................2.......................t...........\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.760678486082694
Encrypted:	false
SSDEEP:	192:Ns4nHWtiWsUWo0A2j9seHnhWgN7aMWCprIhG2ZUnQJeX01k9z3Aao91LVqa:2oHWtiW3sBlHRN7xpreG2teR9zboHLka
MD5:	807BF1604545BF7087EC4B9CB2DF6543
SHA1:	30723FA0B80C553666DCC47461962CEFA0E796CA
SHA-256:	BD495B1EC07B2560943ADE96D0B09DB225D88668EA463FCA3A0668B9E5A24E1A
SHA-512:	8F8AE57886CD6B74A2C9D947C729B1A535B85EC37B0FCD46BCEAA37E8DD9B1DD6ACE3397BF545D8A2F4AD74E03B9B7E00A7A6DADFFB51D71804AAEE10D6DF1B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.f..........." ..0.............n)... ...@....... ..............................m.....@..................................)..O....@.. ................(...`.......)............................................... ............... ..H............text...t.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................P)......H.......P ..(...........x%.......(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	366720
Entropy (8bit):	5.153144608271234
Encrypted:	false
SSDEEP:	6144:o93oM9Qk9gZb3elz7jrhXaCsMaC/Cq0OaRBTJ9Q5fYW+d/Pc1Hr68:oy+okfYW+C
MD5:	DBB25DFAFC9687908BFF3C07C6F76756
SHA1:	633978C041CE215620AA09D115D78EF46B95D807
SHA-256:	9434EFF91E14977A70B8285873635E2D611BB3D3C26E78C9FE4E5D54D3CC2B4D
SHA-512:	C7F856BCA6F9EB40F79AAF32534E451BBD92BE9D1FCB044BE93A5A661692A4F26B7704B72EBB7E07ADF98BF9395FD177B2C03276E95F3BD520872E8FFADD6E61
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...CT............" ..0..f............... ........... ...............................>....@.................................D...O....................p...(..........(................................................ ............... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................x.......H.......P ..`............%...^..........................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3......................................2.......................m...=.......U.....U.....U...G.U...d.U.....U...0.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.691389152623281
Encrypted:	false
SSDEEP:	384:4e/9pWtH8WdGYsBlHRN7svEj05seyR9z0VuTw1:9WtHHGTjSEj05sN9zAOw1
MD5:	CC6BAED04ACFB1A54A04EB79EF12F06A
SHA1:	218A60467029664AA3153EC5F13FEE20B1B3D061
SHA-256:	8D2E21B41CEC12DA133D06416A122597CE14EB92AB5A13A762E131B3FD8D2410
SHA-512:	7A3E7250B3DA66CAFA1970F59F5D5DA3F17A27FB31283EAF7479C7DBF3340159211491B7B4AC1BF41D3ED89184C922BB3C1BCA28081A4E281DDDEB91821E053C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$..........." ..0.............B-... ...@....... ..............................,.....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$-......H.......P ..............<%......T,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........F.....F...G.F...d.F.....F...0.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68736
Entropy (8bit):	5.705147631020692
Encrypted:	false
SSDEEP:	768:fuoOCK7e4oCTW5li8Al/ENwaJt7+0wdMBmXAQbzmV3rOIBG1QmNurBdj8xLVNe9X:gljokE9JoMKz6GburB18nNazT
MD5:	636E108976B06BBB75978BD3609E290F
SHA1:	DDADB3AA7C35415C4D612E9C69D8C0E9481E5721
SHA-256:	0B943C0F32EE1B552188A756AB842A723C92179CA30A6862D282228519B499EC
SHA-512:	B9064F091F0FC3752942C99A7818F7D5BA0BC9EA6A8DBFB07B4D90E94B127BD46C45CC7258F6CAB105716CD7037DA43CF1CB6B82A39DE6E8DAF1C3312405313D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@......aR....@.....................................O.......H................(... ......d................................................ ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................................................z.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.516607185886526
Encrypted:	false
SSDEEP:	384:vfSv3yPYTz3rdWWLWSmmJsBlHRN75BqETN4tgR9zJNyc:HSv3K4AvmajfqETNx9zP
MD5:	EC4288329DDBC2838988B85676EA70F5
SHA1:	E0B8674239B9D7EDB8F3B9DB66DC1817A087C45E
SHA-256:	8401FD95C2465AE84F676FD63704E2B2B416296F4A6626ED15B03E6AFC84A99F
SHA-512:	A262626EB92E1105E09028C1BB5C1CB6062A9339937F71A02A2856F7F32009BE0201E8AFC4A8825C552B2D0E34C023637DB47CDB50432102F1E103AB47382D7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n;... ...@....... ...............................9....@..................................;..O....@...............&...(...`.......;............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................P;......H.......P ..@............%.......:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...G.6...d.6.....6...0.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.371547019102197
Encrypted:	false
SSDEEP:	384:ro950+sQCfWoWmdcsBlHRN7nTrGlD/LVNSR9zu5T:0950+sQDMdnjnGxLVNe9ze
MD5:	1535013459D896547869EC86FC9910E7
SHA1:	944D828AC9D32CE4C3ACE0ACCFDA4EFC2545C75F
SHA-256:	2340167E50A6EE8A35EB6A56320F134DD7AB830A945D609ED6291FE524F41604
SHA-512:	763E1E5F41BB411F8403912EF902479A2AA5B1A965C8A59C95F1419008322167F6A82E598FB750F5410891CDD4E10974D11207C089EDADB8942C2AC5EDAA00BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b._..........." ..0.. ..........Z?... ...@....... ....................................@..................................?..O....@...............*...(...`.......>............................................... ............... ..H............text...`.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................<?......H.......P ..............4%..8...l>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...G.C...d.C.....C...0.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.6901505308508655
Encrypted:	false
SSDEEP:	192:3g0B3+o3vWDtqW/oZfWo0A2j9seHnhWgN7aoWLaXwks9gICQX01k9z3AFMr:w0tbvkYW/oZ1sBlHRN7ouw/P/R9zVr
MD5:	A91E98C1B0E7E9C781C54DA95B7E0BEE
SHA1:	CE5405AE8628A0898BC459925109FB405A689C6E
SHA-256:	6093E959A9A976A804793ACF1BCA00BAE5FD16A71EA62C028B657C013884F65D
SHA-512:	94CC626A765FA6AB2DC5BEFC4307DEE7A04EF962730DD987D0CCF968562A3680D239C7A4618B1833B16991197419A655AFC85EAC6042522393B17BE40EAAAFBC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............(... ...@....... ..............................9;....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..H............%......('......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...G.8...d.8.....8...0.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.465840564373484
Encrypted:	false
SSDEEP:	192:gbaJYT2YzEZOxd9GITjMWLKRBJTyWo0A2j9seHnhWgN7akW26ks9gICQX01k9z3d:0aJGPI2GvWcb4sBlHRN7n6/P/R9zVD
MD5:	C02786E294591D537161182E771565E1
SHA1:	60342E1AE6015612E7256CFD12B113E2B3DCFD83
SHA-256:	A37142F6CA4C57996998E3C6C039AA5FEFA5C57357BCA933B6D6808A4F60D7FC
SHA-512:	C4A40FB5A89C116D36AE7D8F21A0C14ADDF170E880E976184BFE06B2CA847F9010F7CF8BB6518774038603AB76B63451648A93D2B9D2D6CA13DDB9205DB31D58
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............4... ...@....... ....................................@.................................x4..O....@..x............ ...(...`......\4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%..P....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...G.5...d.5.....5...0.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91800
Entropy (8bit):	5.468699610107234
Encrypted:	false
SSDEEP:	1536:YD19QyqEOcQmg81PrZMWHT6NSR/fGxTEhmJEJGDxOOQyvz+:YQyqEOcQf81zpWNSR/ffhmCgD/Qyva
MD5:	987B97F364E2CA46EA7B5E8E670B90A8
SHA1:	F5BE5C7F66DCA8E7C4B0786A3B5550E54802E9E0
SHA-256:	77F7CD334E2D8EDCC16F33FB612D3FCF44D201E9A4A695F4D3F446851DF79171
SHA-512:	4434F0A056FD6F358893C64250798C2B6EF9499AFDECDA4144C297CF4FAA1629C670090FAAFE1E202C17D000577168D3A4920469730B3835D2CAC74A8A158CDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..4...........R... ...`....... ....................................@..................................Q..O....`..H............>...(...........Q............................................... ............... ..H............text....2... ...4.................. ..`.rsrc...H....`.......6..............@..@.reloc...............<..............@..B.................Q......H.......P ..$...........t%...+...Q......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................................................z.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\de\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.745613974769842
Encrypted:	false
SSDEEP:	384:mL4yLx6WsrS2W+11sBlHRN7JXhuTN4tgR9zJNTI:y4ux/srS21Gj1huTNx9zU
MD5:	6A630C5CB1C33231F0DB98FF4764C619
SHA1:	00A59B9081370778C37C78842C085A724AF0668E
SHA-256:	333780BAF91132C1489A1812025FF605B4B123B586B3F13A59DB7445DA05B540
SHA-512:	2AA73B857082866558BD196DA2C032DDCC9A74E3830E33466E20EB274C118071E3669B944776F22A3FEE99AF3163D3FA0E9D6A3E2EBBB6D98DED4A60B6265D0F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.y..........." ..0.............r+... ...@....... ..............................&.....@................................. +..O....@...................(...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...G.;...d.;.....;...0.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.3073292477485055
Encrypted:	false
SSDEEP:	384:syhiXSXRaRmILXdXxahTKQuCb32DXlhpiYwqcjsoaWYHAhQ5WAsBlHRN7j/P/R9t:syh/IUTROHMDqcFbjzPZ9z5
MD5:	442302E9DB96CECB90439BD6D95BCC47
SHA1:	BA1FF4833A2CCC64B86615B04EC9FC8F76AA37D9
SHA-256:	ABA45F3ED9898EDDB83AB94B4A5EB0C89F626F2C550CFA0A6019023DDC8CA484
SHA-512:	40BA22EBD9331C57CA676AA3D69A03D9D3F62633031D052C9D87226D0415DB99B24731EA29580DE4AA997E477BE320C9F1957D51B4B959C71215928ECC941D98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Kc............" ..0..2...........P... ...`....... ..............................R.....@..................................P..O....`...............<...(..........tP............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..$...........t&...)...O......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@...................@.r.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110232
Entropy (8bit):	5.3579287529014
Encrypted:	false
SSDEEP:	1536:a61jOxA7X72xbpIzqq8HfTQcN0TcdKVt4v0TIrYJfJrBSc4/zX1AhZsTBv6MKSyu:Z1iib72xbpIzqq8HfTQcNycsqrLPm3LU
MD5:	51CD22CAB04F7808C3A539543D4C4A7C
SHA1:	A7B002C82AFE3E80BFEB3F134E078565BAB8A788
SHA-256:	643E231DB7B84201339F66179951D20A850091F829D6D5EBD117F4A1248C5293
SHA-512:	F4ACC2474680C8D675C04BDA27CA616F1E77F6A7CD60B1882682E3E14C5FE3E908FE321B8C5D423287A1D7F0FAD55838B4546D8F4D1F1270CFFB0ABCD8DBECE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..\|............... ........... ..............................9.....@.................................0...O.......x................(........................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc...x............~..............@..@.reloc..............................@..B................d.......H.......P ..4............%...t..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	203416
Entropy (8bit):	5.206643718569258
Encrypted:	false
SSDEEP:	3072:cZyOPnY+nF7eILDlMJBoWB0nih8obFgdA+RBLQ851mkusNFxCeDNsG+QyvQ:c4uih8obFgdAQXikDEoyY
MD5:	D800BB9E262EC6AD99CA95165191116F
SHA1:	280B03802D4FB1B2E6B541FDF86211F65D653DEB
SHA-256:	64C67748415F404521353CB05A542D3DF5CBFC9D55B5DA7BD7EB73340D034353
SHA-512:	E93C9BFB7082CA61D42DBC0D1B8B06B00E78E04623AD3ADD09C25B18385E6EEC503AA2E5C809FD7F8BE92FCB3CC84F975A71C19A7E5759A594D1971A9C1681EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZS..........." ..0.................. ... ....... .......................`............@.....................................O.... ...................(...@......p................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..H............%..X...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45720
Entropy (8bit):	5.630760469713851
Encrypted:	false
SSDEEP:	768:MP5M39t/Km+ku/uCaXiHpNhX6JgH8t4HVxjwtgkgrv1YXCmU/QSDb3ySjMJTNx9y:cM39t/KSXiHpNhX6JI8t4HVxjwtgNrxX
MD5:	E64880C26D63412F390468CE5785F398
SHA1:	DC2E5F762707926DD22C2D4051E5DD8F90BC8A00
SHA-256:	20B48BCABA3E92EA0C2EEB00280980D20A5445D083CB8BE4DF9EBD524D2A5F29
SHA-512:	6E59DFE647BA3A5BDEF24D43DA94A3AF1A10A0692B5B388C20FCDBED5139CF4E6F27EA1EFC6774DC608CAE7145CF0B3F24000B2B491FFEB29F98F1F7C4250310
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T............" ..0.............n.... ........... ....................................@.....................................O.......h................(........................................................... ............... ..H............text...t~... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B................P.......H.......P ..0............%...x..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39576
Entropy (8bit):	5.789076193120773
Encrypted:	false
SSDEEP:	768:K9rDN4Ne0KwlXSpLioFOPl2iQnYuMjvDSaR2y4ObZgji/WdrYYz3tdhW1acyZDEW:gDN4Ne0KwltARYYz3syZDEAyRtQyvz2n
MD5:	7E0850237C5388F93BC68A199C5486E2
SHA1:	B2A4883359E794D027F487FD7D551F17E0F80E6E
SHA-256:	4377F96CB82E230BA7D0ECB4FF16CC3582659CFF030CA754E9E9B951C323ACEE
SHA-512:	5753565A648033437806E01588419DDBAAF0626822D503D63E07482DBD5F7878CBE481CBA27306AC50F3CB5F8BB0FA4D950BE121106F0E0C983C11FF757707C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..h............... ........... ...............................I....@.....................................O.......h............r...(........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...h............j..............@..@.reloc...............p..............@..B.......................H.......P ..X............%..``..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.559995433852141
Encrypted:	false
SSDEEP:	384:+hEZhxs80LipoWxCt8sBlHRN7OXVOY/wR9zQSw:6cGLSXCljO/M9zY
MD5:	05F246F55DB8CE772131AC3072B3E40F
SHA1:	6F686C2CAEB8EB6879D9E4B2FCBF787ADA3B1C04
SHA-256:	F5F12F6EE6DB1EEE50A45F8ABDB0A6264F2CF223C2CCD7FBBBB50BC48A18602C
SHA-512:	69ED17E484D16914198B129E77E141DD6ED59156B14188FF177E0146B474E14B3BFDF0A151356E82811FA53E6E4CACAA457E28DC36466F034A6FD3AE4EA8EADC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............J5... ...@....... ..............................4.....@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................,5......H.......P ..............,%..0...\4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142464
Entropy (8bit):	5.438736765588969
Encrypted:	false
SSDEEP:	3072:VSR9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyfbYlmaDglETAHZf7xx43kZ8GG9sFl:Vz9sFfp3OKvaeoK
MD5:	8EF32FD77274B26A9E304DB7FB157BC3
SHA1:	899A18408E39857A8D8DD774BED9486162640831
SHA-256:	FE8D82B244B34650E464C2B98D09FE5BAB9C4A55E0520AB5D0FCDF777B651625
SHA-512:	32233B4145CE19547F4BA91292A5ABC636E68A8BB8C230AA9D56458647956E87AA97DAA0B8D4E60E6046C511791E423FD841DA1FCED290FEF47FD8B05E1ED786
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(Z..........." ..0.................. ... ....... .......................`.......u....@.................................d...O.... ...................(...@......H................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..P............'..(...........................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.754027067282426
Encrypted:	false
SSDEEP:	192:NGHuLuLWtiWs+Wo0A2j9seHnhWgN7awWym+UChG2ZUnQJeX01k9z3Aao1Iw1:wHEuLWtiWxsBlHRN7/G2teR9zboGw1
MD5:	3B3406AE78ACDC4B6529E25C8CC4A91C
SHA1:	4BDB09D091030A5B085C322C82DE3FE9FC0E7DAC
SHA-256:	AAC2FF2A8AB830E63843046FA463662A45623290656A815BCF0CB1FB7EF9736C
SHA-512:	2654F799A018803363330DBE406BC4E2B8327B425F4B009AA706765B18A1D1137EF6ACBD93E3D4BE2C3C67FC8A08C93357ABFF4D367E1A3A1450E18195A42BE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z............." ..0.............Z)... ...@....... ...............................[....@..................................)..O....@.. ................(...`.......(............................................... ............... ..H............text...`.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................<)......H.......P ..$...........t%......l(......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359552
Entropy (8bit):	5.0635918325037235
Encrypted:	false
SSDEEP:	6144:v93D3b9lQZyfiaFjoWFcUY9O04K91jw6V1UtN:vxwjV1UtN
MD5:	6D4B9328985D06A6B4E0A772FFD85B11
SHA1:	A69160BBFA32A0C348FEC185B0C617A175FF3F8A
SHA-256:	231716E2C27722DAAF64A163E09A30207A6F2E537A5087C6FBA20172907BD095
SHA-512:	4771500884A03C5A4B5D19AECAFB73959B5655E9F3073EFB4DD5DD9AF5EC6EA74B96472785B0CC3BAE1B8AFB3FF00E14C3958743627C82B73406A2D4E3E6540C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..J..........Fi... ........... ..............................<.....@..................................h..O....................T...(...........h............................................... ............... ..H............text...LI... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................(i......H.......P ..`............%...B..Xh......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................F.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.657855401832611
Encrypted:	false
SSDEEP:	192:F48AIl8X1BKZfhzwRFFnWdGgWo0A2j9seHnhWgN7aEW5JVOYOg8nK4X01k9z3AvS:G8kX6yR3WdGmsBlHRN7GVOY/wR9zQwB
MD5:	D71016722B1657D52E762AA62D62AC24
SHA1:	5F9D4F3C0F2B971DF89313CF6C3718D2986B926B
SHA-256:	76DDEF55D2600EED82EC6B77245AE2B76C60BE7ABEE3A73E28B596A1EBC79480
SHA-512:	550B15889FE9BED5FA0A4B3F6DF9FDFF566D1BC43D26211BB123E21AE06141FB36BCC26079EC47D708AC5D964771F1B19EAEB4FE23509A84DD081E4C8BC9C2D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............,... ...@....... ..............................cj....@..................................,..O....@...................(...`......d,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............<%.......+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66176
Entropy (8bit):	5.612035493340198
Encrypted:	false
SSDEEP:	1536:1ljlfGaKic94N4FfC5YWMvmGPaacjohSN8qgpkBXlzC:1ljl18q/G
MD5:	0BF133EC6EB0CFE7851D77AF0FFD6C61
SHA1:	201A33D14CB0B5D735E0BDBDF5BA6C39ADF95A71
SHA-256:	93715B2C8A55F25E31E5FF1EDD1AC63A36EF7C7099402AC62EF94F7B4E5F77D3
SHA-512:	E4B6D936288004F842AD55982BECEB5E8ED7CF2797FE675D5405575D9828765AE66331170B3D65EFC5C2CBFE8AE2081B6A1A3373C1020A1A6B9CB4078E45E325
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.F..........." ..0.................. ........... .......................@.......'....@.................................d...O.......H................(... ......H................................................ ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.447041226036482
Encrypted:	false
SSDEEP:	384:LNZfH03Jl+28mqJlTWSmmdsBlHRN7aZj05seyR9z0VukUv+:LNRH03L+2gJ0m+j+j05sN9zAL
MD5:	8DC0A56ACF47D77CA8BD72DD671BB616
SHA1:	27DF9790EDFA1A78C0721A2C3E09DF8F182EDE25
SHA-256:	9B9528965906E86A2C8DA1FC0B54A49F9E535E139222636DE6D12A44F817977C
SHA-512:	F241FE8CB101D14C52669B8E4BBEBBDD7BC334E0540BBE818D29E1D0F2ECC838775FBC89DE9D453942BB7719101A46834254CC3EF7A2B31B91258973271FE689
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.u..........." ..0.............f:... ...@....... ...................................@..................................:..O....@...............&...(...`.......9............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................H:......H.......P ..@............%......x9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.....................................................~.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.317118826628249
Encrypted:	false
SSDEEP:	384:LuxD4SCqDWGVgPoWmd7sBlHRN7Qj0hG2teR9zbo77jC:6xD4SCqDWDPMdwjxG2tC9zE7jC
MD5:	F3031C7663C65D25602E81FFE31CD126
SHA1:	2B0CB27B5E36E23E41DE2CAAA8BC91DF49397538
SHA-256:	ABFC989533DF325C636D6F3422FCB4F1E56AAB75D3B6B8C26D646E41561C5980
SHA-512:	4E683FFCE25AA9A5DF17C13B15A57BE4560C9546C03EFA9687F25AE5372AF2FBB04C748CFC6C1BF3913FB1C5A9D835A865AF93BA19D9C73B6DDDC90DCF4B804E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3............" ..0.. ...........>... ...@....... ..............................F\|....@.................................D>..O....@...............*...(...`......(>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................x>......H.......P ..............0%..x....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.690448144872169
Encrypted:	false
SSDEEP:	192:EIv3Z3rUWBF66W/oAWo0A2j9seHnhWgN7akWgOyjNq5lOeSjX01k9z3AfXluJMu:NlgerW/oGsBlHRN71j05seyR9z0VuJR
MD5:	EE4293861B237DD6AE7BA303FDF4E10C
SHA1:	2797060FB117E2E84331CD0D5A06AAF08B2AACE4
SHA-256:	BDCD2CD8013247672E591DC3B1CF1EC48EF1CA209703C6BE0AF87634947EAB8E
SHA-512:	23A964CD3FDB02B6FA31BCC3653B8BBB96ABA45454A0F2FF18BB1BEC6A44C396A63D051A83543AC0ABAC07FFAD125188CFBA2E89CF7CD9E04560C33BF6B06E47
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r............" ..0..............(... ...@....... ....................................@..................................'..O....@...................(...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..D............%......,'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.482608583249038
Encrypted:	false
SSDEEP:	192:ssQ1LEcM4KWLKRBJTLWo0A2j9seHnhWgN7akWA4Cks9gICQX01k9z3AFMltL9i0:nQ1fKWcbxsBlHRN7Tb/P/R9zVlRk0
MD5:	5C2C646E2BEC8F6D15F04E31525B0F54
SHA1:	5DBDFE3BDB5D76E0AD4C9EDD6EC4A55387642B2D
SHA-256:	1E82CD6455D07C8F71C9A06C81DD5EE26D2B35AD70EDF354BD99D81A92C98768
SHA-512:	D084563D4F2D154EE42A18C05694D70271B04936265E719D311A46B45A940D101CFABDA6D53B592CA3B4AD4E8B788DDD9A813B02CF617C65094428CE5764D6A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m ............" ..0..............5... ...@....... ...............................x....@..................................4..O....@..x............ ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..8............%......(4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................................................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89752
Entropy (8bit):	5.395376489000955
Encrypted:	false
SSDEEP:	1536:wD1dSUEgf8HshlaoTHTPC1YUU4e7DPYPWsoJo7fi8k/nvwM25KOlLG9Mw56huRaL:wiUEgf8Hshvsy+StplLre
MD5:	ABC599333654D282AA83A637D52CEB34
SHA1:	9DB0CA865404236B78DAE3CF52DAD0332EA8CFA2
SHA-256:	49E8A87ECEA4147FF44BD63A11919CE79CAE6271AC1552B8E6E801C8DB44DBB6
SHA-512:	778D2013B85BFAB21E08AAE9B3DEBDA58549D47F88DB1FBD3E2B6DEE45199D0374E5F71AB2FC541814BDA437C17958D63BA7FA32EA29A2264DF61836855E8A8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{............." ..0..,...........K... ...`....... ...............................*....@.................................LK..O....`..H............6...(..........0K............................................... ............... ..H............text....+... ...,.................. ..`.rsrc...H....`......................@..@.reloc...............4..............@..B.................K......H.......P .. ...........p%..@%...J......................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\es\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.71983672417952
Encrypted:	false
SSDEEP:	384:zKQLFLHJeWWeHRGk6W+1YsBlHRN7lY/P/R9zVx:xZHJjtHRGL1TjuPZ9zn
MD5:	96253E681AC6B40A769B8EC80A355488
SHA1:	53EDB22458885545C6090AF58C9819EA7103A174
SHA-256:	F446628F04F617E26389074B15134F07187B8A2E45ED7803794AF3506EE614F4
SHA-512:	9260C609B3B39DB3AA36BB4D05C2EEA7927B67395C20EAB416AECD4C7A1026709A3707D563870D50CECE4D08958FAE0766E07042563E486F6CC74482D1908C49
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u]............" ..0..............+... ...@....... ..............................y.....@....................................O....@...................(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..P............%......(......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.340932897930031
Encrypted:	false
SSDEEP:	384:8Z0XSXRaRmIZXdXxaSiG7eQu0a27bVhr1FEhrMoaWYHAhQ5WBFsBlHRN7xj05seh:8ZpIzvB1LJFERZR2jxj05sN9zA7
MD5:	9D297698EDC4EA9267E5F9FE8E5F79BF
SHA1:	F4EDD98ADB26AFF5361372C88E957061BEED0A99
SHA-256:	B59CD589232DE28751E628D4D27DA708060BA5B2BAB17A5013E147F64527CFD4
SHA-512:	C44914D1D8FA17D94324A2BC6EFA76E13F90625B08F9F3A3D8DAF56D71E7C922442C7B4DAF7E87A1EFEAAA43E7C343C5E59969D2872E2C420DDE8A852A7D75C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+j..........." ..0..2..........ZQ... ...`....... ..............................?a....@..................................Q..O....`...............<...(...........P............................................... ............... ..H............text...`1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................<Q......H.......P ..$...........t&...)..lP......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C.k.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113304
Entropy (8bit):	5.392989796789274
Encrypted:	false
SSDEEP:	1536:N61jOFSVCiSArfEhGf+k+1wKPqoVzkoSKd12CcxE5W0+I3Mc0NpzO:Q1iFSVCiSArfEhGf+k+1nZ2C5HB3MTK
MD5:	D8F98E471F99098EEE5CAE6DE3DF71F3
SHA1:	6C67D1FF7931A510DA077EEC875CC14C5CF76F25
SHA-256:	E14D8F0CC0CD89B6B042E1B4FE138E1FC577709268D9B05B3FB7BB85F3F2C43A
SHA-512:	AAAE7AC275BDD3783CB6BB49CD55652E77AC11D6FAD6776BB923538E677BD45CE19678A01E1D679ADEF044BE210A35A5AD60D63A04B9A21B9F4CF7F93B2B9375
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W............" ..0.............V.... ........... ....................................@.....................................O.......x................(.......................................................... ............... ..H............text...\.... ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B................8.......H.......P ..8............%......h.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........1.....1...D.1...a.1.....1...-.1.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.S...C.....K.......................C...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	207512
Entropy (8bit):	5.263141831618974
Encrypted:	false
SSDEEP:	6144:+Za9TYjFbY2Ek61lSEkxJfOAOdRlLhpBo0ca7:+BY0EkxJfOAOHlLhpBoDa7
MD5:	044A4CEAE153722176002373B2EFEF7A
SHA1:	81A6A558F53BF177012F376CA75851BF500668AA
SHA-256:	2FD08E7A56E1BADD63B76F318C2227F220BF7CE8A3E9EC81DD75194088739666
SHA-512:	DFC7E4C7CB9C8044BBC37D56FE0103F505698B3EBB02F2A2C24CF7956FF8FAD22A2BA3F7E864B79C4223757D8822B6D34F570827673E53751DE63DEC8BB639EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E..........." ..0.............Z.... ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................<.......H.......P ..L............%......l.......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........6.....6...D.6...a.6.....6...-.6.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................H...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46744
Entropy (8bit):	5.682522633203017
Encrypted:	false
SSDEEP:	768:e+pAJgb7iRNnCU0ZPx7LZ7m8cqj3ufSgIPZxXYJmR4D89qPiDddyFj/Fj05sN9zL:P2Jgb7ik/m8cqj3ufSrPZxXYJmR4DayN
MD5:	5BAE7BE912D8B889A93FD6636A499027
SHA1:	246E640589F0BD0A45C4308A056B7588C32AFAF4
SHA-256:	2B81C5F0C6ABE82E677C5E8E2F5A151CDBCC60159B4F36972D05732D51BD88E9
SHA-512:	AAF2A3EBE2795B43D3F7041EE64316CB51E9CD0AE08BC152916FBC9593B570A3AA2FFFE6047CE9B79904B80EBB478F6820EFE1A56D214ACA1A7F4CCEED223A78
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!.s..........." ..0.................. ........... ...............................}....@.................................T...O.......h................(..........8................................................ ............... ..H............text........ ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%..8}..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.A...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40088
Entropy (8bit):	5.820782597617571
Encrypted:	false
SSDEEP:	768:TepgsqCekJO+Ym5hLgEPH2UpYsMoj4KYwqxxSOHpVCNDJuLwt3YHZts0/rshznp7:mgsqCekJO+1Ym3Y5tspSgcO3XW3yihzM
MD5:	E8300EC5C809985EFC4C15189EF39937
SHA1:	BE7E49DE15A218480E2529D438EC38C657200732
SHA-256:	E910CED6E3C40FE54DBF706A00DBA073AC772AA7A753CC5B8D0A5C16F67BF780
SHA-512:	5023EB052236F1859519767D51BADC9F4705F6787E892946076B5D7CB8A29E99A4C6F3C851CCAB779A403F5ADFEAC6E757E1FD6A3DD232987A38A5F1328B4D16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@.F..........." ..0..j..........b.... ........... ...............................K....@.....................................O.......h............t...(.......................................................... ............... ..H............text...hi... ...j.................. ..`.rsrc...h............l..............@..@.reloc...............r..............@..B................D.......H.......P ..\............%...b..t.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.A...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.54721461817832
Encrypted:	false
SSDEEP:	384:Khg6wpoWxCdsBlHRN7KhbNTN4tgR9zJNVkj:mvwpXC+jKhbNTNx9ze
MD5:	E2DA26725C6F43419A28407F4ED282DE
SHA1:	E529FF16BCA2DBE09FF219D1611C7DC565B02478
SHA-256:	A6DE4AEBB4A14414C6A7FDBB406F2B27D44E8277D04F452E7FF56199EBD38A77
SHA-512:	9B50654FF2FD33F93C61B56D0F337A3C958C86C608230545F367C61784D58AE3DC67789BCE28D4608A414668E48720E7A0686BEDC764B618C1B844B29BBB27DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$p............" ..0..............4... ...@....... ............................... ....@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............,%.......4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........?.....?...D.?...a.?.....?...-.?.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................Q...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143488
Entropy (8bit):	5.454129193156242
Encrypted:	false
SSDEEP:	3072:gR9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yhCfAcGtexgVyUL+5pEbY1jGxWjPqV:bWjPPZAYtye+mP8
MD5:	E14713106409C93E86EB069786B07B69
SHA1:	7B2A2D5C82A11CC82B478038AA688D021FC03AA9
SHA-256:	3856290CBE53CE334712C861FC87E3A13C9BA40A5A1F7010D626864278457550
SHA-512:	D02ACBADF2AC06214279ECEB097F9F0C65BE8894640AC07DDC39596165407720E0DC82D054A7EEA9543768321E59C912AFD7926529F53A6EB5233EDAA772A894
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............2.... ... ....... .......................`......=.....@.....................................O.... ...................(...@....................................................... ............... ..H............text...8.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..T............'......D.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................t...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.......................k.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.768274789033182
Encrypted:	false
SSDEEP:	192:2P/0rL8fWtiWstWo0A2j9seHnhWgN7awWQgChG2ZUnQJeX01k9z3AaoJPN9:qMf8fWtiWisBlHRN7TG2teR9zboJL
MD5:	EE970FAD859D305B3C6346BD60285547
SHA1:	58752341DF3A9DE18AD55D995CA866F1A257F3D6
SHA-256:	1C0625E96BF878F3043C62BF50D4590E03EC9F9FD7151A28DEDE9AB5C4D0BFED
SHA-512:	EA83CADF6D5178C2C68AD5362B9C5CCD8F2F19EAC16D9DE8F8284B84EE18D4E0BF50CC0971CCC3B1470DB6B8EEBC19A1BDB388C7391AB04EBCF55FF2830AC232
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0.............v)... ...@....... ...............................~....@.................................$)..O....@.. ................(...`.......)............................................... ............... ..H............text...\|.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................X)......H.......P ..(...........x%.......(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................x...........].....].....]...D.]...a.].....]...-.].................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.......................o.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	365696
Entropy (8bit):	5.148256993552302
Encrypted:	false
SSDEEP:	6144:n93FOlvDJVzWZiCgUGHtVaDgvE6WsETYnSFZOt8LT+hw+nBMcG+/L:n//SETgS7Ot8T+hvn+cG+/L
MD5:	E1B6511992A0B6DAC7455CB3F667B69C
SHA1:	FE6B989964FE0297FE9B55EDF209F71EF8FA38B6
SHA-256:	061DFD1CFA88BD56258759DB0F2228C13244927BF704E2EA37EC402D2740782D
SHA-512:	395DBAC69AA112B806F5CB6DF09CAD5A0E2E8F8EA691BFAEFFE290CA6939B1834BEBC3848D1B2B1DFC705DF4F17A7BC35E0D71FB0D7DA4950B013083991A3CFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..b............... ........... ....................................@.................................\...O....................l...(..........@................................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......P ..`............%...[..........................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../.......................m...=.......R.....R.....R...D.R...a.R.....R...-.R.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................d.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.695871541982892
Encrypted:	false
SSDEEP:	192:McqEotzsNfZG2CEudYNWdG1+Wo0A2j9seHnhWgN7aMWslWhG2ZUnQJeX01k9z3AB:A4ZiYNWdGGsBlHRN79wG2teR9zbov
MD5:	1B618CFA8DC24769106F48C2FF592EA2
SHA1:	F5836904C8F136EC4366F9426CB0355F13D1E9E3
SHA-256:	2368F572CE6EC4EECFB71808AD1B457C1E7D43304125C02E558F7CA844A777BE
SHA-512:	03F9EFEE058695B70640B370342931A0DF35342D7F85B1F9376D2CED26175B55A02CDC798AE6ADE016CA8EA5847D4A0D30F00554B32BCC727DA180DFF39DF417
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I..........." ..0.............2-... ...@....... ....................................@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............<%......D,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........C.....C...D.C...a.C.....C...-.C.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................U...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67712
Entropy (8bit):	5.660519252433162
Encrypted:	false
SSDEEP:	768:HyoOCK7e48Rva+O3yc01mDJTYHCX1l1/qC2Od1pRQXi/2iWDBSjpxLVNe9zJf:slj8f01l1yC0S1GB+pnNazB
MD5:	A97E1B293D218327A450E74016CD1C60
SHA1:	46A8546A8E78FD53E8CC22A8F9B9E2D043346D84
SHA-256:	AC393EA808E561C3D91CBC155F9A5F6259CB4925A5E53DB403A13995017912C1
SHA-512:	E9F0B018A3E9FEA1757294F5BFE3267FE59EF85D8AEBDCCF4F528992FCE931F3067B97C301EFF243074A71383C28BB2029EAC037970B48B70D39462F2FCCFDD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T..........." ..0.............2.... ........... .......................@............@.....................................O.......H................(... ....................................................... ............... ..H............text...8.... ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..`...D.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.>...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.495016622719389
Encrypted:	false
SSDEEP:	384:K8ofwP3cgks1u161ZfWSmmesBlHRN7p4/P/R9zV+eo:KfwP3rks1u161ZymNjmPZ9z7o
MD5:	BC4614CA754167DEB95F680F4B92ADC4
SHA1:	DBAC86A3EC1BF6F92D61F4566E72FC71F6A601F4
SHA-256:	270957DBA73C73F9BC7E3F8EC5B9ECC4F5AD9D829EF2ADBFFFEA22F7A1C44D60
SHA-512:	1B55F6185F05EBACB57D8D66DAFADBD6E2B33382140E4741E6C42CCAE7758E4259643554DC62A83E9B6F6C4AF8F2A5CB702BE687101F9BD02E40F5C3878ACE0B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y..........." ..0..............:... ...@....... ....................................@..................................:..O....@...............&...(...`......p:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..`....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........3.....3...D.3...a.3.....3...-.3.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................E...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.362665721475072
Encrypted:	false
SSDEEP:	384:c+Zyw6I5/Eo4CoWmd9sBlHRN7gOTN4tgR9zJNZpwI/:FZyw68VMdejgOTNx9zt
MD5:	E00C6339FDE503C6073571C7D084BB1B
SHA1:	0DFBA603DACAEAB263ADB7165C034C1CF439C8F5
SHA-256:	8438D1722A54CF4087C4CD0667A263CAF5E375F91D9DFF1F50593E5053658363
SHA-512:	0B9A8DFA4AC9E726B6D6A328C6B0945B684EF3E3D7E1518BDC860BEF33DB2D57F28503429886034D12D6AF68A0D26B8F220598FF414C8A35DE1A523FC94C3AB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.. ..........j?... ...@....... ..............................L.....@..................................?..O....@...............*...(...`.......>............................................... ............... ..H............text...p.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................L?......H.......P ..............4%..H...\|>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........@.....@...D.@...a.@.....@...-.@.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................R...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.684559109394485
Encrypted:	false
SSDEEP:	384:7jFOafcW/oBsBlHRN7SrBTN4tgR9zJNK9:gqoij+TNx9z+
MD5:	33002C7A5455D798943523E077A68FFD
SHA1:	2008B6F9C8B5518F65390FA97A4B4EC9041C2197
SHA-256:	04D2AF1BB2BB587BAF95DBE0A59975588E5C37D0B753AD43045A5445DC76FB41
SHA-512:	6DF696B2C2EB3F4FF0520D8DA0E76CCFBCA8CEEBC06CE7492A700B32C6B76389B65DA32224F90E254E71035800081370A7C771C1730F2E3E8B69D7BF516BC9FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w............." ..0..............(... ...@....... ...............................!....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..H............%......('......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........5.....5...D.5...a.5.....5...-.5.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................G...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.475943131104714
Encrypted:	false
SSDEEP:	384:YWYfeDRPDYOlPWcbThsBlHRN7ubN/P/R9zVXFo:jY2DzbTCjubVPZ9z5y
MD5:	D1CF5C2DDB8DE489E2CD3D6CB64BFAFC
SHA1:	1600269D0C291BB5511A35249CB83AE6AC679FD4
SHA-256:	62A04F7E6875B0BC167C6F5ED3F621BC248FF425A4111BDAE67C77C4483A6054
SHA-512:	DC48DD4F85FFBADE707E77770C81EED6EFC948A5CBA544A9E003871505CA92ED5B639FC04961A4A3F37AB05293E6E9D8DCB9374BC44C51D4D1654ABC9AB0D110
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............4... ...@....... ..............................Nx....@..................................4..O....@..x............ ...(...`......t4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%..h....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........2.....2...D.2...a.2.....2...-.2.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................D...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90776
Entropy (8bit):	5.457045042236705
Encrypted:	false
SSDEEP:	1536:gD1915SaOoaHCCURoRawCDsgWFtXp6wwykCTGsLxLwzu2FawKCPX+vdkitXBxcGN:g/SaOoaHCCUwBasLxSkHrN
MD5:	A2E77D7ABAFD923A7BBFD514D1998EEA
SHA1:	C6252062E17AFAD59F8C8863F5C828617BEAD92D
SHA-256:	E827BC686CCBAA9838597BFCF01F4EB40DFAEDA113651323ABD23596D8ECC106
SHA-512:	A090305B5F5D8E4D382202B81E7E72C35A549C71903C8D653DF0B61F198D585E20D7FAE2DB80421370E6937650D5E6F19DBBA9C77C559C5FC50A3DE46BB4817A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[............" ..0..0..........bO... ...`....... ....................................@..................................O..O....`..H............:...(...........N............................................... ............... ..H............text...h/... ...0.................. ..`.rsrc...H....`.......2..............@..@.reloc...............8..............@..B................DO......H.......P ..$...........t%...)..tN......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.>...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\fr\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.749095901413472
Encrypted:	false
SSDEEP:	384:vBLFLHlWWDYwVW+1RsBlHRN7dc/P/R9zVbUvs1:NZHlLDYe1SjiPZ9zJz1
MD5:	7962935D9170E6CA9795B2E6EDC9E991
SHA1:	3DDEE15DCE62EDA70C12331E06AF81A5F0385476
SHA-256:	385F8142C5E154BF04AFE8656B75E33A2C0B3DF975BBAAAC400DF59F0FE51B9D
SHA-512:	B6184FCF663904D1A259E7F54FD936EE962A349C425BFAB7A38D4A0835CB1067CF588AF4DE8CFE0AA2FE5804D2EF51A8AD99607E104ECC1A067D812B3B45E338
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eS............" ..0.............r+... ...@....... ....................................@................................. +..O....@...................(...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........8.....8...D.8...a.8.....8...-.8.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................J...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25728
Entropy (8bit):	6.2799109933248145
Encrypted:	false
SSDEEP:	384:lyk0XSXRaRmI7FXdXxa+yTQuvB2NCMhS4Yl4toaWYHAhQ5WnsBlHRN7RHGlD/LVH:lykpI77yUnzvYJ8jkxLVNe9zhqV
MD5:	31D09F9597BCE764A1627C16AA196A5B
SHA1:	1864C559151D0E94DD98FC9ED9BE40659B2F6586
SHA-256:	58E25F412836BF10B6C97096EA38B01776702F1EAC56A41A85081A2355795E35
SHA-512:	F36A98634B9975B1E50ABC01E160802FD9B4C7C7B97CA2633681AA9549789AA4533FF77F390ED6A3352D75DF90250DA4C53496A036B12892B056EA35C1856FFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B............" ..0..2..........2P... ...`....... ....................................@..................................O..O....`...............<...(...........O............................................... ............... ..H............text...80... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..$...........t&...(..DO......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@.....................u.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111256
Entropy (8bit):	5.355901774590971
Encrypted:	false
SSDEEP:	1536:y61jOkdyNdGaJUTLigAwD38EQ09PngGaDZMcn53pz54:R1ikdyNdGaJKLigAwD38EQkgvMM5W
MD5:	7371684261438CA5D4C823E0CA0FF143
SHA1:	92E779C85D7A12DA80D8B7A9112F8034E97C7129
SHA-256:	AF8F4E3E61FCA35EEC82A9962A36B49EA8161F8A67B174B91E9351274B058FE3
SHA-512:	F3AD57868B75D8C88803D2CB75C7763B36D9920EE8650A825726ED23936C2FA23925A2A948A66B0F53A987727C4C33AE707FE78A334E684E39452705CA6BEFB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;............" ..0.................. ........... ...............................~....@.....................................O.......x................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B.......................H.......P ..8............%...y..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	205976
Entropy (8bit):	5.213971410719787
Encrypted:	false
SSDEEP:	3072:YZdCPEAgU+pzmIr1ERg9wRK6kwFvJwL5iQRZJAybVHTKbySu6Ri6JhMrvL+E1fb7:YrpLwFvJwL5iQR15TgHRi6JhMmE1fn
MD5:	4FCA931DF78B5C1C06BB1AECB4B6423E
SHA1:	919AE76A2F811078FAE1D587B0E2480BF90E994B
SHA-256:	03BB849436C6265C6AD5403FC883F44AB960AF6DB8154500ABC42491220C4F7D
SHA-512:	D323BAA08A3D8B0638C1A68DA69372018A2E217CC4DFA5131AAA12B893A4D7EC7C085D7E189AE329E261D8CF0F3E3198C384DF52830B0787057D6CFD1DD2EC54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,............" ..0.................. ... ....... .......................`.......,....@.................................`...O.... ...................(...@......D................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..L............%..(...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45720
Entropy (8bit):	5.631036430253525
Encrypted:	false
SSDEEP:	768:29wjC3+TmwA//4Ag2nXBvxEBJWI1EjgpTZSi+RD7Ng9PTGFVQL49y9jlbPZ9z/:1jC3+T0FX9xEBJWI1EjyTZSi+RHNg9P/
MD5:	AE7823EBBC7457964B4FC41C9C76BB4C
SHA1:	A7FE6791C16A6353B6D69C3B9C94817AA22570E8
SHA-256:	0E889ABF4F42D4DD45F5F68D5DB162C646577BEA52EDB22FF6563E47130616F9
SHA-512:	E703359100889845DB67A8727970142C2465EE2AEF40891DDC7E99D9EE87804E75DAD4D2239E31D16B989CB1651AC1B14A25172B023EF1D9AC4E58BD2C48140D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h............." ..0.................. ........... ..............................n.....@.................................d...O.......h................(..........H................................................ ............... ..H............text....~... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%..Hx.........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39576
Entropy (8bit):	5.782122683427072
Encrypted:	false
SSDEEP:	768:S2/33OL9ecIZSmd9O3a7Pp2Ifgn9HjFmLH1nKZpOdnwwtw1ZhbBUmSCVyRj6eTNS:h33OL9ecIZSyM5VyRjpzq
MD5:	A631A0F40FFD9ADB2ABB5BAF838094AD
SHA1:	D1D15C2206B457D9E20C47C533F959BF100BF1BA
SHA-256:	04AABAC83DF44886042CC859DCB0BDF075C1DF69A8AE84D0430A78D49C6A6029
SHA-512:	0ED5F5444AA05D0F6D3A79D0811997D83849D2B1F78F4F06BC954580911FDF6B7DDEAF4AB19760E7748E23225680DF8DC734207A3C49DF409E9F96C4BE83C3A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..h............... ........... ..............................`.....@.....................................O.......h............r...(........................................................... ............... ..H............text....g... ...h.................. ..`.rsrc...h............j..............@..@.reloc...............p..............@..B.......................H.......P ..\............%..p`..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.525158816571632
Encrypted:	false
SSDEEP:	384:ZhFryUeTeoWxC+sBlHRN7hTN4tgR9zJN1HJl:nFWUeKXCtjhTNx9z7l
MD5:	C018D7082BD0E3E8ED413E64CCF6D963
SHA1:	2F1293344E78E95C32BF46C202AA2ECCA70E3EA9
SHA-256:	562B11047720820A18761D8C2C74A3618746607F6D53F1ECA39FAAD84C4E909C
SHA-512:	99C3177F208B8188DB13ECA6C36DE7390EBBCC4C71438592AAA347DBF290687D005F14FCF455B917995E6DF2B8C45D5A3D48B9A9D6E4738D1EC4894CB8D17BB4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....8..........." ..0..............4... ...@....... ....................................@..................................4..O....@............... ...(...`......d4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............,%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143488
Entropy (8bit):	5.429821998512487
Encrypted:	false
SSDEEP:	3072:ixR9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyfbYlma8HgbaJeQEwR1yli/h+JsjVo:iosjVHJ57imrLeMiHtap+nduj4
MD5:	23635F6BD1D5D07276EB2CF3F831A4CA
SHA1:	496E84FAA25036B37FAA182D04C83331BD9BBA2F
SHA-256:	A289C28FDE2BF6F3F7631FA8036CF3A81A54326C127A13964B1E02121FE15822
SHA-512:	319C2E74D845684BEC691C91247BF48C90A91633C06CC42DAA049BC17395125A85CF6B96896A0177A9822A0B76C3CFDADCA33D5D2E1374BCBCDFD0E87576F033
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....A..........." ..0.............z.... ... ....... .......................`............@.................................(...O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................\.......H.......P ..T............'..............................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.756577220384937
Encrypted:	false
SSDEEP:	192:TqGN1KIWtiWsoWo0A2j9seHnhWgN7awWO0uUEhG2ZUnQJeX01k9z3AaocpU:THN1KIWtiWfsBlHRN7VG2teR9zbocu
MD5:	AFD4FC41A0879C0D417BAC4E5B364622
SHA1:	01C750D11FE811630455E555263577065F1722C8
SHA-256:	E4B2A4705014B3F09D96AC0330CCA1C5A1241101E04C5C024FD1E495C5FEB052
SHA-512:	5A40235EE83D33ACC6C7F01D02F81907D96515685A10B81DFA5A356B3775B97B5DDDCD44FD818EB9990334F9EFBFDA744679A6DFBFAB2199DAC02ED24D8833B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m............" ..0.............^)... ...@....... ...............................p....@..................................)..O....@.. ................(...`.......(............................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................@)......H.......P ..(...........x%......p(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	361600
Entropy (8bit):	5.060868192553264
Encrypted:	false
SSDEEP:	6144:Q935s9SaujD1ITpHJ//OPJfl89yQzcpvA/NgkYhyGkuy4f9NEzFWKXlkF:Qz6Ch
MD5:	DF1A18D516D58101D7D726B69AA0D0FE
SHA1:	7E14D3130B9C669920452590606A6B04D2AA3DB8
SHA-256:	C5270BD7F3807B281AA44CEFFB47CFB0ACB30793E78C653E12832627D67B9134
SHA-512:	200D753913B96CD959CE934E48A7AD7392B6F975E1321C8B1BD1B918765FC5D1235429DDE14C9926C2F1AC82F9647DE2C73A6D5794A89F7E19C3BDB1C98D7797
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p............." ..0..R...........q... ........... ..............................).....@.................................\|q..O....................\...(..........`q............................................... ............... ..H............text....Q... ...R.................. ..`.rsrc................T..............@..@.reloc...............Z..............@..B.................q......H.......P ..`............%..0K...p......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................I.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.666212664835782
Encrypted:	false
SSDEEP:	384:bStFrGg1WdGvsBlHRN7NP9j05seyR9z0Vu9P8ua:cUGEjNP9j05sN9zAWUZ
MD5:	7F55C9738C573B3279324983E29CC118
SHA1:	0368A7130AE8E6A1997B7D62F7B1760925DA2F55
SHA-256:	66CE9DF9EE235F60B3834A1762837CE03136FD13A58C94D41221B45D3F9F9E48
SHA-512:	164138A1A800A790F584FA6D26E8E56FD2A15A89E516527814B0872B61A114ED0B7C824035412D47D55D776A6FB481EE73062374C4A37A08261F303B3F12B5BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=R............" ..0..............-... ...@....... ...............................>....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............<%.......,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66688
Entropy (8bit):	5.605863491135274
Encrypted:	false
SSDEEP:	768:+oOCK7e4KRzqPthDd4EqfEJ2zGxTKnVic/f7inlNix8BDtjgG2tC9zb:oljKsamKV5f7QB55zb
MD5:	BB2DF1B3679D9D556FC49DF1945207BE
SHA1:	0BDF3AE9DE3C2A8B1DFEE744D399A9465EA7BF36
SHA-256:	2553806D9AB624509528C4A72D0628F06EA4664ED1ECED63BB70A7C1AF88F855
SHA-512:	8D0663AE3D6FAA6492FF6A6EC4D5D7E13C7A395338E8A71C9A1E9C94B21D69CAC43F1BA38B93226583840AFF0FDDAB79516C8B84115BB40DC0E8DAB4ADFAAA87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i6p..........." ..0.............2.... ........... .......................@......8.....@.....................................O.......H................(... ....................................................... ............... ..H............text...8.... ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..`...D.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.482402470262076
Encrypted:	false
SSDEEP:	384:PlEfiG3QULQsz1X0WSmmGsBlHRN7o//P/R9zVG:PlSiG3DLQsz1PmljiPZ9zs
MD5:	D9E5575C4631A8174E2518B39173259F
SHA1:	CB8DF351CC6D6D3D9AF5C5EA235DFC480336CC44
SHA-256:	5B0B6A3C9A050081D572F74B3909CBE8A27395DCDC7F7E177EF32D384C9018DD
SHA-512:	27793687AB64703329EB9E0EC08D371DEF7F4F82949A9C43A91C45A2F99682DCC8CF41CE3CDED38CC4CAB75D6080F2F6D79B46AA862AD45CE8CEF063CE5064EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....EN..........." ..0..............:... ...@....... ....................................@..................................:..O....@...............&...(...`......x:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..h....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.....................................................~.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.3371594998284575
Encrypted:	false
SSDEEP:	384:nXhFYm5+RlBgyEuoWmdrsBlHRN7P0LMB+6R9zctFdF3I:XhFn5+RlpVMdAjsos29z6+
MD5:	0167A6DCD2B81F490BCC18BD1BE660AE
SHA1:	BAD5722011E211C117DE88DBC64190C10D538541
SHA-256:	AECEBA86D0107DA0FDE0351B8AB1B0428251CAB6DEA546F88D03E7714156A5ED
SHA-512:	35536B6FF5CE22915C1B187B1A28A457A2163F56921AC078554FC6348DA46D9824F8BFAFF55044AED3B3B86528C5C079050CE02E0F8296430B1BCBCF767EEAC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[............" ..0.. ...........?... ...@....... ....................................@..................................>..O....@...............*...(...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.685415636778882
Encrypted:	false
SSDEEP:	192:QY3Z3r8W5kpW/owWo0A2j9seHnhWgN7akWsSks9gICQX01k9z3AFM5:HlIWMW/o2sBlHRN7+/P/R9zV5
MD5:	F4875BAB7DB4969AE4AA2AF986C4C658
SHA1:	01BB3ECC246D678EE9CBC757AA18F19B4E1C5363
SHA-256:	89A76403B81779E6801277ADF5D02B7E15B96635DD74E51B5DE8CB1F2E2D03BE
SHA-512:	AF8F03D4C065B45D9A4CE1A31E3ADB882C5287F31F797B7ECE47787BEBC06F38D8C6F12F898405EB8063144B71DFFA5DB8F7749562E01F93D909C8A0AD7F519E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&............." ..0..............(... ...@....... ....................................@..................................'..O....@...................(...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..H............%.......'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.471893068415479
Encrypted:	false
SSDEEP:	384:1C5K6/ebWcbmsBlHRN7iij05seyR9z0VuF:U5l/ebbFj7j05sN9zAM
MD5:	CB8E644218915F27C4D861FF4CF1B346
SHA1:	CBE5625E1213E23D946B78BE1B1DE7C27F5BEDAA
SHA-256:	E2450F9769C5F144ED3380F34BF268DC5D01C29AF7A05F3141494ED93F13DC8B
SHA-512:	AEA7CFA21C8B50D136FE9F2D008E2BB2A2AC69BD00CC06FBF0E1DDCDF1A97A4F2A4FC711CD0B57D62E4A4BA935B552D161B1EB289F7A8B1E99296E56FB4CA840
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f............." ..0..............5... ...@....... ..............................]{....@..................................4..O....@..x............ ...(...`.......4............................................... ............... ..H............text... .... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%......,4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91800
Entropy (8bit):	5.393322280331218
Encrypted:	false
SSDEEP:	1536:sD18vHwqbwBqAbBdQsj8uwrCeW2bxVjQyvzcn:sIQqUBqAbnq227QyvA
MD5:	D08B70AE940610A53A73B924398E9BBB
SHA1:	0C4F0D645CF8CBA52B0298565922560B77FDB61E
SHA-256:	8EE90B6F770A42BC4382D46BF550B6CD75141512F9B3C509D03237D6C05E5964
SHA-512:	BCFB91410B9AE8B518E2FEEA176E402C9F5133AA584D3B9B3875EC81DBF2EDDF2EC80E8E7B4239E7CA93B66F7E3981BE77E2272F48DD71948AE8AFBEDB130FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...FW............" ..0..4..........bR... ...`....... ..............................\|.....@..................................R..O....`..H............>...(...........Q............................................... ............... ..H............text...h2... ...4.................. ..`.rsrc...H....`.......6..............@..@.reloc...............<..............@..B................DR......H.......P ..$...........t%...,..tQ......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\it\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.723196181924758
Encrypted:	false
SSDEEP:	384:oK/LFLHP2WBrW+17sBlHRN7O8/P/R9zVZ:nZHPrBV1wjOAPZ9zP
MD5:	679B4A75F379821F94F3830C21DC7CD6
SHA1:	021E95EBF43F7B313080CE511309B021750C044F
SHA-256:	0E1C87A6458776F826E794BC8626A7C4A1776020A4F370F20F141EB479EB40E3
SHA-512:	423550BDFBAE780E4497D61547D95383231DBD6D517CE5E782CFBC69264B03905FBB19DD332DE8FFF85F9831ED0F064DE55845C42CEE190A380C8BFBC516B3B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I.1..........." ..0..............+... ...@....... ....................................@....................................O....@...................(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..T............%......$......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26240
Entropy (8bit):	6.496918731577293
Encrypted:	false
SSDEEP:	384:ecXSXRaRmITXdXxaDgdQuHC2/bN/hsMS8mQeoaWYHAhQ5WmsBlHRN7ihMgjLMB+q:exIKg2CvZzBVjih7jos29zQG
MD5:	EE241D45FA3A26F6F0296C2473BEB7EA
SHA1:	50C1802B1EF9B97FDB58FC48B4C40DF1E927EA44
SHA-256:	0CF6ED267DC71D5619F83637DCC946E66EE45BD885741B0E311DFF09F53B4D86
SHA-512:	88C535C0A51FDDEC327AD808F57B57FED60BFA6D02C8690353F40502ACD295169870050C8E151EB079B0D04423C06DEB3123ACB7FEEA1FCF10C02B3BAB7FA4FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$~"..........." ..0..4..........jS... ...`....... ..............................G.....@..................................S..O....`...............>...(...........R............................................... ............... ..H............text...p3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B................LS......H.......P ..$...........t&...,..\|R......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3......................................2.......................t...i.......\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C...............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122520
Entropy (8bit):	5.859090602132088
Encrypted:	false
SSDEEP:	3072:U1iq8ongmeN0n3NIHE9qPWayjuTxkQyv3:U1iTonzeN0n3NIHEw4uTfyf
MD5:	3AA2B1F5F0725DCD011623625B86C439
SHA1:	8D1C426FC2D221370BA1FF4AB5181734C4DE4748
SHA-256:	97B285A986C29B1A68DD0BD302CD3A26614F8F5E0AFD6DE265D18915C8A9EE60
SHA-512:	4A01B28ADA3EE1FF944F0FD668E2165C9B91024FA4A8CADD892E8C25302B26E4E29DAAE04EDEDA6700508ABA182FF94C9D96C70ADFD9991736CBCC9C575936DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............^.... ........... ....................... .......o....@.....................................O.......x................(........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B................@.......H.......P ..8............%.....p.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...G.4...d.4.....4...0.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	226968
Entropy (8bit):	5.781343199918642
Encrypted:	false
SSDEEP:	3072:FZ7TxP+FVBHOLIW1JSKkPkfsRvpI6LXVV/KgSDghzGXVQMgCJja7tCftJI09DFxA:FHIvpI6LXVV/Kgxh+T3Jja7aI09DfOom
MD5:	0486923CE86EC8D0BAA5478481C659CD
SHA1:	24E4F7268866F970C4013839D13A444B31D62F94
SHA-256:	4CFF022E0D6E54566779786BF58A39AC3C22104053CF0FBE1838CF2B7E875E52
SHA-512:	1CE037E8953F17DCDEF8A1AC55A5AF606D201569E55E30747D7CB2E0D91F62A10B594893291ACAE0F2B9B9613957BE3C81B75849FB0C12A0F87098BF896ECFB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V..........." ..0..D..........Bb... ........... ...............................h....@..................................a..O....................N...(...........a............................................... ............... ..H............text...HB... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B................$b......H.......P ..L............%...;..Ta......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...G.9...d.9.....9...0.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49304
Entropy (8bit):	6.077738402360184
Encrypted:	false
SSDEEP:	1536:UkcX2TzfJJv7dq9umYxE627qGIdsHoiyofpzC:LGIdsVPu
MD5:	64D2110C9F5BBE0F0C3CB6CF2001089E
SHA1:	3603FE5A97F24A3D0FE7D5B9043367566942CA5B
SHA-256:	1757BB7FDB6B128DBBA81BA52CF627267070A0A5D873DF03F15F2ABEDFE4AA9F
SHA-512:	84C612CC56EB2C68B3E40A16A7E44081A3DABF1104712E497FABA6A58A54D55BBBE896E2351B038351B60E25B2070E6EC4BE3D928C6347C01C9AF8827873CF18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ...............................r....@.................................t...O.......h................(..........X................................................ ............... ..H............text....... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%..X..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42136
Entropy (8bit):	6.139516661516243
Encrypted:	false
SSDEEP:	768:ty33n4eb43ixJFkPlRPq2Z8VZHOj0mncTcjxOfjbTNe/L+hsgP+jN3y5yBjeHPZ6:033n4eb43i9SLfGyBeDzmP
MD5:	5886F7AB1D922C2F40284F592581D43F
SHA1:	066C5BEF8C78FBD3385C69E6C76AE11E34868C8A
SHA-256:	40501B0EBC240A4B752267B575862A524FE3DA461B578A5ADD4BACAA9C509193
SHA-512:	8FFD214D7F3D8331F7C718D53A29C5375B95A983E48A826FC36F744E9A609CE28232F41E6BCFDEBD2B06393DF0C7296DE00EAEA535E9BD6E1338E457D3B9FDC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..r............... ........... .............................._)....@.................................h...O.......h............\|...(..........L................................................ ............... ..H............text....p... ...r.................. ..`.rsrc...h............t..............@..@.reloc...............z..............@..B........................H.......P ..\............%.. j.........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................................................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19096
Entropy (8bit):	6.618757862663788
Encrypted:	false
SSDEEP:	192:POFRzE/Pf87EzEwt19UYhUoWxC6Wo0A2j9seHnhWgN7akWYrks9gICQX01k9z3Ao:mFhWfO4UoWxCwsBlHRN7f/P/R9zVPUa
MD5:	0EB4BE608E4A011FA1C349AC7D6E82BA
SHA1:	54664AFF8BEE661CA38476817EC171BC7B350337
SHA-256:	1ABA0DB4ACFD3FC0892F1B49F28F4596528A2303803F4CD318B46A9601EC3503
SHA-512:	DFAC3E4EED47C534F09E4899D7C8F8E5ECF8537172222A9D532C7B229994805374B0FAF53EBF8260534B640EE6C949E257199EB2BA94E333D519780EDDAD0D94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9..........." ..0.............r6... ...@....... ..............................n.....@................................. 6..O....@..............."...(...`.......6............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................T6......H.......P ..............,%..X....5......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........B.....B...G.B...d.B.....B...0.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	148096
Entropy (8bit):	5.814299945149681
Encrypted:	false
SSDEEP:	3072:PR9MtbGzbtyHZ/I11DKdwWorcP4IVCUncl6ShW/lxyH+VcbOruHtVy7sykRtXusG:DtXuspMczTeYjqO8
MD5:	AFE9E9F524435CBF29F346045096580A
SHA1:	8CF3F7F48C65DFDCCA9EB5ED05FEC8F7B5162FAF
SHA-256:	6A50F7DFE18B429616D7B249C547F0EA1377CB31A8330291AC61EB6C64D16100
SHA-512:	8215323B42C6F7EAA3803C224485D6C58EC690FCAC4621B7C216B269B5CBE6B34AEB9D6CCE5DA94E61152E857F9AE8B7CB5A4239DF2602CDAE704F4233408521
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............B/... ...@....... ....................................@.....................................O....@...................(...`....................................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$/......H.......P ..T............'......T.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3......................................2.......................t...........\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.73319787639187
Encrypted:	false
SSDEEP:	192:os4Mo2zWtiWsY+Wo0A2j9seHnhWgN7a8WCItzJVOYOg8nK4X01k9z3AvXVbPK9PO:rHowWtiWosBlHRN70FVOY/wR9zQXVWVO
MD5:	82BE9C3EA10822AD91F254AF12B68746
SHA1:	1C0C9E0E395A92592A55EA1C45329AEDBD56ED4B
SHA-256:	0369EFC89083ECBC599173C081BA3D6967653E14BC4AC38219B4E3956CFF7BA1
SHA-512:	6E7CCF0DADDEE6ACAA24102035593822430611C770026F878232470D2B8FB372A26588E1D71F0DA62D6818C9DA30A962B9DCA89FF7FC0F4E861F450F1B8B8DA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............&... ...@....... ...................................@..................................)..O....@.. ................(...`.......)............................................... ............... ..H............text...,.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P ..(...........x%......8)......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	401024
Entropy (8bit):	5.680617630804586
Encrypted:	false
SSDEEP:	6144:t932KC3tQwomGKgdPo9k1i83iAdzMhHtPJRIDQ7:tkKC9R9r2DQ7
MD5:	3338236EB7A2857CB990C3E67AB4BB33
SHA1:	5359EBDB78A81FE2C58E2FE3B525BA907100EC2B
SHA-256:	B91B2DD30E255F35F14B7D838CA35D0DF1BBB2FA5A07D5A784989FEA8270C222
SHA-512:	88810C832BB5EBBC289420B5DE6A849F15A8BBB70DA00FD2B9D945364C1560A591FD31BBF8E026F50001CEC50610E7BE616B85062C54A3A0B0A149F2D1299E2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....qP..........." ..0.............F.... ... ....... .......................`......S.....@.....................................O.... ...................(...@....................................................... ............... ..H............text...L.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................(.......H.......P ..`............%......X.......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3......................................2.......................m...=.......U.....U.....U...G.U...d.U.....U...0.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.8116843849666
Encrypted:	false
SSDEEP:	192:jfIQ9dxleKCxAIc+GWdGNWo0A2j9seHnhWgN7akWz5+ks9gICQX01k9z3AFMxL5A:hTxEGWdGrsBlHRN7ck/P/R9zVxL5A
MD5:	DFFB7FDA8E290BAB5D84F80A611DAABA
SHA1:	95A17ECA54F52F338786B2B7D72C53D28CE542C6
SHA-256:	078302853C5721AC4A807E044AC116882C1AC4BEDB2E8236C1CB9072AA3C5BA1
SHA-512:	04845E832B953E871BE9C6A921F1A5A47A0288DEC6C5478BF9D1524E96DB6BD4869399281450017827958834C0EAAB2C72BFD1C3338722FCDCD7DE74FB1F358C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....tb..........." ..0..............-... ...@....... ..............................o.....@..................................-..O....@...................(...`......l-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............<%.......,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........F.....F...G.F...d.F.....F...0.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74368
Entropy (8bit):	6.114329340745404
Encrypted:	false
SSDEEP:	768:OoOCK7e4waPm7miIFkK1qiQqNpqMJpFg+PgDA0wJG62Bwj8os29zcX:YljwPbug+Pg80cG/BQ8lCz6
MD5:	E76A0BE8A222DD74B0FEA19CA4EF06A6
SHA1:	66F906F7D20EA945D9329748D54AE98DEADDD548
SHA-256:	1241074261F0B286D26F1C1BAA4FBA1CF6D64AE0A1AB39E95A0C47DB2F8BDC94
SHA-512:	E2613613BF2F8A2D72C08E88319B444492718EA616E3A3A674973CF57DFFECA0F9C6AA79FC574B138C115A24394419A60B1CC62C4D3EBD78C887D7B6781B6B7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=.g..........." ..0.................. ... ....... .......................`......D*....@.....................................O.... ..H................(...@......l................................................ ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................................................z.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20632
Entropy (8bit):	6.648019969884357
Encrypted:	false
SSDEEP:	384:Pfyg3QMTCeH+LWSmmSsBlHRN7LugTN4tgR9zJNBCC:nyg3vuC+WmxjSgTNx9z5
MD5:	5E7BD14D92B5A6246F15D6703EE05EA6
SHA1:	AEC5AD6740C388D991FAB6B26509529C8535E584
SHA-256:	359154B07BD873BCD2215319DBBEA87E09F45A1839A69DB3BF25C3741FD0ACA5
SHA-512:	3FF2C2B8A153FFB5F5130A2A332878144549CC89D1EA59DEEE2B77C3D39FA68FBF691C423EF55ED5547694432E326B433D460A3A2E26DDB4E16F63BE25940C2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............=... ...@....... ...................................@..................................<..O....@...............(...(...`.......<............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......P ..@............%...... <......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...G.6...d.6.....6...0.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21632
Entropy (8bit):	6.428256592837022
Encrypted:	false
SSDEEP:	384:AJ3Oci4Ryt+3oWmdVsBlHRN7pcWVOY/wR9zQsA:a+ciPtcMdmjb/M9zNA
MD5:	9F866CE2BAB1C04A60C6F5D1ABB63C3E
SHA1:	E8490E5E994C05B1FFCDA9E51FAD21FFA7DF79D4
SHA-256:	F25734D18A404A7EDEA8BFD86F4AE43551FC8F2E1796423372A92F40A3007F56
SHA-512:	E0A3B5876B2D7316F4F9120954BC321E512A2A755B63B616728ABFB7EBCCA9147F1024CFC756322F308A30CFEBE329CD9798C43E7ADCD4951F8F69C4C546E0A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>V..........." ..0.."...........@... ...`....... ...............................~....@..................................?..O....`...............,...(...........?............................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............*..............@..B.................?......H.......P ..............4%.......?......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...G.C...d.C.....C...0.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.715709792415442
Encrypted:	false
SSDEEP:	192:oJg033+23KWd3wW/oeWo0A2j9seHnhWgN7akWl0Awks9gICQX01k9z3AFMsRGzk:o60HFKSAW/o0sBlHRN7a0//P/R9zVnY
MD5:	A9526269EEA3A63FC5C2CD4F97F1F996
SHA1:	F7D69AB1DFB52C6B4D0D45CA0AB0881963A74683
SHA-256:	2043996733326F71ED2D7CAC100635DAB96D045276842AE0A145708C7F61810F
SHA-512:	CDF1702D37BF64BB898518B88FC4B195B05D1DC6E9901EA9442641679FCED00FD659320292E009AA12C19BD527F8507FD223FB622CCF80D62DE29BAA158F3EEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v............." ..0.............>(... ...@....... ...............................e....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ (......H.......P ..H............%......P'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...G.8...d.8.....8...0.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.571058205594018
Encrypted:	false
SSDEEP:	192:XSWo7grBqPWLKRBJTbWo0A2j9seHnhWgN7akWFaks9gICQX01k9z3AFMSXGKWw:CWocKWcbBsBlHRN7aa/P/R9zVSXGKf
MD5:	98B91D0E728F2C1E2DE14298BBD1C28B
SHA1:	927A910729A096F17716C0FE8CC33848C5F80A05
SHA-256:	4A67314C59633BD2853B73FCC18C63D0A8B4A265F4322E93C2B853E20C633F0F
SHA-512:	CF61951FDDF2B2EB55FCBEFA3C6091E7B8917497EAA15438649CBC29D17E8795102D7D6DF95D23763A10BAE6B37854DEB819DD43BCD531C15C1A460669C318D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............Z5... ...@....... ..............................T.....@..................................5..O....@..x............ ...(...`.......4............................................... ............... ..H............text...`.... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B................<5......H.......P ..<............%......l4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...G.5...d.5.....5...0.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	99480
Entropy (8bit):	5.917998892422826
Encrypted:	false
SSDEEP:	1536:qD1ylH/KKPc1unoDtpcy6C3eCQ1sJIxInHQyvzrz:qQlH/KKPc1u6iQKQIUQyvj
MD5:	4F14553471796EB233C796B3D1AE2375
SHA1:	D9A08EE0065C94EA094687ED1E40E1279C536730
SHA-256:	069D13D0292E10852F248ACAA8A08F237872410FF97C856927DF4E3F13E634DA
SHA-512:	7E2484AED3AC154A69953F2299CA1ECD5E516B4D950F9F131D45AD25E8615B74BF579978243CA548B38285A5DFE482FD3A4210594A710A1AB80C5C8D47D657FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R..........bq... ........... ...............................C....@..................................q..O.......H............\...(...........p............................................... ............... ..H............text...hQ... ...R.................. ..`.rsrc...H............T..............@..@.reloc...............Z..............@..B................Dq......H.......P ..$...........t%...K..tp......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................................................z.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ja\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.7215416935022185
Encrypted:	false
SSDEEP:	384:4L40Lm4WPCW+1usBlHRN7dC0Bj05seyR9z0VuGj:s44mVPS19jdjj05sN9zAV
MD5:	2F31F66904612D5C5F2BFE81C92AF01E
SHA1:	A41CB45C86EC7172F0BF19D1D10C1B50F6D22326
SHA-256:	3BDD51D8711E2CC188AA287272D9FDF06664AE8E4B134702DC83E496A7E8F6B6
SHA-512:	3E189CF2B483DEED3FDDD978853898FEAC9EC6241CBA6EE704ADF76BF264FA1487D618C2FA870A9655508C576BD2988F4999E6856737745E96AC7696FB62BE24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c............." ..0..............,... ...@....... ....................................@..................................+..O....@...................(...`.......+............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T............%......,+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...G.;...d.;.....;...0.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25728
Entropy (8bit):	6.514371839604758
Encrypted:	false
SSDEEP:	384:Mq/XXSXRaRmIHXdXxaWnNQufc92wOZhloWTVYPOJoaWYHAhQ5WMsBlHRN7PlGlDF:p/cItnm6nrqWTVYFnjExLVNe9zU
MD5:	F149DCBEE09097907DB8067BD950E3F3
SHA1:	559B8B780BF6BBF7B434D366861210AEDF9A4AEA
SHA-256:	1713BFD8ED86CF5C5FC20C862E5DF78516822401726687D9F34153127CBC55A0
SHA-512:	43A9C28DBC3029FBD4A0E0916DC2E545FE26DBBA2B20106FA25B54F03AAA8C052B68D3ED56FA4AA74B81D905FEDEF7D51E97E8D7DCD9DA81E0CD0E3581B9513A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,............" ..0..2..........zQ... ...`....... ....................................@.................................(Q..O....`...............<...(...........Q............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................\Q......H.......P ..$...........t&...*...P......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C.k.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114328
Entropy (8bit):	5.984500999678845
Encrypted:	false
SSDEEP:	3072:N1iiMPQlYZaOz+0w8etM4ckqpVHNYSL5nImvNWwSTLp/NfpxbRSlQyvnh:N1ivPQ2ZaOz+0w8etYkqpVHNYSL5n7Vh
MD5:	8C27D7375D8B4E3C32A8F725A90F91A4
SHA1:	0A6E61D09772E06E8A252F424240094FBA68EDCF
SHA-256:	A4EB81DE62C58111CED5AF26F88488CD9FAA3B5925DD75EDB3CB8219D1B26014
SHA-512:	4FB3854C18C4D3F6DEE9A1418C92D13BC843737EDAC206C8356FF33EC319E044D172F5671BE64F74D54EC2ADCA8B2014741AE808BAC3F6090553529695699AB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#..........." ..0.................. ........... ...............................~....@.................................\...O.......x................(..........@................................................ ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H.......P ..8............%..8...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........1.....1...D.1...a.1.....1...-.1.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.S...C.....K.......................C...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	211608
Entropy (8bit):	5.916580263416328
Encrypted:	false
SSDEEP:	6144:xNXtUQDKdzaIKaNWOgtu3GjmqEuGbMq4k/YS3CuREcGFSbpF80iSosN5QWuJKf60:xka/neGjmqEuGbMq4k/YS3CuREcGFSb7
MD5:	E1C12805FD1535F8DFA92675D0FEEC57
SHA1:	541FE9D4EE1BCD9A5260849EC844025A39DD3514
SHA-256:	5A087F34D3FBDFDC5C68E7D74E4EDC15B1096BBBCAB4A32AD1FD41363D4E8EAF
SHA-512:	56382122571B62007345679097BBDC72AEF4EEE33B918BB306EB0065853BC5C18BA69FD3984FA8961123D771519F9E6516C8FF7337EFDD6CA2700534CF742FB5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O..........." ..0..............'... ...@....... ..............................+\|....@.................................x'..O....@...................(...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..L............%..@....&......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........6.....6...D.6...a.6.....6...-.6.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................H...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46232
Entropy (8bit):	6.084850108095216
Encrypted:	false
SSDEEP:	768:KIBRV2DtGZcxaQ2TR6zQWFK4/W1ZgG7Asq+h8FhhYAuSoXU6oYy+jAMj05sN9zAX:rBRV2DGtMzQWFK4/W1Zx7Asq+2FhhmwX
MD5:	AA0231C3F664C7441CF65FB18361CD14
SHA1:	3CC5CD9C7D1C05CE47CA59D366DAD84FA6CFC1AD
SHA-256:	79832FB1B64DA69FE154555D57B8E297D8D94C32FE000BEAE32ADCBD5896C848
SHA-512:	16E8CA5439A7E96BD58357E20BA6A958C5A25A77C91BABA0E1F56BF2D1E98352F3F010A0DB9FDE23619706E520838ECC6FE6F6A47AF925D1782E55F8F11D371A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ia............" ..0.............~.... ........... ..............................;.....@.................................,...O.......h................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B................`.......H.......P ..0............%...z..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.A...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40600
Entropy (8bit):	6.164359454724118
Encrypted:	false
SSDEEP:	768:g5JShuaekc+o52KBCwsPN2CMRUw6cjzrcrrEcJOCm2NRJ0jn7X2sh+9NzZ6YAkoQ:yShuaekc+ogb4njWcy07mzyk
MD5:	4AE0A4004BFD01911B8502D653D14DD1
SHA1:	41996A2EFB149D46182BB323B93C8EF8FA9FFF98
SHA-256:	75558EE758B1558EE5005DB78652863EF15892EAF4A3D40219701CA9916F8E6B
SHA-512:	3FF1DBE5C927B3D777538507951DE416AA3B8FC832A5A5C95AC2DA5F67F360F46D4FFD81193002FC7DEB810F3DB50A489D969535D54164D0A7C854BA25C4BEE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..l..........B.... ........... ....................................@.....................................O.......h............v...(.......................................................... ............... ..H............text...Hj... ...l.................. ..`.rsrc...h............n..............@..@.reloc...............t..............@..B................$.......H.......P ..\............%...c..T.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.A...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.713216590095991
Encrypted:	false
SSDEEP:	384:5heYEyM3oWxCwsBlHRN7Y5WGlD/LVNSR9zuTle:H8yaXC7jYnxLVNe9z7
MD5:	5A1B51C8D3E442788FA232A34C924552
SHA1:	8B495A99E2ED6CFCBA7A3FF61753ED2493FE6B67
SHA-256:	FB89CDEB66BCE31BCA3D80E048E0716ED41263A0769BC0303DB205B54B208DAF
SHA-512:	AA2E7F1EFE2E291E0680C2BB0F5FF9DDCFDD78B38340831B466B8D3464E1C132D0F05B90CCBA2E494A49191B3CFC87003AE357E12EB51EF774372D83385BCA1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..............5... ...@....... ....................................@.................................H5..O....@............... ...(...`......,5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................\|5......H.......P ..............,%.......4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........?.....?...D.?...a.?.....?...-.?.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................Q...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144512
Entropy (8bit):	5.795638158370421
Encrypted:	false
SSDEEP:	3072:CR9MtbGzbtyHZ/I11DKdwWorcP4IVCLAFmbTwNOi74NsLGB41svN5O3Qsu3tvzYv:gtvzY0chFuxeyBzrHcBBo2BEI20f
MD5:	BF9F8C2E47EDD6B73A5E779E78EA6D32
SHA1:	5A08266E44B399928F27BE58C9E5230B4AA71478
SHA-256:	A01BDFC0268EBC2F687D6E39CBDFD1D0DD799F8F5AC064B69C22371F9F46F912
SHA-512:	14DFEAADB38294AFA13611CAD73913FE27D6D351DD506CB460C463681C05F1553769A9D5E66AB28E394941FD68BA296E43D663C62DBA36533DE30BD8F4C6B2B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............R ... ...@....... ..............................g<....@.................................. ..O....@...................(...`....................................................... ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................4 ......H.......P ..T............'......d.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................t...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.......................k.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.836847603035281
Encrypted:	false
SSDEEP:	384:FGv8WtiWWsBlHRN7XoqfLMB+6R9zctFm/xW:FQ5jXoqfos29ztJW
MD5:	C1970BA3E2D5E68CB0539B0D204CB8F6
SHA1:	A0C31A7684F17B0221E8B99DAC9AED9B0B4989BF
SHA-256:	42DDAE22BD97E68899708270B4AA5C9063FFB1F597B941A1B5D591E9B4B10654
SHA-512:	5863107143F8169EB0060EE31298B723D8B1C953CCDB96AA8669EF0C8D0EB19236E94766964ECC704A65B46F91892A9AB0BD37B63DFD685C65A12DD387650770
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0..............)... ...@....... .............................._.....@.................................d)..O....@.. ................(...`......H)............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................)......H.......P ..(...........x%..P....(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................x...........].....].....]...D.]...a.].....]...-.].................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.......................o.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	364160
Entropy (8bit):	5.8473896478302185
Encrypted:	false
SSDEEP:	6144:o93NYfeBkZ5Zp13/NIq6P1jLun4W4814WUB9JUqA/fmOit+DBiKw6BtBGxLS6vOS:ozXp8mt9PA/JiKfw6BtBGxLS6vOc/tld
MD5:	61CAA0F4321FD711BAC973B27EDDECFF
SHA1:	82701A453437D08DAD9CF2AA61EDD0DB69637E5C
SHA-256:	80EFCDF76306993053048611192C51E0C3A5DBB1F0E22597370EB960CCE0FBD1
SHA-512:	A3E491936B360C78F8E57356461CFB1CE3B816B26CCC5852055F840232DF1918A68167838032BB3B8ED5F649CA1A4A2FA036C2B5D149D9603206B65DFD806A0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.(..........." ..0..\..........>{... ........... ..............................:.....@..................................z..O....................f...(...........z............................................... ............... ..H............text...D[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................ {......H.......P ..`............%...T..Pz......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../.......................m...=.......R.....R.....R...D.R...a.R.....R...-.R.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................d.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.767452999473023
Encrypted:	false
SSDEEP:	384:7ye+AUwWdGlsBlHRN7cJLMB+6R9zctFeBB:CjGWjcJos29zJBB
MD5:	0B61A8CA3A8EBDA65C0C85F52A08620B
SHA1:	D029E593EDDBEF07198A1436E73BA59B21217A46
SHA-256:	1B88C15CB72659251E858803A65FCCC9BB0B64B0DE43920A33D53AC2A1AC7262
SHA-512:	D46F2B4E12FB2BCA7C72280F8C3548E088236DFB0436AB79BC56783D95BAC045BF3E0A389B54F54E24F15D8A322D8B88C7CCA6F2E5D2D7B711602B070DCF6E2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............*-... ...@....... ..............................y.....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............<%......<,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........C.....C...D.C...a.C.....C...-.C.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................U...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69760
Entropy (8bit):	6.228780819853762
Encrypted:	false
SSDEEP:	1536:jljTq2XvafM8qMQRQsMpbYSlHPGpQVPQh9kl6BSzlCzr:jljTEfM8ppbYSJeQJQh2l6cCv
MD5:	3505C992B0EE049BC5BC5371E9D6B1C9
SHA1:	DAAB3D8FE5EDB401846A74334E350EB6EA443FD2
SHA-256:	BC17EF8D17F87D090189C5AD469D119272B40F3BF57A30E307F65FEFCC0FD1CE
SHA-512:	0217B3F4899509DFFDBCE80433D6A89FC0885B4F45E4CFF90AF33022E11C191E917147CC42899300F8FEF864C53F1AF81A5A64379F6A97F5497290A144803A9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o............." ..0.................. ........... .......................@.......=....@.....................................O.......H................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..0...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.>...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.711752835589695
Encrypted:	false
SSDEEP:	384:8jfsi3FncDD8nLcRWSmmosBlHRN76LryW/P/R9zVki:esi3mDwmDjaPZ9zX
MD5:	DDF34B87F159AF781630E2FFE2D021B3
SHA1:	6646FC94910D653B6C4255358F7BE3CDC40BDBB1
SHA-256:	315FAB1B808AE506996395E5CA3A1D7EE88F60A5A9FE69E93C3D29A689DF5B0D
SHA-512:	A64BC4534EDE154C28620607BA816E3CEC386833223BA74ABA7E36E4E6189FCC2FAC42FB39D19F85D0092B53353E30305D2CB46854DCA73C9CD94E141F9CD6ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V............." ..0..............;... ...@....... ...............................u....@.................................T;..O....@...............&...(...`......8;............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ..@............%..(....:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........3.....3...D.3...a.3.....3...-.3.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................E...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21120
Entropy (8bit):	6.468997366369214
Encrypted:	false
SSDEEP:	384:nEYW4+GtWToWmdKsBlHRN7T3H/GlD/LVNSR9zu9V1:nhW4OTMd5jz+xLVNe9zMV1
MD5:	17D54904D6B85D95C1FEF5CAC4FBA1F1
SHA1:	FF810ECCB711227764E622547E0A16B8DEFD59EB
SHA-256:	0809D681DF7F9E92F13D5257894067CE8B2664C38BBFA0ECD4EC8670DB005777
SHA-512:	524FAD9D03012F3EEA46E897A6908338D41D341CB529E0E08A81FE685D9C0D329B374CBF2477435AD45E20EE44E5EFAEFD82C6391ACF2F1C14427956A498124F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............." ..0.. ...........>... ...@....... ...............................Z....@..................................>..O....@...............*...(...`......d>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........@.....@...D.@...a.@.....@...-.@.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................R...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.707022834312076
Encrypted:	false
SSDEEP:	192:3Rd3E33EWgjDW/oaWo0A2j9seHnhWgN7akWsaWGaN4NhrJgX01k9z3ASNTc9:hx4EnXW/oQsBlHRN7BTN4tgR9zJNTc9
MD5:	7DB2487E605F0C586CD79F87390E404C
SHA1:	AA185EF254BF63599C1DF4EF8557B041ECC9B304
SHA-256:	AC3B7FA007CC632F786D9036EB551E7957001D2AFD972C789A861445467700AD
SHA-512:	694A6B664A6636BFCD1682E430DE965E753EDD1DB3005FA2C7E8EBA7495D408D612AEEA0F8744C6220A30A2F8ED706CAAF61C5A2F7F1A44FDFE62F747DAA8EB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O............." ..0..............(... ...@....... ...............................l....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..H............%......@'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........5.....5...D.5...a.5.....5...-.5.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................G...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.504652949718969
Encrypted:	false
SSDEEP:	384:ryLXIzWcbysBlHRN7CfITN4tgR9zJNSML:eLXwbRjeITNx9z1L
MD5:	515CDCC420F622CA1402036877466F82
SHA1:	37EEEE3F7BE3F78564EDB36524CDB7796E3ADE8A
SHA-256:	3938302B976190BBBA4C7321B6D07F90D48CB84334A869AF6C8EE2D9990FB01B
SHA-512:	AD917128398AB3DD4A48F820EC6294E8E60C8032DB1E8847271DA31BE2B27163613F9E6EDE0A4337C087574CDD8D011526868D978209CE1BFD52E944A7179894
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\............." ..0..............4... ...@....... ..............................h.....@.................................04..O....@..x............ ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B................d4......H.......P ..<............%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........2.....2...D.2...a.2.....2...-.2.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................D...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92312
Entropy (8bit):	6.046358082081381
Encrypted:	false
SSDEEP:	1536:GD1INwyCoNWhi72pUwTO+R//4smPsEM/oAxG6Qyvz4:GCPCoNWhi7uUU5UA/QyvE
MD5:	E7700C5052AFF99DD34F97BA11230D08
SHA1:	D3E4AE9FDC88AD99B18C3CB814552DA7CA57E0B6
SHA-256:	A0C89960092F7D10BB3BC036A10DD246CEB96DC9AF4C6051C80FF06A28CC44C9
SHA-512:	A87B01992DE4CC2F7A37424820224452C8FB1FB20C7C577C0F38E082B809665157CEC2B8FC9EFA5282DA48D40BA13C8FF8F749022B89F9B069266D5D0B93BF48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F............" ..0..6...........U... ...`....... ..............................$.....@.................................8U..O....`..H............@...(...........U............................................... ............... ..H............text....5... ...6.................. ..`.rsrc...H....`.......8..............@..@.reloc...............>..............@..B................lU......H.......P ..$...........t%..(/...T......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.>...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ko\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.8096157301743725
Encrypted:	false
SSDEEP:	384:SBLPLHJYWwbW+1C+sBlHRN7gj05seyR9z0VuvL4:ODHJ1wl10jgj05sN9zAc4
MD5:	78C3C47F90CBD0E0EE9E0C8E7F08151E
SHA1:	B6376EB4838B3365385AD912D06402D28CDF408A
SHA-256:	7E4D29971AAD5B7E2D35751D01F9EEB638B607C0CCE723FB1AA9C4BBE4BDE016
SHA-512:	1DDBEC56483B80BA842FB2A263876635D36DA4B352142BFDF0F10F0744896BC1502360BA2AA12BA2956CECCD67A984E58F882D8243003F49BE4BFA24113C539A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}..........." ..0.............r+... ...@....... ..............................Ni....@................................. +..O....@...................(...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........8.....8...D.8...a.8.....8...-.8.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................J...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.352883013426118
Encrypted:	false
SSDEEP:	384:UrXSXRaRmI6XdXxaFhHQuOX2gyKh7BedZoaWYHAhQ5WNsBlHRN7qno/P/R9zVDNr:UQIHhw0iAC+jTPZ9zDr
MD5:	DCD536C3E31A4A9694DACC5B25045B34
SHA1:	02F0A56972F025CEAC9770A9A22C8DB2AF7D93D8
SHA-256:	831B5C1B7B05296090B02B61147E683D46B7FAA14467A070AFE813297768DF2E
SHA-512:	8A781A38251FF8A1A77AB75ED00CD41E544C6345859D11152F7E47D1DF4AA59022B7A9D732D055990FDEF7BA17C42ACD27839059531CED0EC638084BA13FD7AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..2...........P... ...`....... ..............................yi....@..................................P..O....`...............<...(..........\|P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..$...........t&...)...O......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......\.....\.....\...D.\...a.\.....\...-.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C.Y.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113304
Entropy (8bit):	5.583632869012404
Encrypted:	false
SSDEEP:	1536:C61jOrnusDdI0nAl/FUIz3df304fOxZ8jCWAfEuQErcalpzN:h1irnusDdI0nAl/FUIz3dMQMZgQEA5R
MD5:	9458DB0AACBC3E22365D4C9DA72309BC
SHA1:	58FFD89A2B3343961C0376C46DD05F689C3242E5
SHA-256:	9D6483E8CAC24FC3C1C07DFDD57DE55ACBB5E49BCCF36226E95D19D3EF7F51D4
SHA-512:	26365BD1EEBBE2287F47EDE91B5BC770D6E34A9D660F3F5FCFDC33947CEC2EA6D47A18C27716CB1F1B8A3E50155A67463CB476ECDC6B6C9CDBEDB00FB79E1F4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h............." ..0................. ........... ..............................6g....@.....................................O.......x................(..........h................................................ ............... ..H............text....... ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H.......P ..8............%..`..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...D.4...a.4.....4...-.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.S...C.....K.......................1...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	210072
Entropy (8bit):	5.4661194136840585
Encrypted:	false
SSDEEP:	6144:Sd5OgPxe+jT8oA1qZjdC3GoN2KNKB9OyQ:SBYoToN2KkB0yQ
MD5:	C1321346D3AC8FCCE9F25BEC959460E4
SHA1:	FE0527F008FF395B464BDC72CC1D305202DEA185
SHA-256:	FDF9550BA083DD84A875F6976CC07DF2B84EA86410FA68AAC565E6A05FF9F3A5
SHA-512:	FAAA9020EEFE05147171D006E755EB4AE79E02BD42130451A2C4AC7855E63C53A2239DF7494BF13DD05807512D0EAA32E361FBEEA924F1C2B3FFD3F747B0E528
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....'..........." ..0.............r ... ...@....... ..............................D.....@................................. ..O....@...................(...`....... ............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T ......H.......P ..L............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...D.9...a.9.....9...-.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................6...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46232
Entropy (8bit):	5.7721654607090604
Encrypted:	false
SSDEEP:	768:GexIgxhW7mPK63Mxj0HubXqbNGmiylgaD2nBqW0Tr9XL9nG+0WMNypj9TNx9z0:/xIgxhWGKnvbXqbNGmiyltD2nBqW0TrU
MD5:	3666E1766578D68183968B3D2E33C15A
SHA1:	9C70B59D18A09316AC79F30D10909CCC64A28CBA
SHA-256:	75D110DCC15ABE2D0E0CCC62C64D45D6B252D6460EFD53E4460472351C20F9A8
SHA-512:	8F2038F89B7CF9B4EF8ADCE01E5512EF8DFBC3E2B564F97DD2D1554857AFE519D066D099112CA89822C1DAE5065898252BFA598576D8435D30F05E1B72FC5912
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ..............................7%....@.....................................O.......h................(..........h................................................ ............... ..H............text....... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%..hz.........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}./...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40088
Entropy (8bit):	5.906587087021585
Encrypted:	false
SSDEEP:	768:apP1lvkeXf5gNwXfhFwePQ2IMSrRujl3lt/4//ODMGJW9I6h/upcy5NNL7X4Wyt1:y1lvkeXf5gBx6NZrPyFkpzDW
MD5:	C397F534761A58A894A13F6801C35034
SHA1:	C8F13E83BC4A31746071D8570013AD540A7EFD36
SHA-256:	51659F1E3EF16A6DBF9D27F43338B13E9B5782EDA35650B8B35C8A47CB9958C0
SHA-512:	5702BB85B6114DF1ADAA3FA9DB997D55543496FE3462C89D0F8F2B24BE6407FA71653BAEC25B5D21E2CC438014E02FC525B00779BD9B52C65D7FEE79D4BF45AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....M..........." ..0..j.............. ........... ....................................@.................................p...O.......h............t...(..........T................................................ ............... ..H............text....h... ...j.................. ..`.rsrc...h............l..............@..@.reloc...............r..............@..B........................H.......P ..\............%..(b.........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}./...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.601207772743215
Encrypted:	false
SSDEEP:	384:LHhB7SAhE3DoWxCnsBlHRN76uBGlD/LVNSR9zu1O:1xFE3DXCsj6LxLVNe9zH
MD5:	ADB64EDDD15EFB86CF9C427AA8AC797A
SHA1:	CC0CE66368E0873A0F7940806D6C2A025FCF73BE
SHA-256:	2F113F90947E08E5CB595A587B5906722B9CE9AECBAA68266F27B49B456D54D2
SHA-512:	C8CC7994E4924D37E6F2F966E99C6EEBD1617A3A8348B8837D8ED1B848809B335B0284528F554D7FDE97279936668B49869346B8223E8604541599963115EF8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../............." ..0..............5... ...@....... ....................................@.................................05..O....@............... ...(...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d5......H.......P ..............,%..h....4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........B.....B...D.B...a.B.....B...-.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................?...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142464
Entropy (8bit):	5.502744629526019
Encrypted:	false
SSDEEP:	3072:+R9MtbGzbtyHZ/I11DKdwWorcP4IVCQrQhubYlmaelG5YUzVTFpFWROTNpWJu7qY:O7qzJOTzsPemorJ
MD5:	D536742BDA0471EC196F696757FC233E
SHA1:	5FC43598EAB40B2E0004B9CB97F4C2D5DCAD22C3
SHA-256:	0C527AD652932C8D83D0A09A507CA9756A2B492F081FF10930359536A7BC3C98
SHA-512:	CC82A0FD1E52EDCA842E75D7AEE7E50EDF7718E2390871DD61509310EBBF348FB2AB85FE588024A0F22914C52815EAD11DCF57B3C51A657728F76C4850342EA0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J............." ..0.................. ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..T............'..p...........................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................t...........\.....\.....\...D.\...a.\.....\...-.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.......................Y.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.771332586368993
Encrypted:	false
SSDEEP:	192:VPuEnS6ejWtiWsPWo0A2j9seHnhWgN7awWQDhG2ZUnQJeX01k9z3AaoJW4nel/:tpnS6ejWtiWYsBlHRN7nG2teR9zboYl/
MD5:	612ED8E107CA34DAAC96942599939870
SHA1:	FB59F3F089EC84E1FD821BA62938EBDE27EDF20F
SHA-256:	478089BD43108ABFB77397E29058280A35ABAD11E861E0018FB79841DBAE29B5
SHA-512:	78BFFFFA555A71B029B249C3CF5778DFE14EB144DA168B3AE348D9A0A1AA1D730F50BF9537DAF9F2CB1BAC961F00F64BD93BADBD175E812D4E6140CA82BB4DF6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............f)... ...@....... ....................................@..................................)..O....@.. ................(...`.......(............................................... ............... ..H............text...l.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................H)......H.......P ..(...........x%......x(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................x...........`.....`.....`...D.`...a.`.....`...-.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.......................].............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359552
Entropy (8bit):	5.33048583134458
Encrypted:	false
SSDEEP:	6144:x933hgdoIdvGHcsw19aJfhHGVrCBFkuP907p4cI:x5kmv9S6
MD5:	88CBE86A7E9E3C4EEA831BEF40EEEE98
SHA1:	56C17A79BCC4DFEDBBC0F26B8069B801DDFE9210
SHA-256:	85B3C153C1A5F62CC2E45BC70D0B8064F7C5AF5F42B03FA542317747BCFF39E1
SHA-512:	49DAFAEA821EB46266F26DB6C518E6926A0B5533932A0AB49D7DF09B6D92238F8C33BCB3377A47221DF66C3D16A4CB9A2BFD43A8C49C545A3DD611C9A0F6DA1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..J...........i... ........... ..............................~.....@..................................i..O....................T...(..........hi............................................... ............... ..H............text....I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H.......P ..`............%..8C...h......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../.......................m...=.......U.....U.....U...D.U...a.U.....U...-.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................R.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.736601492244135
Encrypted:	false
SSDEEP:	192:ohchBZc7E768M+4T8/ctOWdGMWo0A2j9seHnhWgN7aoWrks9gICQX01k9z3AFMLm:DWNw/1WdGSsBlHRN7e/P/R9zVLT5lB4
MD5:	E01967FE0146D7ED3856640ACBEDF875
SHA1:	13E1BD387B8F68406D0A36755139E9093AB9ABE5
SHA-256:	3CC0190C775C7531554FECF47DA8EED553055D8A81098C4D0E6010898A5E71CE
SHA-512:	5879E2DB5F9C35192731FCE253D748B29BAAE2260C89FBCCED24B9B3136CA85E7A748248161D703A958B94C494DFA917D722F2EA62628774145C2150932A9F53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............z-... ...@....... ....................................@.................................(-..O....@...................(...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................\-......H.......P ..............<%..P....,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........F.....F...D.F...a.F.....F...-.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................C...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69784
Entropy (8bit):	5.868748629345917
Encrypted:	false
SSDEEP:	768:XOoOCK7e46Nd0tyOJ1232W1ZzF4M2zt192dlI5QOu7HC3laevvpB4jvPZ9z87F:olj6h2M2R+l85w2laGpBI7zSF
MD5:	F2392FF3F30562841B6A91047C5738AA
SHA1:	9904F2EAEF68473CB84C1FB14B1D57EBE85627D0
SHA-256:	1EDE1C8497B3C6F1AA56546492716EFD83DA9D06CD45540C9C0C1B3533ED3877
SHA-512:	B2E82A09FF59A32743035D3FB45A0094A51673D753E33B098D12E19CC19DB1514C029BB6CE872C0D41AF847010392428922121846266CE7AF8C13A355179155E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ............" ..0.................. ........... .......................@............@.................................0...O.......H................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B................d.......H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.,...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.562439183275511
Encrypted:	false
SSDEEP:	384:aBfSY3abpo4iWSmmmsBlHRN7Qj05seyR9z0VuF2U:OSY3epo45mFjQj05sN9zA2
MD5:	BA1F03064EBD7A307E3625EC8347A9B1
SHA1:	69229F51FDFF73892B7FA593320C80AF0EE4C71F
SHA-256:	211E5A4E388E99743414F4009AF334664A9DBEE02EE918ABCA26BC3DF3B6254E
SHA-512:	5D020358B5D6659A13FA8810D34DEF3A81F762DD9B9CD7199BD2129E9E13FC9AF40144735945C248366A3F5D2D995EA34E3DA7A36FF6B1FDA22D0B98B0BD2B4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k..........." ..0.............f;... ...@....... ....................................@..................................;..O....@...............&...(...`.......:............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................H;......H.......P ..@............%......x:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................3...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.363178374254638
Encrypted:	false
SSDEEP:	384:gZJgYTXXbVQlhooWmdgsBlHRN7gyc/P/R9zV4:XYTXXHMdLjgygPZ9zK
MD5:	0D3BC848915C82679DA736A1C40B19AA
SHA1:	1733C9398419244BF2CDF63EAE87D7C9AB1407DC
SHA-256:	116BAE4B7F9F55BA4DAD5C96B8BFBDEC7495D68EF34BA6155F2F87B285DDD7E7
SHA-512:	1DEA558CE4888078EC6E4A5EE4D4EE29251ECE2FA4898E925B2CDF621CD5D3A13F33EAC828F2063E29D19489A9E1321E95B542E474EAEBB0A12E50CB8FC4177E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%+..........." ..0.. ...........>... ...@....... ....................................@..................................>..O....@...............*...(...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................@...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.705957529549755
Encrypted:	false
SSDEEP:	384:/KLMkWbW/oKsBlHRN7EDIynj05seyR9z0Vue0Bqt:Gfo5jEDrnj05sN9zAeBO
MD5:	DF5A985AF93F01AEAA49D69A8134B011
SHA1:	8903B478B4220B760D3360D8154A399EFFF6A0BE
SHA-256:	4B81D2E358424CF67507E0DF17DEA3307890C7279608DFCEE76D282EE6B7507C
SHA-512:	1B0C387B677C4D182F534AF1FA8954BFB4D74A469543C3697D53B126739B6A51541A2AB064C2804E54421AE737B8691BB09F05BA60E9D294E78664F0EA0DCDC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...vN1..........." ..0.............F(... ...@....... ..............................z.....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................((......H.......P ..H............%......X'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................5...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.467007216176513
Encrypted:	false
SSDEEP:	384:l0ghAbNWcbfasBlHRN7XTN4tgR9zJNwYI:fhibfpjXTNx9zk
MD5:	D97CBB8F98056EBF726F7240F950D45C
SHA1:	21FE296E08A4DA6B6711DFDBD8BC852DF670AE44
SHA-256:	60BD536E8E3D58807EF68DBE0A14183C5F2E8E856DB645AC43C9B8E9D035F4D8
SHA-512:	1B31C20375914C8E596E1D097E86F914BD41CCED8BFDEAB2CF06B2EB292DA0D3A626E6787910E78A9EBF18630C89915FF8FAEECD2533827E236FE61308D58F34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............4... ...@....... ...............................A....@.................................h4..O....@..x............ ...(...`......L4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%..@....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................2...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90776
Entropy (8bit):	5.621713181956353
Encrypted:	false
SSDEEP:	1536:tD1Vph3cu8ZPoAg8EExNWAJo/m9X3M1AmGwCxMqsdaNk84SKCq2aax8ISzY:tNh3cu8ZuOLo/m60aaYk
MD5:	03E9B957F723241D7626AD6FF94D4B9C
SHA1:	4DA4E09B25B65D58D150E275A68281FD53D5E49A
SHA-256:	7373EC1E3BA9E9D7EC1A3A8F42C8C3D6498260AE8B43DB7D84D4F375881121DA
SHA-512:	707248C809607CEBEE1F746D4BFD669EE353BEB06B84F79731B95C21A052D235C8CE98C61F89DB45AC08874ECB5925B2554E4C43363BC0581B6CB84458103886
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$H..........." ..0..0...........N... ...`....... ....................................@.................................XN..O....`..H............:...(..........<N............................................... ............... ..H............text........ ...0.................. ..`.rsrc...H....`.......2..............@..@.reloc...............8..............@..B.................N......H.......P ..$...........t%..H(...M......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.,...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pl\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.756551158053722
Encrypted:	false
SSDEEP:	384:6L8NLiRWF0OzW+1CzsBlHRN7v/P/R9zV2:G8xioF0Od1Pj3PZ9z8
MD5:	34D3E4BF2ED7D7AE853E52983F887C89
SHA1:	CED0749E356720CAB0FCA934DA890F18570AE03C
SHA-256:	397EEBD1484AA52447742278BED802A865E32529461E380995742F1FE706C7E4
SHA-512:	CED5876C70EAD7D716500A6D86800BB9A10D0F5788D9E8816871329DC7E3567BB6BCD92C42DBCEAB83D023E31393B37C1D5C098FB7193E646E449F74A71DC6A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i]j..........." ..0.............R+... ...@....... ....................................@..................................+..O....@...................(...`...................................................... ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................4+......H.......P ..T............%......d......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...D.;...a.;.....;...-.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................8...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.321914218733697
Encrypted:	false
SSDEEP:	384:valXSXRaRmIDXdXxahKOQu7l2135hwdVjFvoaWYHAhQ5WNsBlHRN7C/P/R9zViC:vaCIcK9zBuG+jmPZ9zMC
MD5:	0E4F878167D8316DE563C1D43E8D1823
SHA1:	DA71147AF5FDD56BEDEC51B67C3B246F586D9640
SHA-256:	1BB66DA24AD29C53B5F0BC4C994A9760FD1C9159F9D471A5214380EFE141F399
SHA-512:	AF1D747109C268519B68AB81662AF2FB9905B12AF57E2AB9EC190F5E7E9A2AEFE0FCC18B5160D74D138081B3224A7CD3CBD0567B19001FE6416607655E4AF922
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f..........." ..0..2...........P... ...`....... ....................................@.................................lP..O....`...............<...(..........PP............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..0............&..P)...O......................................BSJB............v4.0.30319......l...\...#~..........#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................5.......................w...u......._....._....._...J._...g._....._...3._.................q.....q.....q...).q...1.q...9.q...A.q...I.q...Q.q...Y.q.......................#.....+.....3.@...;.a...C.t...K.....S.@...................O...............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109696
Entropy (8bit):	5.4082284471688284
Encrypted:	false
SSDEEP:	3072:i1ivAS9EpFuRDtBqutDMcZkWOW/nmHPCSTTH2gAICO:i1ioS98FuRDtBqutD1ZkWxxgV
MD5:	274E0C86B123DD3B9A610C805086E11C
SHA1:	3C4C68AF6BDB01F9B3C6FFD1BE54C0666F7A9E3D
SHA-256:	2F02C160E33E8318B6BDB3CBA0263A68CF158784907AC72A64AA85F89B78EEB3
SHA-512:	34973C59D6D1B6E6D54D1E72E88E159D94C7DB7EDDEE91170BE377ADA6836AA3630277548BA775386D28A3B1D3D4988838A87BBBFAF574ADB3CB041D1359F4A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|............" ..0..z..........".... ........... ....................................@....................................O.......x................(........................................................... ............... ..H............text...(y... ...z.................. ..`.rsrc...x............\|..............@..@.reloc..............................@..B........................H.......P ..<............%...r..4.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................b.....b.....O...........7.....7...J.7...g.7.....7...3.7.................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	202904
Entropy (8bit):	5.277130637141356
Encrypted:	false
SSDEEP:	3072:gZgxPDDCjk3SIqF4S1C7gHXKqai4mqw1yvlzCm8Cxx/1P5qGoaYMu5R4T/Ib0Upa:gj6qai4mqw1yxc8/1PoH2wb7+yM
MD5:	C7CE0DA0CF33EB44F62C876E6762613A
SHA1:	67466009755202E3302B30A84BAA60C3C3A719DC
SHA-256:	D851B71804745423FE6246538EF4FC43F43A51E739E04D1B365D5C3B937E97AD
SHA-512:	46593D072FAB583E420E423EE6A1C0598C63975348E7998B00AB88EB318F2A37C6AB2BF61F6CE0D670C694CD0482157BC3E99E8B594ED0B240BAD291D7863525
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`.......M....@.................................l...O.... ...................(...@......P................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..P............%..0...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................g.....g.....T...........<.....<...J.<...g.<.....<...3.<.................N.....N.....N...).N...1.N...9.N...A.N...I.N...Q.N.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45720
Entropy (8bit):	5.668797278834332
Encrypted:	false
SSDEEP:	768:mOQxugWQGm2q+z4tVdWIG8KFH9+gURCeKMY2smVt/ZrfVUX/l6PSlo3w6yhj1VPV:FQxugWMPdWIG8KFH9+/RCeKMY2smVNZy
MD5:	41C84C08A2E39C4588B465078FAF8C20
SHA1:	DBE9D1F43F5F286225EBBCD2091DDEAF3176FD1C
SHA-256:	B95C1C35084D3EB029F6BE998F47D96ED4AF9A30E782EFD3E09234BB9110B980
SHA-512:	07DB94F7722D17D6228734E3DFE65959E52722FF2BFFFC57F96F9DF9840B21CA492C6F02962637FD1619A6C84651684AA6647F5D69D7BA366BF6BE11DBBBD317
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[X$..........." ..0.................. ........... ..............................E.....@.....................................O.......h................(........................................................... ............... ..H............text....~... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B.......................H.......P ..8............%...x..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...J.5...g.5.....5...3.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39064
Entropy (8bit):	5.806256842173525
Encrypted:	false
SSDEEP:	768:CVT8SL4emhmZ0eEfYVuPe2ZZj1UkjeBentRDNO0ZGlbcKtAh2kmSMabAOpT0lib7:Ch8SL4emhmZXaQ85y4hQyvzP
MD5:	4B9F11A30E9B41C298B7AA8A10083B2A
SHA1:	A360AB235C9969B2329EB5A981713C72C5D05FAB
SHA-256:	1A54AB5EC1D401077D214F4A0959485C8213B4B31ED28561F4F2F1FC6BE4492A
SHA-512:	F7FCBA5F38B45DE50AEFCB10C9A530A5A7BC752DF83E14D48958CE10028429402F8E46CDE6A609F9A75CD012053AC48E989714F8551CFCA8F01371478DC652B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5B..........." ..0..f............... ........... ...................................@....................................O.......h............p...(........................................................... ............... ..H............text... d... ...f.................. ..`.rsrc...h............h..............@..@.reloc...............n..............@..B........................H.......P ..d............%..x]..,.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...J.5...g.5.....5...3.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.557374089729578
Encrypted:	false
SSDEEP:	384:qhiFZLWzoWxCjsBlHRN7MGlD/LVNSR9zuRxS:GomXCojzxLVNe9zEQ
MD5:	D1D6202C3D1AD5C5B8CFFB7519F74219
SHA1:	2A2F95901EAEF078C34E1C672A6E39D3F852F5F0
SHA-256:	11B6F8E7C46891FC1248926B70044E007CCEE06EAEA795C86F316779D38C7AE1
SHA-512:	5868283D5A53513A40BB814CDE54ACEDDCD6CDEF83860C74332824335FF79F0A9F4DCC7283417268341E4E40F0B20908580BE7E7C5618B80A84472FB3C1808EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............." ..0..............5... ...@....... ..............................]n....@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............4%......,4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................p.....p.....]...........E.....E...J.E...g.E.....E...3.E.................W.....W.....W...).W...1.W...9.W...A.W...I.W...Q.W......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141952
Entropy (8bit):	5.459604499720831
Encrypted:	false
SSDEEP:	3072:IR9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yI7Ixf9GLqBdasIVDBvQBasuauRUyh:tuRn+T6uDNeP6u
MD5:	4B310396ED0A54286628BB0E451EE7DC
SHA1:	25DBFFA6A2F00C83D0C32CC034B83D2A6C61C628
SHA-256:	8DCACF04CA102E619372D7BC3E4810AC3A7F4734853117304EFC76FB5ABA1832
SHA-512:	1BB25B5C799A9216A4512998B9F75B0A362E7AC6F23AC701D8C53B5BAE492F6BE455E9E6B3DA201CBE5BA156D4E732B47E30E9A6ACAD2CA75B1D76E5E3716168
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../..........." ..0.................. ... ....... .......................`............@.................................T...O.... ...................(...@......8................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..p............'..............................................BSJB............v4.0.30319......l.......#~..........#Strings............#US. .......#GUID...0...@...#Blob......................3......................................5.......................w..........._....._....._...J._...g._....._...3._.................q.....q.....q...).q...1.q...9.q...A.q...I.q...Q.q...Y.q......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.767348586993338
Encrypted:	false
SSDEEP:	384:64CAZWtiWgsBlHRN7IuGLMB+6R9zctF/nf:6JAgfjwos29zQf
MD5:	278741FD3DF7017F7A9AAA60DA62782A
SHA1:	8E8A1E832D29CFA5F2E14BEC50546648E98FDB59
SHA-256:	FB3C67C2138D9F1A92A6AE5300058A2CC07845579964D67EF621121BC2880D4B
SHA-512:	A00FC76E25C3548372A33A9917B0AE318F3C167D402AF8D2EC872D67EFAE3702D2A4696219C788E36E5090C2980DAFC126010AABF0E15C1670C83BE1749A39C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............b)... ...@....... ..............................b.....@..................................)..O....@.. ................(...`.......(............................................... ............... ..H............text...h.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................D)......H.......P ..,...........\|%......t(......................................BSJB............v4.0.30319......l...D...#~......$...#Strings............#US.........#GUID.......D...#Blob......................3......................................5.......................{...........c.....c.....c...J.c...g.c.....c...3.c.................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352384
Entropy (8bit):	5.127191319896
Encrypted:	false
SSDEEP:	6144:q93vdvcjoee/CtKvAzrRKa44OMI9nLdSg0NSf/rav:qldai7nW
MD5:	6CFA4F0F6EF81869AF4DB81CB6A81190
SHA1:	1AE3C123B92AD215DD73F84E73EFBBCE71E7FD2B
SHA-256:	31E7E18EF01FE3344F4699D82FE2A584BFFF974F0A58A1B7870ADBD6840F8527
SHA-512:	C1693C1F814AE6E25968CA055B92B6AD4E75A060EFBCCE5EE684E53C936B20BE70661738ABDAB84DA5AD9FD47455BD77299F08E5534475F3ED444A44A84AD6B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?p..........." ..0..............M... ...`....... ....................................@..................................M..O....`...............8...(...........M............................................... ............... ..H............text........ ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H.......P ..l............%..P'...M......................................BSJB............v4.0.30319......l...\...#~......X...#Strings.... .......#US.$.......#GUID...4...8...#Blob......................3......................................5.......................p...I.......X.....X.....X...J.X...g.X.....X...3.X.................j.....j.....j...).j...1.j...9.j...A.j...I.j...Q.j...Y.j......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.....................*...............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.675456431485256
Encrypted:	false
SSDEEP:	384:3+4TUWdGfsBlHRN7FsNTN4tgR9zJND6GF:nGUjSNTNx9z1
MD5:	01C1026A3F256A617A924237ECB28A49
SHA1:	07E8045272649FFA6730C4CE65B5EB3D5CCA7C32
SHA-256:	7F2810880C24E5C05CE6E25D107101DC91909932AF2FCD8C34BA3ED1B0BBCFA1
SHA-512:	75511901CFF9BA432DFFF42161A56EEDCE1AD28161DB4C42C121D7754FF9FE408D2805F5EB1A62E956600D8A57D5C37C4DADDD72AA9686694B0348F2D75C1F14
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yM0..........." ..0..............-... ...@....... ....................................@..................................,..O....@...................(...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............D%.......,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................t.....t.....a...........I.....I...J.I...g.I.....I...3.I.................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65664
Entropy (8bit):	5.690216890927441
Encrypted:	false
SSDEEP:	768:BoOCK7e4k+HYdRWsswJ9JgAIN0gF9ikuHy+jB5jDhxLVNe9zO:jljk+jJF9kyuBpDhnNazO
MD5:	5DD29B6E1A98B451203EC79CC4AB854A
SHA1:	FD3E197303CEB7338621E644079A64E2CE77950A
SHA-256:	F9A085CEC846647B845F9E401D5C9A8193ED39A9C77538C58C65CFE607D92181
SHA-512:	2CFF5707825A0AA36D86EAB3FAFD1584070F1A4847D3610DB095A29B10D06984678AEC956F9E1C67F216038EA50AA8B6378629D37930BE101C7C0605228952E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............z.... ........... .......................@.......;....@.................................(...O.......H................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B................\.......H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...J.2...g.2.....2...3.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................................................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.478831423526027
Encrypted:	false
SSDEEP:	384:E6ifH3353XfsVgNWSmmnsBlHRN7H/P/R9zVlWv:E6wH33JkVRmsjfPZ9znWv
MD5:	7DEBB6C2EC1A75AB8A224B5E9A46AE4B
SHA1:	1DD21C14D0D63F7D890A44AD69E061D1B1A5698D
SHA-256:	FC2CE99D1946F2FDAA7CD013B482AC4C34C6204A9E0C6206BC4C27A87E439315
SHA-512:	9F3DFB1A03406A05D14B4E0123E22704436E76121F624605D27D26155011F9327FAE4C59B700E3DD64AE362E06DD3485C4D86A4FF3B96D7275A63EA0641228B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-............." ..0..............:... ...@....... ....................................@.................................D:..O....@...............&...(...`......(:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................x:......H.......P ..H............%.......9......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...J.9...g.9.....9...3.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.327303841535854
Encrypted:	false
SSDEEP:	384:5X8tNC13aoWmd0sBlHRN756H/P/R9zVVy:J8tNC1KMdPj56fPZ9zPy
MD5:	C46DB3108E5356F0E920637550D5EA22
SHA1:	EEE168B4BA15FFCEE0268BE0B60E5183656E489E
SHA-256:	E8438C4AC163522E519A6CC43871D081B0A297C85A8551726833637CC604E45A
SHA-512:	36AFA4919FC40958E2DD216BD80515827B70E15EFA6075BC4ED64D0FC80AFBF308A1DC0AA1680C8B2C0ED8516501031DEFFC1ECC145589369E5524C86DD7F3FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M..........." ..0.. ...........>... ...@....... ...............................+....@.................................0>..O....@...............*...(...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................d>......H.......P ..............<%..X....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........F.....F...J.F...g.F.....F...3.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.698098726735165
Encrypted:	false
SSDEEP:	192:RAk3+M3EWk3cW/oCWo0A2j9seHnhWgN7akWNWuks9gICQX01k9z3AFM43h:OOJEDsW/oIsBlHRN7g/P/R9zVmh
MD5:	75AC3C9790193FE9601189650DEC9A25
SHA1:	1C9A2BE7252B07FB3D2B05294224BD575D8C7AB2
SHA-256:	CA4028725AE07ADE0E10B36E5A56978C0D61DE7F30E95D86A67FDF0D7FA704E2
SHA-512:	5E9049692406E09368DE15DD6DB6FEDDFC55C0DF1440146F127100228068CEFBE680A0EA001BE7E6E633D6B9C0129FAAE12BC9A51B02E5830F04D93704E77BE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4............" ..0............."(... ...@....... ..............................q.....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L............%......4'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...J.;...g.;.....;...3.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.4682272441477116
Encrypted:	false
SSDEEP:	384:c1X/9tOYWcb0sBlHRN7R+oTN4tgR9zJNvEn:K/7bbPjPTNx9zo
MD5:	8EE3A2E0BE5D93FAEABC1E296965E04A
SHA1:	C41D1E82D1C29F21F41ACDDCF5AA988DC74B110A
SHA-256:	016A28DD1260DE7DAA14D81016B03923F5162586047F152A678BFF47E93DAAE7
SHA-512:	E6D79EE1AF041BA55B792A92E43992B26ADA5E248F2B6A36B31297653204D5287270F91E63213CA103AF192B987746C1B36354F94E54F8C4D1452D93CCD7C287
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'............" ..0..............4... ...@....... ....................................@..................................4..O....@..x............ ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..@............%..p....4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...J.8...g.8.....8...3.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89240
Entropy (8bit):	5.471443499776381
Encrypted:	false
SSDEEP:	1536:CD1bd14KdfmhBTgbQjWILvmVeQdxwVJpzGL:C94KdfmhBkYIsa
MD5:	7EFB1EC4D4D9B008740E66AF9FD3781B
SHA1:	46BEBBAAEE20B0E13DE9FC92068A0F599D95D15C
SHA-256:	36AB9D66BF6916F78A88AE013EF8800B074407AC6B2D5ECFA287457BA5AB79C5
SHA-512:	444152AB0D1F81A1B390D0C18DBB94831A776A789CD45C5199D1FBEAAAA8508EA42DAFD9980DA14C43957EEC3E599143379BA6CBF0A8C42D73061AF0226763B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............I... ...`....... ....................................@..................................I..O....`..H............4...(..........tI............................................... ............... ..H............text....)... ..................... ..`.rsrc...H....`.......,..............@..@.reloc...............2..............@..B.................I......H.......P ..,...........\|%..x#...H......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...J.2...g.2.....2...3.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................................................}.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\pt-BR\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.719139108697208
Encrypted:	false
SSDEEP:	384:CL4OLAwWGXW+1YsBlHRN79h/P/R9zVEfD:+4KA9GR1TjLPZ9zefD
MD5:	B85E4069EBFCD190211E0AB9595F06C5
SHA1:	C907531A811CEBF9BA130D575E857451A552B892
SHA-256:	5C7EFE95C87356C30AB3F48D56C5A27C041B9F624E9C6924112080DD0152017C
SHA-512:	53DFE064197A1F202FC1E5B3CC2E6AC8B93B2E9A838C62467F06B781F5208110BD81901B219C8A1362E091859A50DE66EDFFA96E13F5559F010BD4A39C69086A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]n-..........." ..0................. ...@....... ....................................@....................................O....@...................(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\............%..X....*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................i.....i.....V...........>.....>...J.>...g.>.....>...3.>.................P.....P.....P...).P...1.P...9.P...A.P...I.P...Q.P.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26752
Entropy (8bit):	6.454592793814387
Encrypted:	false
SSDEEP:	384:hyRXvXSXRaROgMCXdXxaur1Qu7xd2Vmuh1C7f0ZWBxzzoaWYHAhQ5W4sBlHRN7hQ:hyRXsgrrOtZ1kf0SZEDjhG2tC9zx4Q
MD5:	4B16EC2AC74BF4C4E270FD2D1DE71D28
SHA1:	7D368142BCEA22B32C94FD4F186942D713F7C502
SHA-256:	60520F9780515C294312EC686DDECB94A5B9634309B9BC854E381B8FE3B9D31F
SHA-512:	81BC6C8EBBAE0F3A2CFCE409D768103D4410200ED072B1FDAFBA8571E94FE08CE35F06455BE0D2BF6A9A620A7F81790EC2BFAA7042A2E96EDA5AE08B2ED81975
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{Ee..........." ..0..6..........*U... ...`....... ....................................@..................................T..O....`...............@...(...........T............................................... ............... ..H............text...05... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B.................U......H.......P ..$...........t&...-..<T......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@.....................u.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138392
Entropy (8bit):	5.5429353604294045
Encrypted:	false
SSDEEP:	3072:N1iM7DcD1Bi6shPHbyZHOS3cigkfxiHXA3YGFOrrJ+4+2MEm2GahiKzEsLqjYL8t:N1iqDchBi6shPHbyZuS3cigkfxiHXA33
MD5:	369A66D1833D96FAB233473AB9F5CA81
SHA1:	8CA9A03785B560C015FF2F3203B140036A84BF3C
SHA-256:	1E64B76B2D840BB523452F94BA88C3CD7E6CCDEBCD1195306BEEDC78C669E99A
SHA-512:	AE465687D5AF2FCDAB21A8D0E3E7626A8A6A22E8EEA04C5809C3227EF601F994A115E81F8B886E25D8ECA3A5F77A00E843C774717F2B09C087F8DFA29D1EE4A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L..........." ..0.................. ... ....... .......................`......~.....@.....................................O.... ..x................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B........................H.......P ..8............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	258176
Entropy (8bit):	5.4274880007099116
Encrypted:	false
SSDEEP:	6144:0nTvesBk9o3HsV1EoQnI7mezPxn3AxnTLhycfzemusLsOhBJUkr9GSw3p:013a7mezPxn3AxnTLhycf6musLsOhBi1
MD5:	61BDE6042647FCE9DB7A714AB0FD9EAE
SHA1:	4001016B935C1773C7E9A9E27C98AD51D1602D93
SHA-256:	941E4D7C31D093C3E8122540A53E3B6DAF59A7E964AE343DFED019A45AD0530D
SHA-512:	A25CD02C6A8EAA4E73571E1E91DFC1BA4A7164EECA940A93A61BD9917769161179C754D786348A4B7E941EBD0A067040088D4FD6DE0E722F914489E9886C2C30
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................... .......Q....@.................................H...O........................(..........,................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................\|.......H.......P ..L............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54424
Entropy (8bit):	5.805570809282405
Encrypted:	false
SSDEEP:	1536:bYWNABq2zPkpp60MTBI9qHmYlTEd4po10sFyRnoDMg6Cy8jpzu:gpEd4po10sFyRoDMg6CbS
MD5:	CE23BB852D845F038ACA0FE732BA21F5
SHA1:	FB1E0C927B2D6AAB4E4700428D051E36472605EE
SHA-256:	01162A81F4494D2588571F06F7482E35FC7FD14017CAAE94F850C21AEE1D6A77
SHA-512:	0764EA9E59E6901E4DE6FFB3EE43689A322053C28F46B7493C06447C44D6EADBB0FB7086E3AE5AA2BCA63EFB9B383EFFEB35ADD6167B6A8840BED6AED053013F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ............@.....................................O.......h................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H.......P ..0............%......(.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44160
Entropy (8bit):	5.99942778546928
Encrypted:	false
SSDEEP:	768:m/4Zo9be9NhkmnytF61PN2bi3rEHjUGPTtL+BOwbym6KY05CGlshBVaFk9ytYlya:xZo9be9NhkkG05CGlrtyyl9nNazF
MD5:	2DF476E387281692C2CC4CCB51B9B92C
SHA1:	7B902366C3ED95FC6B24A17CC0C2F4280CE95750
SHA-256:	99D7A201487BC0ACEC080F29DBBCBAEE926D22154F7D30A0EB446EEAE0A97398
SHA-512:	CA361CE8A99D42B2099748938C938350024057240B36C2EC1AB804A359E01EFC864E1E1A256CA4E45F787B16C4CEBA1132A584A0D4DDA52BCCE4A3BDB5502269
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9i..........." ..0..z............... ........... ....................................@.....................................O.......h................(........................................................... ............... ..H............text....z... ...z.................. ..`.rsrc...h............\|..............@..@.reloc..............................@..B.......................H.......P ..\............%..`s..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.58568846399066
Encrypted:	false
SSDEEP:	384:fhZ7juoWxCHsBlHRN7ouyLj05seyR9z0Vu5:JZ/uXCMjILj05sN9zA0
MD5:	2EE20350E281394D1FA95CB087F3CFFB
SHA1:	8CE8B80222D89C95B6F2B7BFA1F013F43517ADB3
SHA-256:	498DA3783DAA4D83D7ABC6D466F160ABE0D6C810939C3A74AD652FF4FD25265D
SHA-512:	9BF9345A6EC5FE0E63F7D6A57720F8211DE54881C824E450FD727620649AD3B49237B58057E3023C0455E2FA6A85ABA6042FAC7A43C7C69A9447F5DAF848AFBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9..........." ..0............."8... ...@....... ............................../.....@..................................7..O....@...............$...(...`.......7............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......P ..............,%......47......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154752
Entropy (8bit):	5.723967301651295
Encrypted:	false
SSDEEP:	3072:gXR9MtbGzbtyHZ/I11DKdwWorcP4IVCKZuXsI7Ixfzw10DAH9Os5pk74V/eaiHEQ:gniHEPsV5s3eL/kITQ0VJ
MD5:	82032FCEBD78321C06D4E407C3C5589F
SHA1:	AA731D688AB47FE4FA93D5E15EE06738215BF803
SHA-256:	E4E4DDBE33F445252CCCBFDDF7B209B144CF3975240E31F207816D7FC6C062F7
SHA-512:	802216CB83149220423DE89FF9415B31352F1E83C16807569A9C4CD07ACCC8A2F1BC4E247405C319C38E21866F785D82DD50349735B7E1847D30D2EC451BCCB5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w5<..........." ..0.............I... ...`....... ..............................b.....@..................................H..O....`...............4...(...........H............................................... ............... ..H............text... )... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ..T............'... ..,H......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.729085766953443
Encrypted:	false
SSDEEP:	192:PsW0xosXWtiWsIXWo0A2j9seHnhWgN7a8WF0ieFJVOYOg8nK4X01k9z3AvGWPj2:j7WWtiWhsBlHRN73ieTVOY/wR9zQZPS
MD5:	CBD294C9E5120282199C9C1B23567A7C
SHA1:	C3FE0A9D73789BCFD7EB5A6C9AC522DEF2E1D1EF
SHA-256:	C07152ADC14302CABD42A8B871C6F39E32C976E0CA9D26A4F7C3B47B953098EC
SHA-512:	3D6EA6E2B04511F6B72D2589DE6C40F58C9F3C865D92F180C1DB0B6B617745122C68925BFA9E03AAF7F6C711B34A8B521EADC08284ACDCEE7571ADE0D06BE2E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............6... ...@....... ....................................@..................................)..O....@.. ................(...`.......)............................................... ............... ..H............text...<.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P ..(...........x%......H)......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	468096
Entropy (8bit):	5.280591057134724
Encrypted:	false
SSDEEP:	12288:7GgyXknvKkSxNaBuh5QHSYxIrAAr2r6C1YaTqiD1xUHc1N1lvTx1Rp0KrjtIZ9Ut:syJ
MD5:	9164D03D7AD857B14DED42EE00EA200A
SHA1:	EAC0C253C191987A04C07E8F3C1AB4D31DF1D2ED
SHA-256:	EF152AFBDE1C0515C5F1D4218E385E8761616977366EA3A40B3D17E70AF8ED99
SHA-512:	020B6B96A5F7EBE3ADEE02481BAF36997239638402FF4E545541FDF4181A0161C7059A5142896678446E0573A24C5E02D1D9EF83CA02A86F720592D1411835E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!............" ..0.................. ... ....... .......................`......f.....@.................................t...O.... ...................(...@......X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..`............%..(...........................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................I.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17024
Entropy (8bit):	6.7636267745319225
Encrypted:	false
SSDEEP:	384:d1YVZHon3DWdGFsBlHRN7HXjGlD/LVNSR9zua:eZHon3uG2jCxLVNe9z9
MD5:	14ACE53D2D8DCBCC0FFB6449A0E20237
SHA1:	C699EE5E924A43F704675D98B7793387CD59B3AE
SHA-256:	6E7AB287EECFC4AFEFB2E6E5B74D91C63CB96E4451E1CFDAAB4A67D6FE9807D0
SHA-512:	8EE4CBE82915F17CD11350699BF596711730431F56E5F5463A7DA0E20A86039D17BDCE9E406B35784EB06EB660C9DD651BF6F7138A73496C9017191CC0D66E02
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............." ..0.............B/... ...@....... ...................................@.....................................O....@...................(...`....................................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$/......H.......P ..............<%......T.......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85144
Entropy (8bit):	5.6870454715132555
Encrypted:	false
SSDEEP:	1536:Ulj3kzOilWWWuJlcqGiUQGgMhEoaqcvBqeQyvzA:Ulj3kzOilWWWueqGiU5gMhDaqcvVQyvs
MD5:	5252DD56382441C4A8E5E3058BD80552
SHA1:	ACCE5C7D417914330C9BC113C0E1141A3206A8AB
SHA-256:	08AAE2F6B7D6A8276094AFAF9B5F67418D6B22EADB1EF1911636C44A26F4BF4F
SHA-512:	3F74ACDFD1BA5A16C07A5F31F3CBE022F66D2D0ADD676675CB950877C49179EC31D35990F9B8E337366EBF1ADD640FB8C26782A81304BC2B3D55DCCD01ED75A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<............" ..0..............8... ...@....... ..............................;.....@.................................@8..O....@..H............$...(...`......$8............................................... ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......."..............@..B................t8......H.......P ...............$.......7......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21632
Entropy (8bit):	6.556283410829501
Encrypted:	false
SSDEEP:	384:Xb5flg32hKPy2d/WSmmXsBlHRN756nVOY/wR9zQL:Xbxlg38Kym8jQ/M9zy
MD5:	51B8FFAB00E3283B5E76FE1BEBE60D34
SHA1:	F8641E9A49FCBBE70D5605A9130ED0B3260B9C1E
SHA-256:	FBFA086831D614BEB0C11A8FD695D38608352B053C359639CD8B53E2B8EFB9A4
SHA-512:	58EC0FE07961506930D2423D03AB5F0D0A4DEEB96DAE4EA7107EBA16A6F4B62BAEB449A1865EBB50DA99ECCEF68831525F640AC3BDE38FC8EE4CF480D8EB08CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7............" ..0.."..........F@... ...`....... ....................................@..................................?..O....`...............,...(...........?............................................... ............... ..H............text...L ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............*..............@..B................(@......H.......P ..@............%......X?......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.....................~.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22168
Entropy (8bit):	6.477003864515189
Encrypted:	false
SSDEEP:	384:xnvQOSFJ5KagEoWmdmsBlHRN7E/P/R9zV9al:VaFJkagEMdFj4PZ9zPs
MD5:	B6B7B59FCD9F741ED3D6971CEAF9ED79
SHA1:	0DCFC769633C1D9D6A67F390E44023E8410F8874
SHA-256:	4188657F3E6848DED584B9ED5617248A33384DF93EA28F1D58DA9B9EF8A54DC8
SHA-512:	A51C5817AA5BB8AA4A8DC5CA401685D2467782C834FC7081AA2AA7D349D52A80767AE8B0DDE01F7BCFFE568811783CA073499A193D2DCC15770C38FCA69B9AA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..$...........C... ...`....... ....................................@.................................@C..O....`...................(..........$C............................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................tC......H.......P ..............4%..p....B......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.7278435342179135
Encrypted:	false
SSDEEP:	192:0Y3Z3rQaWuh2ZW/oZWo0A2j9seHnhWgN7awWiOGmhG2ZUnQJeX01k9z3AaoA6JMA:7lhn2ZW/oXsBlHRN74G2teR9zboHJZ
MD5:	EFBB4960CD0833767475B51636A6FA3F
SHA1:	26F43A29CB8ED07FFBFADBA18BD2BC21A58D6742
SHA-256:	16AFEFDD161714A1CCA64B83A1E377C32F7944CEAB3F1F614F7AEE0DD82779E1
SHA-512:	5D5BE07D052DCBAD1F4066BA2E7F26377D58E116BD0C10E3430C06415D1DE4B648E20D96B1877136ED1B048F055B39C396DB35BEDCA5CDEF29304C11C676DB1A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n(... ...@....... ....................................@..................................(..O....@...................(...`.......(............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P(......H.......P ..H............%.......'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19072
Entropy (8bit):	6.518175391800451
Encrypted:	false
SSDEEP:	384:yNRYAZ6k8Wcb3sBlHRN73UCGlD/LVNSR9zuQy:yY4ybcj3gxLVNe9zM
MD5:	89AF3162D40A1912767E0AA82DD8F9A9
SHA1:	00A4066C1B759A6B91F7C483168E185E99C5C2EE
SHA-256:	55A5292DC08AA33E1DD39ACB65796748C55589046C8D4EE7D2DC3625D5EFCA57
SHA-512:	0C3071CC0BB8EFADBD24C6FA0F0E1D66C7F0644E6F613BEF060A30BE21042F42CB81FBD6AC6D0F5F4C1869232C2321CA115B99F50D846A861BCA3B723E753295
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...qc............" ..0..............6... ...@....... ....................................@.................................06..O....@..x............"...(...`.......6............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`....... ..............@..B................d6......H.......P ..<............%.......5......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	112280
Entropy (8bit):	5.540028153105875
Encrypted:	false
SSDEEP:	3072:GMMX49qK0cpSNKWwIdNAjfWIbLt+Zrv96kdohw8+4Yg:YXEpSNKWwIbqfWIbLI9VtdY+U
MD5:	FAC31F9F6360C958782634D3AE9CD22F
SHA1:	DD7477D3C3CB89C7F3BCA56AD44611F43955AA3B
SHA-256:	92D69F3BE175619865D544A8B2BEDD21E03B6B37F6456FAB866D479B456A47FD
SHA-512:	DAD36E6E0E02DF79F4738E120186DBECDC286099493F1FC008486C4DB3AFFE19E1212C275BC275F7F09A68DE627259CA166378D8DB70B4D475E941904EC344CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.....................................O.......H................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B.......................H.......P ..$...........t%...{..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\ru\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.78143279980055
Encrypted:	false
SSDEEP:	384:aK/LFLHkVWjq9W+1h5sBlHRN7GiGlD/LVNSR9zuLP:lZHksjW1hqjKxLVNe9zsP
MD5:	92C3BAFA93371F416E4870EC3CECF432
SHA1:	19ACBCFEA3A7692AC3BFB54FF063B0E0E0D59648
SHA-256:	8FAD94475E25DBB6FC181F0E7984D4EFE98F3CC3DE3214DFA9E2681DA6C8BC78
SHA-512:	75106DCBB84DD8D86B41F8BB986DA8F9C7930C12B3691F1FFA0B9949AF0F30222CEEC12E8B35388220B0DD96C576C1C759B133B3E7D7714F07BD4A1227EB4CFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ix/..........." ..0..............,... ...@....... ...............................+....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..T............%..h....,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25240
Entropy (8bit):	6.395533122807165
Encrypted:	false
SSDEEP:	384:PyVGXSXRaRmIaXdXxaR04Qujyv2Xjmhk/4N+oaWYHAhQ5WgsBlHRN75h/P/R9zVf:PyVTI70XMKLbj5hPZ9z+0
MD5:	22508E52A7788DAEA1DE9A9976061594
SHA1:	46D1AB070A67A9B3BB96664C4317AA3EFF6DA232
SHA-256:	E927DCA196B45BD6EE2A9B7043F6154399F72704CE3875F14D8243C451D9A08D
SHA-512:	1CBCD677A2DF2E466F08ADC631001ABF1857A5A15F89638A3C69B51E5BDCC92BB7014A622CD5A6808E23FA85C861C20F8A6F826EBF54CC403E973831D2F8F678
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..0...........O... ...`....... ..............................b.....@..................................O..O....`...............:...(..........tO............................................... ............... ..H............text..../... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................O......H.......P ..$...........t&...(...N......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@...................C.q.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	107672
Entropy (8bit):	5.51715568358606
Encrypted:	false
SSDEEP:	3072:v1i3SOpG7YTwPgVtnwt2bFRe8XdmM7CKwoKJyDnw:v1iCOp4YTwPgVtnwt2breCp7rwkw
MD5:	ED2104F9A285195B4AA356FDC09AF835
SHA1:	C9C70B9C55A9EC1ABC8117B9C41F5FFBDA0CDD8E
SHA-256:	0418EE16B62ABE7C186BCCFE4DB9F15D55457D17320FC4AA63A077328D28E980
SHA-512:	4B884B6131E3D6AB5947481E418F58CF14BF9F70BBC68DE33CCBEF5ED6307D054FF2D2A5DEB83FBC4CB5FACE1A49D88EAA815C7AAB3F0656E3A770F3026852FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-N............" ..0..r............... ........... ..............................M.....@.................................\...O.......x............\|...(..........@................................................ ............... ..H............text....p... ...r.................. ..`.rsrc...x............t..............@..@.reloc...............z..............@..B........................H.......P ..8............%..8j..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.......................I...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196248
Entropy (8bit):	5.399726010814702
Encrypted:	false
SSDEEP:	3072:rRZ68PxLC368gIIkS5Xk6v4w3H4pppK5kg0qGE9PAeX/gS0sFpvn7q9fdD/hzwzB:rRtX4pppKKg0qJh/gWFJKFD/hzwHWJXe
MD5:	2B77C49FD60007CF36D824B97B7F59A5
SHA1:	5F0E7CB689C90E2DFF904898B30A177CDB8E63F2
SHA-256:	7BF6056FA0694A0684EBD476862E22ADD73982D31C1D4C89E2E8673614F1A99F
SHA-512:	310CA4EC09910322CDFD49108ACC06E2EE55B6460465C7302BEF2368E7A3726CBC5BD1CF6154737C342D69DD4CB39DDEBD7C5681DDD4D81AB717A2E556DB4381
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o............" ..0.................. ........... .......................@......`=....@.....................................O........................(... ......l................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......P ..L............%..P...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................N...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44672
Entropy (8bit):	5.766380395425848
Encrypted:	false
SSDEEP:	768:Y/aiExFCKwFlMQGTrMeY25zn1rg+8qet9dTaiBuQ2vpXdIC13dFxyUjEO4G2tC9L:eaiExFrMeY25zn1r58qet9dTaiBuzvpl
MD5:	AB06379A7D68B88E639CCFC045249B8C
SHA1:	7C0607FFA08C8C4F3BBEB8DE676A893801DC2505
SHA-256:	16E1DAFFD6AF62F4BEA10ED5A5BB033F1D0BB57F1B2F0D5DA041FD94675B5BE1
SHA-512:	D2AC30D65DBFA2D95E82C4B6CE2667DB56A6A173F927981ED778E2E6AC45EB6168A2F8F1971FD45751CF28311AB4EB6353057E845E1495C8CB9FC0907BF4BDC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9\..........." ..0..\|..........6.... ........... ...............................]....@....................................O.......h................(.......................................................... ............... ..H............text...<{... ...\|.................. ..`.rsrc...h............~..............@..@.reloc..............................@..B........................H.......P ..0............%...t..H.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................}.G...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38528
Entropy (8bit):	5.919577277472818
Encrypted:	false
SSDEEP:	768:Ngwqonge1WfeM12BssVPj2s38amEjcR+wHufpOS1C7pmFlih4NMJsqAFGXGDU7Pn:+wqonge1WfeVrSsqLyhgTvFEzOv
MD5:	20E98C3026AEC68921409B05A3E0875E
SHA1:	25469BE8554202312703B5C1DC9524D8173A4E63
SHA-256:	1586FA66152EB2AD2334C709FEABD76254331294CAE7C486146714982D293272
SHA-512:	8C3D208AB040BBE9F7E85205B4030A7F7DF44D91BF7C297282C0825F61DFF3A22845650B52800FFE3CA12C6439E2647B5C5F92A989F790FA642709008BCBA8F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R7..........." ..0..d.............. ........... ....................................@.....................................O.......h............n...(........................................................... ............... ..H............text....c... ...d.................. ..`.rsrc...h............f..............@..@.reloc...............l..............@..B.......................H.......P ..\............%..X]..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................}.G...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.564686945367063
Encrypted:	false
SSDEEP:	384:RhnE9+/F1UoWxCDsBlHRN7MTN4tgR9zJNDM2A:PEwQXCIjMTNx9znA
MD5:	D7CA5FC186084AE008A5DB2A7A1832B8
SHA1:	1D4244B75D60E80305B9D4A3F78C49028F71C182
SHA-256:	06CA7D4FD2228AD8507E3F0606F2C58514FA49D3FED98D733A49127E18E7ED33
SHA-512:	E12A11B560C942D6C6A8412A3975A8463112719CDB8D3362DE44B8D0441280DD422791FC85C2690433DF8179A044AEE80DBEF5467077AC43022908806C45790A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.b..........." ..0..............4... ...@....... ...................................@.................................h4..O....@............... ...(...`......L4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............,%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................m.....m.....Z...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................W...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141952
Entropy (8bit):	5.501277086304394
Encrypted:	false
SSDEEP:	3072:WTR9MtbGzbtyHZ/I11DKdwWorcP4IVCKZuXsn8ZCelODipOJ7OfvNZuXw2Giz5hZ:W+z5hQt7imr6e/WL/zEpg
MD5:	CBEF034C96B797E83B36206D37C04CC7
SHA1:	9204AC53F5C3BF610C09E7657C8A646865753B9E
SHA-256:	1A9F3CCD791079A5E0367B73EA4348F38F979AD10551CAB563BEEAC0C3B17E47
SHA-512:	6AAA2A0B870A2A926123CB34FB80AC4367A7D34BFE696FA515E473F1D7F14FC894CF5413FCBE16823A8EB4A443F4FAE602E1A563D70E451237B03138AADD2B6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z.}..........." ..0.................. ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..T............'..x...........................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......@...#Blob......................3....................................../.......................t...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.......................q.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.775773569549816
Encrypted:	false
SSDEEP:	192:6PL40sWtiWskWo0A2j9seHnhWgN7awW0chG2ZUnQJeX01k9z3AaotK:OL4rWtiWbsBlHRN7wG2teR9zbow
MD5:	764A770C791EFBA8F0EAA07AC7C0FFCD
SHA1:	96705DCF6040D3789AF11C5C0C84C95DD1216E63
SHA-256:	8E1521D0CFBDE9C5D89FA49A65C216287B788A36D053E47C27AACD0FF3740E1D
SHA-512:	BBEDCFB7D01AFCED5666DE61F7485868E428A7F05A50815446DBF4B38E8548ED720CB0EC11D773F8E3572A2BAB26FD716D1C7378D4D52B4C1043C5CA5FFF4D92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._m..........." ..0.............n)... ...@....... ..............................a.....@..................................)..O....@.. ................(...`.......)............................................... ............... ..H............text...t.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................P)......H.......P ..(...........x%.......(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................x...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S.......................u.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354944
Entropy (8bit):	5.271878517166016
Encrypted:	false
SSDEEP:	6144:y931HaNlbFGE1A+sDMSEm1gikUHrwEjBGuL/cWKzt5g9LXnOLLS1JEWzP9:yrrw6NUVm
MD5:	9AF63AC7B9B72D2158F173696397A0B2
SHA1:	A464BE85F81A403FC46BE9577F0A03C84355829E
SHA-256:	C42A0A4FCC77E28CC78E393882D921844E723CC8ED2CECC32AC88911FDEB588D
SHA-512:	391102BF6A70E5FB0639B5538FF11F992CF213294046739F382CB323C027BCCA09B00D33B4D7F126427BB1897BC61135A467510429548E80D55A2687B331C1E5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8...........V... ...`....... ....................................@.................................4V..O....`...............B...(...........V............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................hV......H.......P ..`............%.../...U......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...8...#Blob......................3....................................../.......................m...=.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................j.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	6.683064780634158
Encrypted:	false
SSDEEP:	192:Yqlmzkl5wukG+SdPWdGaUWo0A2j9seHnhWgN7awWqi+QohG2ZUnQJeX01k9z3Aaw:ZLiy9WdGZsBlHRN7F5XG2teR9zboAm
MD5:	2EF51639E58701D82EACC7DBCF60341E
SHA1:	02E1DE9B11A1D662FC4779CFA7225B105470B9B1
SHA-256:	3E6DE03DAF29F8FDDB95D75129AE21B41527302FC49DF384A204A0E68F119BE9
SHA-512:	8421AB9E1072B38DAA380635660437D08071E552143970861E3BBE6ADEB63325898982A4CFEE65C6178409352D9104396DCFA5E01A9C84B58414EC4538F6F54C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Q..........." ..0..............,... ...@....... ...............................+....@..................................,..O....@...................(...`......t,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............<%.......+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................q.....q.....^...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................[...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65176
Entropy (8bit):	5.8268040386703435
Encrypted:	false
SSDEEP:	768:RUoOCK7e4zOJhcy8rtkyLHp8c0boNShlqB49QjREgywciBZjPTNx9zz:0ljznmmGqB4a+FbiBJbpzz
MD5:	C35B26831A10DC81DA0999CD58BF83C1
SHA1:	0876C40231CEB15FF17E35438814FCE51B1FFBA3
SHA-256:	687BBABDAB2396D10EC94DDCD8784B720700A63363F0C3F00F90A4A08FD881EC
SHA-512:	ECD5C9AEB57FE9F44397B02DEE12A2DBB9406215D146BA0C5116DBB51C66B66AEFA07ADE4EF9F264E607A99F294C47CFD707565E4C2D1F418F1C1451E4049CF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P_..........." ..0.................. ........... .......................@............@.....................................O.......H................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B........................H.......P ...............$..(...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.D...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.4900789498061755
Encrypted:	false
SSDEEP:	384:l2f6X3FbjowB5oWSmmUsBlHRN7oyI/P/R9zVy:y6X35jfmvjoyEPZ9z8
MD5:	4F370695FA546FEEB4D80CA092012B37
SHA1:	26BE113BEB2CDE11B970FF96FD8DDEB9ED28004A
SHA-256:	F94A03F980A2D2F6A235FACD5F5E865E649FBC8995C61324497A1A5DF66DF0D7
SHA-512:	A08CE5145723E0560BBFD1074ABC9C0E0416C8F6612092058A23F528B25CBB5F541C2B724B8D41EB9AE32ED2824C213C1E4E92EF8AD27C79B511F8B749B7F08E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0..............:... ...@....... ..............................+.....@..................................9..O....@...............&...(...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H.......P ..@............%...... 9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.......................K...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.356367589450692
Encrypted:	false
SSDEEP:	192:tith2x6c+koyV35znQx/oWmdeEWo0A2j9seHnhWgN7akWrzks9gICQX01k9z3AFx:e+3+x/oWmde6sBlHRN7E/P/R9zVzvw9
MD5:	818C869E1D0A017AE03082045805EDED
SHA1:	13638E03F6089B911260739CF522031476EA5748
SHA-256:	BB0CC46CB7F6F76BFE75A4BAB6BABFDDF8B8087D3EFB977A32C7507587F4077B
SHA-512:	6F75DB743FB6D92960EDF2CD383C29CE3BE02D907C551B29B9346726B96E9E42D2036B7563CC955B6B33B847EF4ADF68412985FE39A6B247E6348CE1318F6A7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)i..........." ..0.. ..........z>... ...@....... ....................................@.................................(>..O....@...............*...(...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................\>......H.......P ..............4%..X....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................X...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.6976954771485415
Encrypted:	false
SSDEEP:	384:83Gi+RW/o/sBlHRN7ClZGlD/LVNSR9zuij:xIo0jCSxLVNe9zJj
MD5:	6BD369982AE15C001806C216BC39750F
SHA1:	3E9631BFAA11D1BE5386C7B211B4CD733E9C98BE
SHA-256:	3E12A602375DEE6EE183EE34B2E706B527F8336ED41E8761ECADD48391CFAA95
SHA-512:	783089816B1F79707706195B55324B214D2715EE5132E0DC9BD5E6AE5DA537DBB8316C3CD7098F4072F73476962F07B9D057F9660CD6B6EDD417D3D8D783E46B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s.L..........." ..0..............(... ...@....... ..............................B.....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..H............%......@'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................M...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.47662879669001
Encrypted:	false
SSDEEP:	384:RZGDpFWcb/sBlHRN7PFJGlD/LVNSR9zu/:XGF1b0juxLVNe9zQ
MD5:	77E8C3507D1AB48862312A333BE27D5E
SHA1:	B760F1CB6D9F9BD0F7B6681B6A0BD1A9EEEF01CA
SHA-256:	5201F7FC91C6ACECF71AE0C926D2D9B0E919D66A516D6137F7F7BC46185B37C1
SHA-512:	2046A3065B4148F00BD96FA711744C211E2C27324667D03794C78E6D7640C6C619E215D96EAB972B10C98B9B473AC55849A472EE0D2165416878081AB2A91DC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5$............" ..0..............4... ...@....... ...............................o....@.................................H4..O....@..x............ ...(...`......,4............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B................\|4......H.......P ..<............%.. ....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.......................J...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85656
Entropy (8bit):	5.580157747060465
Encrypted:	false
SSDEEP:	1536:dD1tTzijdUQ5ZscbIcvw+XRBoMz3TsJF0FhVHtAdIxw6QyvzB:d/ejdUQ5ZscE+zzjsJFyHtAdI9Qyv9
MD5:	CAFE26996858CF0F8D6CED58B8E98422
SHA1:	9AAD4380FA63F4302CD516FADCBB595FB0732A47
SHA-256:	1C7D9069DFF65C94CE1BD088002CBBBA10D46A31BF816FAF1018E28950DB0367
SHA-512:	6C9A8AD602A611E7BF4530A4BB94504F37C72D724C4F60CCF2199FD1BCBF61C34132881B14FC366695E79B9F9C377628FD99EA7CE1DEEA85DE3B3F9A240AC824
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\k..........." ..0..............:... ...@....... ....................................@..................................9..O....@..H............&...(...`.......9............................................... ............... ..H............text... .... ...................... ..`.rsrc...H....@......................@..@.reloc.......`.......$..............@..B.................9......H.......P ..$...........t%......,9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................z.D...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\tr\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.7223309569160365
Encrypted:	false
SSDEEP:	384:pK/LHLHEyW4zSeW+1IsBlHRN7eQX/P/R9zVz1:8rHEn4h1jj7PZ9zP
MD5:	2239451E3F3142A8CA22EEE895BD3F88
SHA1:	FE24C796DD4F20447ADD4D4F252A9BE9CD1A52E3
SHA-256:	EACC94C3F99AA292E31D6A393437526F40514DF4681DF754C7C8F52C1E2AD22A
SHA-512:	D4DFC2D6D1F9CB2491A7D9C490CDEEB366CCB3D95744872463FFA64BD56B3328BD26D0841D9DB81FE72A4108E82AC5568188E25FB56BF586E00DB890F8FAB6C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....'..........." ..0................. ...@....... ..............................=.....@.................................x..O....@...................(...`......\............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..T............%..8....)......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................P...............................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\vcruntime140_cor3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79792
Entropy (8bit):	6.778166830217706
Encrypted:	false
SSDEEP:	1536:5UwZIDobDaHrrAPsCbU4qzBHXpHo0ecbGp9yBOBDozi:7ZPDaHrrobUHzDxecbG3yGo
MD5:	BA65DB6BFEF78A96AEE7E29F1449BF8A
SHA1:	06C7BEB9FD1F33051B0E77087350903C652F4B77
SHA-256:	141690572594DBD3618A4984712E9E36FC09C9906BB845CE1A9531AC8F7AD493
SHA-512:	CA63EEAC10EF55D7E2E55479B25CF394E58AEF1422951F361F762AB667F72A3454F55AFC04E967E8CDD20CF3EEBE97083E0438EA941916A09E7D091818EA830E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........M...M...M.....O...D...F...M...d.../..Y.../..X.../..Q.../..L.../.u.L.../..L...RichM...........PE..L................."!.........................................................P......./....@A........................P........ .......0...................'...@......x$..T............................#..@............ ...............................text...d........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\wpfgfx_cor3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1803920
Entropy (8bit):	6.552083989482493
Encrypted:	false
SSDEEP:	24576:Pwtjgx3R4iRm70aLFwglxfl7k3G1WuB8mD4aZxPMvbxhzTEBo4:Itjm3R4iRmnUG1DvZxPGb3zTEBo4
MD5:	372D693BB34BF1804222504EA7A3E110
SHA1:	03C4406AA3AB114E9207D3F546BBA26B7D0C92F1
SHA-256:	635B51EDF3154DB6E7D697004A47C43CDB03F2BA1D2FB820F2C5333D48AE0349
SHA-512:	5ED4B12E37455DCD3B6E4469076870A9D52195DAFC7C19917E1A249C681AE7D0B41AE66BD9C05A6F2C03A44922D02A03DF4B611A519A7F4FAF081BEC3F5280BA
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................................9........................................W...z..W......W.U......=....W......Rich...........................PE..L...r.0b...........!... .:...V......0#.......P............................................@A....................................@....`...............^...(.......>......p...........................H...@............P..........`....................text...r9.......:.................. ..`.rdata...f...P...h...>..............@..@.data...p........X..................@....didat.......P......................@....rsrc........`......................@..@.reloc...>.......@..................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25216
Entropy (8bit):	6.469170006975943
Encrypted:	false
SSDEEP:	384:gymXXSXRaRmIjBXdXxaLGuQuQF2N2+hiR2/jwOwoaWYHAhQ5WxsBlHRN7wAG2tep:gymcIjyGdsVkKwO9ijwAG2tC9zR
MD5:	08F4E07C91F26AF3525A9BF1CFBDC594
SHA1:	E79085A11B8B529C8702EBE3C5BD006974E87F88
SHA-256:	C7C1F647C5B875EFCD485175D93DE078C5D09524134C49D280B37AB9B4914732
SHA-512:	CA842676243ED358BE95CBC357D01DC8369E730A496CF1447D7BC03A8C20D40827DFB0CA4ABE8DF3313B3BE941453D3202D50DCE63FB9326809404CCC273351C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.!..........." ..0..0...........N... ...`....... ..............................D.....@.................................lN..O....`...............:...(..........PN............................................... ............... ..H............text........ ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................N......H.......P ..8............&..H'...M......................................BSJB............v4.0.30319......l...\...#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3....................................../.......................q...u.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@...................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	100504
Entropy (8bit):	6.050385124550895
Encrypted:	false
SSDEEP:	3072:E1iAJUb4XH2l+YECxhjoDgYZbXhlruXbfOmROtyQbd:E1i74XWl+YECxhjo8YlRNJ
MD5:	1A6D4B8B076C4524782A0092D663FFE4
SHA1:	4345CC45959B8A27D64B462562FAD0940345468F
SHA-256:	BDFB2243F2EE36493B91C670BD798D7DA17CA80CF1AAECB6D1ECF5B4470F5F20
SHA-512:	87CA8AB38BEAE1B90261A4A2015D5C0E08E4911C4FB622F5992CE09872D15247EF50E8D4F0E1C9AFB1A7329DA8CAE3EC1B22696C1305F33876E2C615097A3404
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y..........." ..0..V..........Vt... ........... ..............................T.....@..................................t..O.......x............`...(...........s............................................... ............... ..H............text...\T... ...V.................. ..`.rsrc...x............X..............@..@.reloc...............^..............@..B................8t......H.......P ..@............%...M..hs......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	183960
Entropy (8bit):	6.02422385233052
Encrypted:	false
SSDEEP:	3072:cZhQkPmMA5r+WIJSrYQoxy9OVAFR+8GBLx79O2UT8qy22ASGZjcYsalvjr81olgL:cmyAFR+8ULx7ZtquASGZjBs2vM192CVn
MD5:	6661164356B7352B380790607526A0C7
SHA1:	8368DFD2191590FEC148EE375BAD0765B764AEAB
SHA-256:	CE4BF5BC157DDAF98F99E84AF8D68952575B1F1D871CD29626CF1246034E1F8E
SHA-512:	28FFCE49F9390DEE7A078A02FE77D20354BEBD3C1FAA52EB1A92B2A069870AE8D8237C62DF217069EBEBCDE1C1B7AA2203CED3BD3BABD9BE7CF9F68FD4212F29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............" ..0.................. ........... ..............................}.....@.................................@...O........................(..........$................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................t.......H.......P ..T............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43160
Entropy (8bit):	6.117198024518402
Encrypted:	false
SSDEEP:	768:fted0SYi7Skr+FoyNh1hn0A3Prs4vgXfMGv5YdcSsmC5YUghVOAOyXjJj05sN9zx:od0SYiTiHn0A3Prs4vcfMGv5YdcSsmCi
MD5:	7A04504EB44E59AE2DD57EFF40CF0B4A
SHA1:	3632738AE7C11CF2D906D3975C07EE40BB7DEEE1
SHA-256:	92246CD15C7A2F7F0F022FC9424AA8CFC2237AFC03B6798D3B39A699B0D74393
SHA-512:	ECA9A509D4F75813525B1BFA2D385D6246B60EFED06D6B9DF44FE9393BA2B2C1F3C9CA06BE25B5884E38B843AA0FD482A78415840C24868E92420E980A3B1742
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..v............... ........... ...............................y....@.................................8...O.......h................(........................................................... ............... ..H............text....t... ...v.................. ..`.rsrc...h............x..............@..@.reloc...............~..............@..B................l.......H.......P ..<............%...n..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	6.186422459309867
Encrypted:	false
SSDEEP:	768:YXUOgMne+nvV9fWpVPKFPl27L2vRmjJAU0rXRCOD8j34GTZy0heSS15WyItgUmd+:POgMne+nvVuI0wKKItgUmdSZ7iwGTy8E
MD5:	D9F3E954DD1A15FC2285933D7443443D
SHA1:	A06B491768F4E415BC482E0E87CFE82710208F2A
SHA-256:	130C8355305090FF76E9EF491D55834ED417F123B3422C8C50AD34F87165B3FA
SHA-512:	7A01942F56ABB42927833A1DC7D1D1FCB2FCE887EBB29EFCB350AA0327A4A6CC2C8FC5F724EFEA56549BB3CBDBBCBE4306EB1B7D9C9916544FEA8A0AC1740B1B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.w..........." ..0..^...........}... ........... ....................................@.................................T}..O.......h............h...(..........8}............................................... ............... ..H............text....]... ...^.................. ..`.rsrc...h............`..............@..@.reloc...............f..............@..B.................}......H.......P ..h............%...W...\|......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.589933624549109
Encrypted:	false
SSDEEP:	384:MhWu5Q36eHLoWxCmsBlHRN7ELMB+6R9zctFtFSV:0HQ36erXCFjEos29zaFo
MD5:	2DD35892A13F9AFA936B06F6AFF57A7A
SHA1:	8EAA27B1C7C3F9C4EF028AE11372F3D47F52ECE3
SHA-256:	D7421F714787A2BF77D27A4BA655B472BC439F1CEA488CCA8ECE08E8AA631F4D
SHA-512:	53CCEA89963D33FB8CF67B77032D14488C166AB1B4E0E7EA649561855B7C534B87D69951E568CA6A351AB964F0F93320A82E0D4AEA829BBA0C30E5BB273508AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H............" ..0..............4... ...@....... ..............................T^....@..................................3..O....@............... ...(...`.......3............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......P ..............8%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138368
Entropy (8bit):	5.768370109094442
Encrypted:	false
SSDEEP:	3072:m1R9MtbGzbtyHZ/I11DKdwWorcP4IVCLAFmbZanokelG5YCVHBqDBvQBahpWsvSL:mJSXJSHea/ge/wXfR
MD5:	4D90748887107F1E1045ABDAFF3A3783
SHA1:	F5FADEDA7F702145056E4578137B9A6ECA40D925
SHA-256:	44E3845802519484EF1F133919FE53379C2ED13EF971F2F6E7F7577138EBB547
SHA-512:	E7FD7A3298BEB271E0FED92C33A581E4D17B32F7AF90E7D2414A303126F652FF92CC0B04C99320686EE02077EB8D5F1534D7F282C81048ADD75D5D6BE059F776
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x............" ..0.................. ... ....... .......................`............@.....................................O.... ...................(...@......t................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ...............'.. ...........................................BSJB............v4.0.30319......l.......#~...... ...#Strings....0.......#US.4.......#GUID...D...@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.777404519192949
Encrypted:	false
SSDEEP:	192:2IhqOFWtiWstvWo0A2j9seHnhWgN7a8W6N4Q1RJVOYOg8nK4X01k9z3AvIVLk:RhqUWtiWisBlHRN7l1vVOY/wR9zQIVY
MD5:	4575278546F8617A736F779638736BE0
SHA1:	1573036E06969F5DF0363C36611469AD96897CC3
SHA-256:	574437910E81C4B339E2B75C7EC8CD2715A64E6DAF0ACA3270A17D1BA49BD6C6
SHA-512:	9EA885D223123073BE5AEDA199C64D9634FA3A90257BBA3CD189DFDEC9201F2DE34A0ED8B51C1D38FF0D16916090ABBA38E3EB127FF507571BA10B85E569F613
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[.=..........." ..0..............)... ...@....... ..............................-.....@..................................(..O....@.. ................(...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..0............%......((......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S....................... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	313984
Entropy (8bit):	5.934438302013711
Encrypted:	false
SSDEEP:	6144:793/FEmRVvl/xfvt/FsbmnOMXQ4hqBHT5Y3BvxaR:75ahHai
MD5:	BFB0D6EDD9477F89D208321D580BF90B
SHA1:	80051DD2F866521CF0803880B88CAC7DDAD204EA
SHA-256:	1909DF9A6909A3540FA9E4DB8C6FAA97F36D1B2B522D63AF4FB74DF98822755C
SHA-512:	BE2E6C1E53958230D501F9D34FFA50B9FE670A8AAACE0DE2A0DD841D6AB6F2BEED0052689528C5DC2833ABA4960260B76BB3FDC95469AC2B1CDA7F8829119521
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N............" ..0.................. ........... ....................................@.....................................O........................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ..t............%..P...........................................BSJB............v4.0.30319......l...\...#~......`...#Strings....(.......#US.,.......#GUID...<...8...#Blob......................3....................................../...........}.....}.....j...I.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................X.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.694771280372612
Encrypted:	false
SSDEEP:	192:phWI0Ei+ptHCvZ9ZWdGoWo0A2j9seHnhWgN7akW0Yjks9gICQX01k9z3AFMgEQDn:T0EYWdGesBlHRN7S/P/R9zVgEQD5h
MD5:	750E748A548976FE2BD5330B47FCBF62
SHA1:	7FA5595278110A7CB912494E814E15F6D9DE91FC
SHA-256:	6ECD6E7B2768091A0172675CA9FBEB21DC9445ECC8606FA7D71AF9AD437FD252
SHA-512:	AE883915DA7267DF55B82B662A3F54F8D42734977362958B3B2C1536C40CFFA938A937542BB5712017A878BAB5F595367A26DE05441AC76EA300D37B2AB8994A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w..........." ..0.............N,... ...@....... ...............................q....@..................................+..O....@...................(...`.......+............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0,......H.......P ..............H%......`+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61056
Entropy (8bit):	6.427310215619608
Encrypted:	false
SSDEEP:	768:moOCK7e4xTuLqN/q1SqsTomTrcmc0oDSM13OQK3KG9/D+3CPQxU08ziXRNgu4UBG:Qljx/jAmu32KfyyZNr4UBnfnNazEw
MD5:	08B3DCDB0741E15AEB9CB580B7945C4E
SHA1:	04B4A7D37647EB58A8B872FA46BDE4F55DCC794A
SHA-256:	569EE47C7E90E455C6A7EF9AF48F69FB8874E44DB55C346F371D3A2B6FE227B2
SHA-512:	6DA489BEBB941AC84CCDB384C2FEFFC9A6F1752AA68E28CCECC7618C3E71874ACD09BBE020946AEBC8E3A2C3645E4260AD46E72D2F4D445C7A2E892CE6968094
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;............." ..0.................. ........... ....................... ............@.................................\|...O.......H................(..........`................................................ ............... ..H............text....... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H.......P ...............$.............................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19584
Entropy (8bit):	6.643751746942233
Encrypted:	false
SSDEEP:	384:Rgfet3+LgiuatiFzWSmmysBlHRN7GG2teR9zboWZ:R2et32g76iFumRjGG2tC9zZZ
MD5:	0E7A76DFEA9017FBAFBEF892DCE69A8B
SHA1:	507549E4C787019DE2E81F769A0D0BC589956AF7
SHA-256:	05261659FBF9DE80E211CDB18390D2994CBA0C3FAA53F727DF63CD0EC2B42435
SHA-512:	01AD8B57CDA81CC52DCAB2C3AFB330135BD4665E9D86A63800EB2175693DEB7F9CC1324454FC924AFC0E676B4B388AE5D844D57AEA5AF124531217341063C65A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............8... ...@....... ....................................@.................................H8..O....@...............$...(...`......,8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................\|8......H.......P ..L............%.......7......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.....................................................~.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20632
Entropy (8bit):	6.469287445361818
Encrypted:	false
SSDEEP:	384:MsRBH3BoWmdrsBlHRN7ZETN4tgR9zJNZa:HRB3BMdAjqTNx9zU
MD5:	33C734B964E513E259E54C058EC7D8DA
SHA1:	314ED419BE3ADC4FF3BAFDE1E3EE62BED8E4E3EC
SHA-256:	E1132F6BE476BA1CAF0DEF9F113914E5ECD8A9F137F3AF373505EEDE5211A29D
SHA-512:	647C2930DDE8A4B872A2849B3EB2127CAF40229C49D591B6F11B4B6A713D8E42223AF53D6D6349DF486D903B0E3057EAB8F90E8BE254AD825B69CF3114026CD3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..........." ..0.............V=... ...@....... ....................................@..................................=..O....@...............(...(...`.......<............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................8=......H.......P ..............@%..(...h<......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.69906208309762
Encrypted:	false
SSDEEP:	192:aa3Z3rZWD/W/orWo0A2j9seHnhWgN7akWMWGaN4NhrJgX01k9z3ASNskMz:jl1k/W/oRsBlHRN7STN4tgR9zJNskMz
MD5:	6716D306B0215CF2518598384DBA3C9F
SHA1:	2E896B73EF3004759A2E1AAA5AF9FED9F357BFB7
SHA-256:	199576CDDEB1C369CD952861C7FE1AFB733A4132A89832BA66002751466C2CC4
SHA-512:	B18F4884F2239F5C75865A1372ED372553E9BBB4775D4B6CF06EE8E70BC445B2240BBC279F6E06F3988FD193059143A0F1C381B8860E8B9CBEDF337DE52F4D23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... ..........." ..0..............(... ...@....... ....................................@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..P............%......0'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18072
Entropy (8bit):	6.588408182473568
Encrypted:	false
SSDEEP:	192:l8ctCxS22SOB4da4KWLKRBJTRvWo0A2j9seHnhWgN7akW1nqks9gICQX01k9z3Ab:RtCxDcWcbHsBlHRN7Iq/P/R9zVkJ
MD5:	B61D3AC3A6A1A4CA4A0633361E5EA00B
SHA1:	D7006C2E94D2EE41DFACDF33A314E468FB00E661
SHA-256:	F9FBEF90EDB0BC418B4BFB8BCF82F41937156F0C81C0B49278194E9144E0760A
SHA-512:	2B774A10A2DFEC99E0B67B8C10009914019528BA9B6663023CCE975CF99E71C72EA0332EBFBFB3EA4F51AA1C8BEF4A9868879CD837E2F4CF86856AF95D1506E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............." ..0..............3... ...@....... ..............................B@....@..................................3..O....@..x................(...`.......3............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................3......H.......P ..D............%..x....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79512
Entropy (8bit):	6.136087705670629
Encrypted:	false
SSDEEP:	1536:FD19jmThZUECgG8HTnhgMHgkwbcx8maR3BMLa6Y7lxnu4oxTLBpzK:FPmThZUECPm6kwbY8mG/6Y7lxnu4oBrm
MD5:	93D9A6F6F6EF6302C55D0D850001770B
SHA1:	CBFA987854A2281F0BF0C2380FB2DAEA73DB2464
SHA-256:	D6B9C8D572F4C9A06E3C8360F000206CA6BAD335CE7EE55AC4CCB371B9BFBA60
SHA-512:	EBA1EF522E056B419B3179AD4F146B6A1B183655C2F6C9DD412CB753AA55F3DBC4A5DD30CE694EE78172E2286F23B04753597CC9F395194095AFA88FDBD4392E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c..........." ..0.............>"... ...@....... ...............................i....@..................................!..O....@..H................(...`.......!............................................... ............... ..H............text...D.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................ "......H.......P ..0............%......P!......................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hans\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.748252812658421
Encrypted:	false
SSDEEP:	384:BKYLFLHKqfWq9W+1esBlHRN74Fj05seyR9z0VuA:bZHKq+qD1Nj4Fj05sN9zAV
MD5:	068EF9AC27B95650FD99799E4BC34CF0
SHA1:	AAD46650C4D561B30588650FC4A0056C2DA563D8
SHA-256:	B86B3F34ABC23368ABE1EE46793621B21D6214265375AA03AB0B660A12774136
SHA-512:	1C05CA4979461EDBA7B73F24A75D2828E3D97ED7D80E69E9CBE1692A728ECDAFB2C502849496B99DF0B2B493A530EC77212ABB49DB7881A85744DCBE84FF6496
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............" ..0................. ...@....... ....................................@.................................d..O....@...................(...`......H............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..`............%.......)......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25216
Entropy (8bit):	6.466720423872414
Encrypted:	false
SSDEEP:	384:8ybXXSXRaRmInXdXxaxtSQuTmd21K/hCiy6lV1boaWYHAhQ5WhsBlHRN79GlD/L7:8ybcIGtZa6w2V18Sj0xLVNe9z0
MD5:	EBC18DB13E3D1D1AC7F4C9B641B86693
SHA1:	395677413414613D939D7C4FF28186BE235A86B1
SHA-256:	23C9B9518AD5E7457E59EE554B92334424F347A56F9FF254E36B341FF7E06632
SHA-512:	BD541E98E4EF28213D6E721BE67965BF83A1D93BEE53E8D838915DA4E233B01214DEA4CF23BD309D879F1488C41EDB85F0D05C934A0202192DBA2A2538BE285A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!............." ..0..0...........N... ...`....... ..............................'.....@.................................\|N..O....`...............:...(..........`N............................................... ............... ..H............text........ ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................N......H.......P ..8............&..X'...M......................................BSJB............v4.0.30319......l...\...#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3....................................../.......................q...u.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.t...K.....S.@...................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationCore.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101528
Entropy (8bit):	6.065433558213743
Encrypted:	false
SSDEEP:	3072:f1iC/Ov6FCLBdelJX9OHEvpweKovUGYUeICbrp:f1iC/TFCtdelJX9OHE6eKo5eICh
MD5:	18EE3CADC6B3B9BB081F418B64F274CE
SHA1:	D0A4B7D9E8276145F581FE7FF6AA2F5430489057
SHA-256:	5A66855A90A401FD6B15B87E8C074259F89722A0BBE1B5708E42D0AA1E2EC5C6
SHA-512:	6007ECAB2C5DB4CE4AB9C22C5451340D1B0DEFA2D8D529B57EC5718E65A348F34845D3AE9EF486FA4BE7AA9ACBADF95F56DDE5F070FA5B47E2EE06D0D69E5A57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Da............" ..0..Z...........x... ........... ..............................[.....@..................................x..O.......x............d...(..........hx............................................... ............... ..H............text....X... ...Z.................. ..`.rsrc...x............\..............@..@.reloc...............b..............@..B.................x......H.......P ..@............%..XR...w......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.S...C.....K.....................\|.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184448
Entropy (8bit):	6.021291615958971
Encrypted:	false
SSDEEP:	3072:IZ0iPImK2Xq1Ig9t2VmH0zgZw1lMDlBUtts8+16ga8qS88fBr1X5XirXlV9jPTHK:IvAw1lMDlBUnsc8qSTBBX5SrXlV9LTi3
MD5:	37AF5EA87933279F88EBF03282D2557A
SHA1:	A5F1D47CF82EBF8C2089D7AEB824348994AA6D7B
SHA-256:	71C972FF4E3CCE9B4FD5834B139EDC765EC25C43438D9F81ED4178D3494B0F13
SHA-512:	00E3FD167E402AF29CF41F501625660D7556D394A624ED4A839B7F203CEC7AA2C36F4F0E55AAFA08679967557CBD6890817FF0834E565BE65E8F50C0A4C1F4DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.l..........." ..0.............J.... ........... ..............................6.....@.....................................O........................(.......................................................... ............... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................,.......H.......P ..T............%......\.......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\PresentationUI.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43160
Entropy (8bit):	6.146070812759987
Encrypted:	false
SSDEEP:	768:pEVcZTkePW2dfxp8ilbbwq0+ZEvgej6bBQDmhitdnST5hkrnKUVJMvHd06JDiLqF:GcZTkehpbbwq0+ZEvNj6bBQDmhitdnSr
MD5:	8CA2BA10C173C3FEEE73DFE890E08408
SHA1:	9095202B45047D162894B95C956B26DD58AE5EF9
SHA-256:	C41E744A7F34AE1796104675DBC7AE507CE8D2E50962B8A180A890D3158562EC
SHA-512:	3267B01CDF692B7F22427A6D83B81289D12AB13D7A8FD8A0537A92690B7B55C772F7C10C4836AA01C6125AF87C4C9013E920A86DC6840209DC26504122995DA3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..v..........R.... ........... ..............................)$....@.....................................O.......h................(.......................................................... ............... ..H............text...Xu... ...v.................. ..`.rsrc...h............x..............@..@.reloc...............~..............@..B................4.......H.......P ..<............%...n..d.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\ReachFramework.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37504
Entropy (8bit):	6.169289795969573
Encrypted:	false
SSDEEP:	768:Oz7zhqHJKLeD28UoeTTYs+CPB2HNPeNGHjpJ05cKBPOc/YwmJF02RyhbgkWNsmyt:8hqHJKLeD28xi602fyd3bnNaz0
MD5:	2ACC70B27FA75AD8B99073E14B80F298
SHA1:	EF46B3090784E3B504D12D16E746F454AC2BDF22
SHA-256:	57055D6A9C3833B744A4F065E276DE6D4CC40D1E59EA279BB5244E839A830358
SHA-512:	1DEBEAE45CCCBADA69647EEA037254DF910C3D211AF1F108A015B806F1D052AE1A2F7A6FF5E93762E6C09A996169713AE7BC6A63BD8AB503A6C333FF667D57CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..`...........~... ........... ....................................@.................................<~..O.......h............j...(.......... ~............................................... ............... ..H............text....^... ...`.................. ..`.rsrc...h............b..............@..@.reloc...............h..............@..B................p~......H.......P ..h............%...W...}......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.S...C.....K.....................z.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Controls.Ribbon.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	6.591718157195354
Encrypted:	false
SSDEEP:	384:OhZIZPWoWxCXsBlHRN7EoVOY/wR9zQtMa:KEPWXC8jf/M9z8
MD5:	47F0AD80C5D7B8E1CAF63B24660068DB
SHA1:	B8B543551FD0CAC4D7131C3492CC5357BEA2AE9E
SHA-256:	4E1435D28BFEA08FF598FB422CCFA7EA733B86AB91CFC92ACB9611F7D1D11521
SHA-512:	FC3AA41B26F47ADE48DC0A73880A528D995B26CD38ED61D81A53760057E88BEF740064DF4D94FAC9F2766A01D3F7E251761B3DD70842ED628D73E43BB4B6F14D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^..........." ..0..............4... ...@....... ...............................f....@..................................3..O....@............... ...(...`.......3............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......P ..............8%...... 3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......,...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Design.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138880
Entropy (8bit):	5.766463909863314
Encrypted:	false
SSDEEP:	3072:NCR9MtbGzbtyHZ/I11DKdwWorcP4IVCLAFmbZanokelG5YCVHBqDBvQBarpW7HTm:NHHTm4+Djcoeu82pjLN
MD5:	08559C824F794FB5DC58DA63B0112AE1
SHA1:	C935753A267A993E89C4C4D795FF53A665A8AFC7
SHA-256:	514FF89F99CD943D3F00BA6F8D341BD5758EFAC81E9731E864E510EE47BF2225
SHA-512:	40B3BAF1CD807C79FE0CB23ED070D8232EF22FFB8F8CBB6593AC3EE6DE4209BE4A554FE79C1FCDC962F598DC53F297704B9CCEF91EA90644BE44D53C33FB8340
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ... ....... .......................`......Q.....@.....................................O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ...............'..P...$.......................................BSJB............v4.0.30319......l.......#~...... ...#Strings....0.......#US.4.......#GUID...D...@...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.)...S.....................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.Primitives.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15488
Entropy (8bit):	6.785944919359753
Encrypted:	false
SSDEEP:	384:BjR8WtiWMsBlHRN7GGlD/LVNSR9zu8KgWc:h5rjtxLVNe9zDKZc
MD5:	1CF14D8DDFC3C8E4DEBA0744EF37BC12
SHA1:	61AB8CCE8FCC32B97024903DDF233148B6711449
SHA-256:	FF1238CF08EA982CBB157802510CFDBD931792A650829C2961CE205AC5885CC3
SHA-512:	F5921E31D433EEDFC2907FAC095665268340A9890DC72A1B6E65EBC4D53615023EBC3F49DB724D5922529176B8B9B75C87D8EA5AE39D5F1A8742BFA3C29E970C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0..............)... ...@....... ....................................@..................................(..O....@.. ................(...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................)......H.......P ..0............%......0(......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K.-...S....................... .............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Forms.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	319616
Entropy (8bit):	5.953623688184171
Encrypted:	false
SSDEEP:	6144:e93lezI9NPvqtwJmVaIgC4wJv5ORXyK+g+WXPwRplssX7d3i:eIR96XPwB3i
MD5:	B94FDA0D633492165C95458DD22AC259
SHA1:	27977CD944E33CBFA32BC646F37576CA0A052127
SHA-256:	15C8C35B50F1B081D155BD36F5F639361535D649FCC2F931419D543306E8A5D6
SHA-512:	5C45D7BC6000081B60E9E834B5B3B44BC68651FA3B37BD91509CA826274380FBE1287C6814F49B7D483F6E1E4D6404C2455850CB36969F8E3253DC2DD041BDCB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ............@.....................................O........................(........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......P ..t............%..X...........................................BSJB............v4.0.30319......l...\...#~......`...#Strings....(.......#US.,.......#GUID...<...8...#Blob......................3....................................../...........}.....}.....j...I.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K."...S.......................X.............

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Windows.Input.Manipulations.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16536
Entropy (8bit):	6.697032535431298
Encrypted:	false
SSDEEP:	384:cB2H9BWdGBsBlHRN7edu0j05seyR9z0VuAi:T94Gijedhj05sN9zAli
MD5:	B33387533A110E94B6BF7849202F288C
SHA1:	F9CE6E01F5A5E59859A5F184244090D26F922A7B
SHA-256:	3133DE6B23FFD9A3D939A70A7AF7B0CD07DAE087C6D4133ADD6E85846A970389
SHA-512:	788679E94F28CEF87BB4C1426F1F7F9BC6F2F89650D5045FA6558F620ED8AC94781435C399FF8CFF3DBBCC5AE37CAA219A7F460E4BC0972DD3AF0CD060588FFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e..........." ..0.............V,... ...@....... ....................................@..................................,..O....@...................(...`.......+............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8,......H.......P ..............H%.. ...h+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\System.Xaml.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61056
Entropy (8bit):	6.388875961137112
Encrypted:	false
SSDEEP:	768:loOCK7e49BZdDSA78309IByGh0F96ox46RWCW45W+REUf6fUqSFAKXWJqLFulABF:Xlj9wGTFxLZlf6AnFulABWAEzU
MD5:	CCA527193C544E5244A75C084901BC60
SHA1:	4B9CB3A314A8D462442D2C4587710EA4B0EA0C38
SHA-256:	51A3ADD89A328837E84F9F8F4A2222C5F276E7B96DD43ED4A9BBB26900F9C0A1
SHA-512:	ADF30658DE55EEDCEC78762020409590DF7F3E798B451ED58EAC2C2DE2825481220F94F0E3197097CF8DAD809D39D0B740DDD19404F0571F0FEC7A9827C92F09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!..........." ..0.............&.... ........... ....................... ............@.....................................O.......H................(........................................................... ............... ..H............text...,.... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H.......P ...............$..H...8.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationClient.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.639032797629653
Encrypted:	false
SSDEEP:	384:ofIg3BiRqxQRoQTWSmm5sBlHRN7Ej05seyR9z0Vul13C:eIg3s8xQRpOmqjEj05sN9zAE1S
MD5:	10CA8F52CBDF4732709FF1D85DED2D0F
SHA1:	1787F2AC4631CCE12877EE2B435553ADB7F998D3
SHA-256:	753811D6E90F1B3BF76D2D9738EC85F2865398AD4967AEB1B7FED3DC667C02B9
SHA-512:	CB83704155DE4A9B0C582790A5486AF61A66E4B21EB14D7702108858862BEA4937CEC79BACC3B9DC071DCAEEF7D20F4A0DB7EE99E2BB0D73133FF326188917CC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C..........." ..0..............8... ...@....... ...............................G....@.................................08..O....@...............$...(...`.......8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................d8......H.......P ..L............%.......7......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.S...C.....K.....................................................~.

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationClientSideProviders.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20608
Entropy (8bit):	6.51086960377805
Encrypted:	false
SSDEEP:	384:+VxLm3ofUXw6HBoWmdisBlHRN71VEG2teR9zbo3e1r:CLQnw6HBMdhj1VEG2tC9z9x
MD5:	3E07E7C86E462F753E366B32E6DB080A
SHA1:	F2EC97F03EB4CA799C468F1B235A935896D95316
SHA-256:	96F99D0EB80D939D4D616CD02B4CED3EFABF78B788D18BD9BB1DAF5651A4A9D7
SHA-512:	9880C36D5B118511FABB2E5B751F9A180C1232BB177B3E579FF20D54095919890ED0788A4D9A7C1595A09A728764AAF1650EFF219A6700ABD27264BEAE9FCFE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...."............" ..0..............=... ...@....... ..............................a.....@.................................l=..O....@...............(...(...`......P=............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ..............@%.......<......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationProvider.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.701450700855865
Encrypted:	false
SSDEEP:	384:Sl9asW/ogsBlHRN7Df9TN4tgR9zJNVmsF:WyoLjDf9TNx9zd
MD5:	7205B438CF6168A367D0148BCEDFDDCD
SHA1:	98DFA2ADE418F0D0FA1E958A8C03D375D63C6A50
SHA-256:	1C01F6B7615DBDE0CC04AC28859758A65303FF02FB0FD9A7B7B8767277BA9566
SHA-512:	555F77AA9422FC0FFDA00721A814C59C429B8397F0A836784B10BDDA55DF580960EAD730DA1ED27C3B39909D7E31218BDDE696687FEF48334F676BE33802BB2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...xyE..........." ..0..............(... ...@....... ...............................`....@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..P............%......0'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\UIAutomationTypes.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.492417435908787
Encrypted:	false
SSDEEP:	192:L8pydLKhSI82kWLKRBJT9Wo0A2j9seHnhWgN7akWOpsWGaN4NhrJgX01k9z3ASND:Oydo9kWcbbsBlHRN7PRTN4tgR9zJNUt0
MD5:	6D8799EB9D6320544C0CB0DE25005BED
SHA1:	DE6385ADF196C83B14919451D9D777066F82E156
SHA-256:	FAF7362EAE5ABEC4A95A11878ED7D9F7659D78BA76E83D1814AF1621D2152937
SHA-512:	5805A8D62EA8FD78A33CF0A5094EBDB810D2FBBF1AD7597BBCE1C1678C753CFE1E9F79B7911CD26CCA2D10B8A9AFED8F619B8ADAF1DFC48D3E4F7C83C06948BC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............:4... ...@....... ...............................5....@..................................3..O....@..x............ ...(...`.......3............................................... ............... ..H............text...@.... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................4......H.......P ..D............%......L3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.S...C.....K.....................}.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsBase.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80536
Entropy (8bit):	6.160451379614415
Encrypted:	false
SSDEEP:	1536:ID1Ik9vTJc8+dxmHnjlRJbRz59aKmVx72aLJNSdQlOZOWNspxA0pzx:Iak9bJc8+dGj9Ir72SIspVN
MD5:	4438CB21953D1BDC22984318A64C8D8A
SHA1:	03A885A8B6175F824BA5BF245089337C9BAE8BB1
SHA-256:	8622C82CFBF16A838E430C97EE4EDB3A442B7964E3870DB82EFB945FA5BA675E
SHA-512:	3024EF2B20094DAFBE084C9DDEF85EC550CDED2DB84A3E8FA4532CA517532A09AE4B03EFCAC3ACA2A2D4F5AD119E2E03069D77B19896D2CBEB5528AF01C259B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fH..........." ..0..............&... ...@....... ..............................w.....@.................................l&..O....@..H................(...`......P&............................................... ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B.................&......H.......P ..0............%..P....%......................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.S...C.....K.....................w.................................

C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\zh-Hant\WindowsFormsIntegration.resources.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	6.750181171005905
Encrypted:	false
SSDEEP:	384:aKYLFLHozWiGIcW+1KsBlHRN7JMphVOY/wR9zQR:eZHoSiQ15jGR/M9zI
MD5:	32B2899F09B8A241E5B977D8E74A799D
SHA1:	A17887E68E09F557594CB212517E0CA3EA7FBC12
SHA-256:	110E41DD3F8CC42F6E87CFBE6554F62B6885532F3BF3034E68D8BB4A7488436A
SHA-512:	1C75E856254F8E97F5B757C2D9A9B55A632619F45345E785B6AF69803491CB92C091D49E67A1ABBFDADEEAD6A659C7E6452C2DA1D4F176E0DDB79335603AF0AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ..............................tx....@.................................\..O....@...................(...`......@............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..`............%.......)......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.S...C.....K.......................................................

C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.4 (x86).swidtag

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	488
Entropy (8bit):	5.391733672823436
Encrypted:	false
SSDEEP:	12:MMHdXxurHmRn7+xzB1R4yzW+BFpBxBQEpj0MtMIQ3/9:JdXxWwn7+xF1R4yW+DpBxWWweG3F
MD5:	D5A4FEE7E3B843AF0A58E5971B4D1196
SHA1:	47B19778252AC8B16953E114B5F8C0FEF02AAEAF
SHA-256:	6CDEB19A7CCC1D28D64C830CFE85A8C3899BF7DDB334D3D85E07FB65A2C894D6
SHA-512:	DBD59E50052D2FA1A4EC2FAC4815A720017C546875672B43D66A7C6BDF2C76CC1048B65CC9EC1AD672DAC5F67BF820BC8D9CA62E3C38F4D3510AF628639BCC9E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<SoftwareIdentity tagId="wix:bundle/FF0D7B6B-8624-42F0-B961-69E6CBF896C1" name="Microsoft Windows Desktop Runtime - 6.0.4 (x86)" version="6.0.4.31115" versionScheme="multipartnumeric" xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd">. <Entity name="Microsoft Corporation" regid="microsoft.com" role="softwareCreator tagCreator" />. <Meta persistentId="wix:bundle.upgrade/DA65001D-5316-7E90-1BB6-07698AEB9587" />.</SoftwareIdentity>

C:\Program Files\DIFX\0169CE3A95F06636\DPInst64.exe

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	930272
Entropy (8bit):	5.7366323794740115
Encrypted:	false
SSDEEP:	6144:JcQsynWrZI8I/VELVqZFbq+0pHKmdTJF805CbLLDFSQSAj99HJYnJzDX+v34nQTy:mpRkVWqZRqXVI0oLD7ZxA434QTPh2F
MD5:	C3AC43B2018114A617E946AA8FDF3CAC
SHA1:	2D90F38BC995C9CD5EFEC52109F8BD2468001CA7
SHA-256:	EF6C5FE9F08BE67F24C7DFA5C7BC3D69AB4E387E6065602D45BA358289F05117
SHA-512:	8C471A2575751C5995B10859219B979D75C8E8E4496604C0718268D8367790C5BB8E6DD47C735DCECD02A62DBB0D8FBBB70EA1D085AD7B798491A3D831CD9488
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.hA].;A].;A].;f..;C].;f..;U].;f..;`].;A].;.\.;f..;.].;f..;f].;f..;@].;f..;@].;f..;@].;RichA].;........................PE..d...b.4E..........".................<........................................`.......A....@.......... ..........................................@........q...P..xr...........P..D....................................................................................text... ........................... ..`.data........0......................@....pdata..xr...P...t..."..............@..@.rsrc............r..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2N TELEKOMUNIKACE\2N USB Driver.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Apr 26 08:14:07 2024, mtime=Fri Apr 26 08:14:07 2024, atime=Mon Jan 22 09:58:18 2024, length=296096, window=hide
Category:	dropped
Size (bytes):	1445
Entropy (8bit):	4.584558601007882
Encrypted:	false
SSDEEP:	24:8m8yEcdOEm3gX4n3wAM0hydAMdAZc/KoUUBtz/qygm:8m8lcdObQX4n3HMYydAMdAZc/K9UtOyg
MD5:	B8A59C0DE7365BA099146E11A1280206
SHA1:	F233F2C2C9E0C9755376B3D99405A0CF01B26788
SHA-256:	5A6B0D97B656CF9B79ECEAA74A667FEFB09FF952BABB802EE839874A987DEB52
SHA-512:	86B559F0F54B54B10871BC10E12D9FADBF4BAD4C03138C3E17649304211455DE09B2E2B84AB892D5FFE2E4F7C55EF1E9164C3C94131A0A9840D441A6F9248750
Malicious:	false
Preview:	L..................F.... ..........99..........!M...............................P.O. .:i.....+00.../C:\.....................1......X.I..PROGRA~2.........O.I.X.I....................V......;..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1......X.I..2NTELE~1..T......X.I.X.I...........................;..2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.....d.1......X.I..2NUSBD~1..L......X.I.X.I..........................D.6.2.N. .U.S.B. .D.r.i.v.e.r.....`.2.....6XIW .Usbdrv.exe..F......X.I.X.I..............................U.s.b.d.r.v...e.x.e.......p...............-.......o...................C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe..P.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.\.2.N. .U.S.B. .D.r.i.v.e.r.\.U.s.b.d.r.v...e.x.e.6.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.\.2.N. .U.S.B. .D.r.i.v.e.r.>.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6

C:\ProgramData\Package Cache\.unverified\dotnet_host_6.0.4_win_x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}, Create Time/Date: Mon Mar 28 22:15:24 2022, Last Saved Time/Date: Mon Mar 28 22:15:24 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.471928236216391
Encrypted:	false
SSDEEP:	12288:KIBjxMbJxuz+N1qqGCVt07kw3jl2tBds:LqTm+f2CVql3CBd
MD5:	E272913E581C11624BE39D55E81A07BE
SHA1:	CC9B92914BE59FDF6D227A629B8078B834DE273F
SHA-256:	F80E1AE91FFE984A9F0AD4E7B8BB06A0B6D5C66F2189C33696817E9ACFABC4E9
SHA-512:	80E8CC96FA32BACA5F2F4B6A7781B363BE827D96E37D9419EF11D59FED54A3A4C15F9215E39844725128DB4E8829CBF2CEE1360270E77551488A27ED64B81BDE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\dotnet_hostfxr_6.0.4_win_x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host FX Resolver - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host FX Resolver - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}, Create Time/Date: Mon Mar 28 22:28:54 2022, Last Saved Time/Date: Mon Mar 28 22:28:54 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	802816
Entropy (8bit):	6.654815364510836
Encrypted:	false
SSDEEP:	12288:4iSlGY9IBjxMbJxuz+N1qqsCVt07kw3jl2tBds:vSeqTm+f8CVql3CBd
MD5:	E2416A04AA679FCD0CBBC8E705A6A7C7
SHA1:	9408D2A3F620535BDE620243400B34D6D21A1C4C
SHA-256:	B0C5FE8FCF2996B6C340EAB544CFEAEE18578B525762EAC06128E42B6F6B281C
SHA-512:	0C9BF3961BF2C83453E8F06F6BB1793416F492A9EE94D05506D5A1F49DECF01155AFCE128B4F5E92D1B9201E5A80BE16AD0B3A4D25229FCDFD98BDA0FFB03709
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\dotnet_runtime_6.0.4_win_x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {25B8B5B6-686E-443A-93DD-4A03FC1447F9}, Create Time/Date: Mon Mar 28 22:34:04 2022, Last Saved Time/Date: Mon Mar 28 22:34:04 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	25038848
Entropy (8bit):	7.993694661390324
Encrypted:	true
SSDEEP:	393216:8F7jKrMX/v9NiMxo3lVZvpbEjsFiOzTrlf8akZq8l/Bahg3S6fXz1KM7vubjcl5J:8FPKAdipvtJiOblf8xZq8l/dSmD1l7vf
MD5:	CD9EF7D9D429445AFDEA12E5CC78E5A3
SHA1:	59B0161EC1E3476474E1C3AAA919685932C2B974
SHA-256:	B4847FD536D9A6F39D79ABA8B077E313DB64485D79A02B6D69A3E16FA673E037
SHA-512:	76E3CFAA0ECB9CFE957C9601CA3537E0531EFDFA9426E56510414F0323F88D824C98E9EBE6D387DB52C65AB9BB1E01D2680EDC94658D9C4CD76D1484DC66BC33
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\windowsdesktop_runtime_6.0.4_win_x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Windows Desktop Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Windows Desktop Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {951FC065-6FC2-4A32-9FB6-99EEDC7A8096}, Create Time/Date: Mon Mar 28 22:28:22 2022, Last Saved Time/Date: Mon Mar 28 22:28:22 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	27099136
Entropy (8bit):	7.99437933130602
Encrypted:	true
SSDEEP:	786432:14AC9LZT7/xen9hQfFZJPeElult56O/AU+bq+Cpd:1NC9lTa9wFfTGzT4bqh
MD5:	3CC0458C467FD646AFE4EFC103ECC634
SHA1:	C42C5740E3A10229E250969F22ECDD7376698488
SHA-256:	E67B62CDC6D66720AA82977863F38E3469C45C3CA3F752032DEC709A173C209A
SHA-512:	AB6434BA2DAD9138082AA9D657A850659BD84140D9D90BDA72D54FE688839131C33B333926A306AF27BBD89FA2D7240C73181C530017B01E132834B5A639B819
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{28F5CA46-286A-4C61-A86E-525F06E456DD}v48.19.39090\windowsdesktop-runtime-6.0.4-win-x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Windows Desktop Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Windows Desktop Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {951FC065-6FC2-4A32-9FB6-99EEDC7A8096}, Create Time/Date: Mon Mar 28 22:28:22 2022, Last Saved Time/Date: Mon Mar 28 22:28:22 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	27099136
Entropy (8bit):	7.99437933130602
Encrypted:	true
SSDEEP:	786432:14AC9LZT7/xen9hQfFZJPeElult56O/AU+bq+Cpd:1NC9lTa9wFfTGzT4bqh
MD5:	3CC0458C467FD646AFE4EFC103ECC634
SHA1:	C42C5740E3A10229E250969F22ECDD7376698488
SHA-256:	E67B62CDC6D66720AA82977863F38E3469C45C3CA3F752032DEC709A173C209A
SHA-512:	AB6434BA2DAD9138082AA9D657A850659BD84140D9D90BDA72D54FE688839131C33B333926A306AF27BBD89FA2D7240C73181C530017B01E132834B5A639B819
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{61373008-0285-40B8-93C2-26C8110BC4ED}v48.19.39076\dotnet-hostfxr-6.0.4-win-x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host FX Resolver - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host FX Resolver - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}, Create Time/Date: Mon Mar 28 22:28:54 2022, Last Saved Time/Date: Mon Mar 28 22:28:54 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	802816
Entropy (8bit):	6.654815364510836
Encrypted:	false
SSDEEP:	12288:4iSlGY9IBjxMbJxuz+N1qqsCVt07kw3jl2tBds:vSeqTm+f8CVql3CBd
MD5:	E2416A04AA679FCD0CBBC8E705A6A7C7
SHA1:	9408D2A3F620535BDE620243400B34D6D21A1C4C
SHA-256:	B0C5FE8FCF2996B6C340EAB544CFEAEE18578B525762EAC06128E42B6F6B281C
SHA-512:	0C9BF3961BF2C83453E8F06F6BB1793416F492A9EE94D05506D5A1F49DECF01155AFCE128B4F5E92D1B9201E5A80BE16AD0B3A4D25229FCDFD98BDA0FFB03709
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{8075C447-DEF3-4DCC-BB39-8497717BE91E}v48.19.39076\dotnet-runtime-6.0.4-win-x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {25B8B5B6-686E-443A-93DD-4A03FC1447F9}, Create Time/Date: Mon Mar 28 22:34:04 2022, Last Saved Time/Date: Mon Mar 28 22:34:04 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	25038848
Entropy (8bit):	7.993694661390324
Encrypted:	true
SSDEEP:	393216:8F7jKrMX/v9NiMxo3lVZvpbEjsFiOzTrlf8akZq8l/Bahg3S6fXz1KM7vubjcl5J:8FPKAdipvtJiOblf8xZq8l/dSmD1l7vf
MD5:	CD9EF7D9D429445AFDEA12E5CC78E5A3
SHA1:	59B0161EC1E3476474E1C3AAA919685932C2B974
SHA-256:	B4847FD536D9A6F39D79ABA8B077E313DB64485D79A02B6D69A3E16FA673E037
SHA-512:	76E3CFAA0ECB9CFE957C9601CA3537E0531EFDFA9426E56510414F0323F88D824C98E9EBE6D387DB52C65AB9BB1E01D2680EDC94658D9C4CD76D1484DC66BC33
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}v48.19.39076\dotnet-host-6.0.4-win-x86.msi (copy)

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}, Create Time/Date: Mon Mar 28 22:15:24 2022, Last Saved Time/Date: Mon Mar 28 22:15:24 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.471928236216391
Encrypted:	false
SSDEEP:	12288:KIBjxMbJxuz+N1qqGCVt07kw3jl2tBds:LqTm+f2CVql3CBd
MD5:	E272913E581C11624BE39D55E81A07BE
SHA1:	CC9B92914BE59FDF6D227A629B8078B834DE273F
SHA-256:	F80E1AE91FFE984A9F0AD4E7B8BB06A0B6D5C66F2189C33696817E9ACFABC4E9
SHA-512:	80E8CC96FA32BACA5F2F4B6A7781B363BE827D96E37D9419EF11D59FED54A3A4C15F9215E39844725128DB4E8829CBF2CEE1360270E77551488A27ED64B81BDE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\state.rsm

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	2.503293698895321
Encrypted:	false
SSDEEP:	12:VZK34pgMClGttD6+xU22W+oF6Attun2QaQ1q0JRZlun2Q1Q1q0v:rKUgMClcKX7ZBZ
MD5:	8F08BD9283F09177CB7125B5DA07CA28
SHA1:	70450F165928D7374C47645D57E74E3821705B54
SHA-256:	8D89EF76BDF3B8693773F008EC4C82CF562ACAB2582F1CE8EA2C3320DD319127
SHA-512:	8171D6C67F8EC5033FBEE2D26B146537471DB5E5DE22DB3B5FA2D28E7AD876E59CB807DE82DAE7A656A5FCD28817B0D8E78C206270E0F2CB611FB7A74FD70344
Malicious:	false
Preview:	T...............................................................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.....................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.........................................W.i.x.B.u.n.d.l.e.N.a.m.e...../...M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .D.e.s.k.t.o.p. .R.u.n.t.i.m.e. .-. .6...0...4. .(.x.8.6.).............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....E...C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.C.L.J.4.H...t.m.p.\.d.o.t.n.e.t.6.0.d.e.s.k.t.o.p...e.x.e.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.F.o.l.d.e.r.....2...C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.C.L.J.4.H...t.m.p.\.................................................

C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe

Download File

Process:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624840
Entropy (8bit):	7.165075877000891
Encrypted:	false
SSDEEP:	12288:M5mWukhI2jFMSjysAS9X/GsfTDYrGi81LBrukB/FOGOaWXXoC6J9hDnmFJ:M5mWpI2jFM5sFzfTpieL8asLp6DhE
MD5:	9B29FA18CED2536A6AF5978740439137
SHA1:	37769CCB26FCF75C45B12AFC6987F3094622FA52
SHA-256:	E2DEE005D5361F8D3A4934D545BBD0FBEDCC37FD2F555C4A5344F5F6F3CDBEEC
SHA-512:	C33EA247BFAE41C68F63BCD174C08CE8C4889A8980D08E6BC81807C3EE4BA4028CEE735A755631806AA1537E6A8407F78D5815144B80C1B536108D4F34EC95CC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa.....................\|....................@..........................`......L.....@.................................<...........,;..........._...(... ...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...,;.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HostsHelper.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	ASCII text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	15504
Entropy (8bit):	5.545767596977997
Encrypted:	false
SSDEEP:	384:zGT7jfLE15sVMgtrSs2jpLjp4VRBRNHVLVDgRVDaWFIDAptg3kApH:CH6NLN6RBRN1pDg3DUWrWH
MD5:	39F5FDAA935E92717079355D982FCB94
SHA1:	39C448A87C990A563AE9DCDEE9DA97AD78F84C9C
SHA-256:	939ADE29CFA14D2B5AC9DDE2EFB06095DA6DED214D7992710D514892552C5E5C
SHA-512:	BD2B957FDB128377DE4A277FA177ABBD2992C1D08A83B0571653E5DDD9D6FBF514AE4DF69EA042DE721F546D0D1C6388CF86C450CB58740EFE5ABA705C652157
Malicious:	false
Preview:	[1AE4:136C][2024-04-26T11:13:35]i001: Burn v3.14.0.5722, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe..[1AE4:136C][2024-04-26T11:13:35]i000: Initializing string variable 'BUNDLEMONIKER' to value 'Microsoft Windows Desktop Runtime - 6.0.4 (x86)'..[1AE4:136C][2024-04-26T11:13:35]i000: Initializing string variable 'PRODUCT_NAME' to value 'Microsoft Windows Desktop Runtime - 6.0.4 (x86)'..[1AE4:136C][2024-04-26T11:13:35]i000: Initializing string variable 'LINK_PREREQ_PAGE' to value 'https://go.microsoft.com/fwlink/?linkid=846817'..[1AE4:136C][2024-04-26T11:13:35]i009: Command Line: '-burn.clean.room=C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart'..[1AE4:136C][2024-04-26T11:13:35]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotne

C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336_000_dotnet_runtime_6.0.4_win_x86.msi.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	684324
Entropy (8bit):	3.8439585033711525
Encrypted:	false
SSDEEP:	3072:2yHY8jSxVce3+SD/oI+9Py+CF8FvluqQKeoQvL1WmWYGGF+mHSUFIPpmp9Dr2JFB:hjII
MD5:	D6CAAFC404119584508953F7BC6F14C1
SHA1:	4846FA83DDD78A4115B15BF1D9D08A0046D17B89
SHA-256:	AAE3300F25B08FB051C246355800C9F9384F5CFEDD0300790DDC668CF4F60C53
SHA-512:	7684C593129CDCE869C8AE0D031D98B4F05484CD8756DEB2AF76E6B0AC83AB0AD4EF900A6E1188536D405C87821103CE71790816E1AAA535242365BD0DD44C20
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.1.:.1.3.:.3.8. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.C.0.C.3.5.B.E.-.E.F.8.5.-.4.2.E.F.-.A.7.A.F.-.6.6.B.7.6.F.7.3.2.A.F.7.}.\...b.e.\.w.i.n.d.o.w.s.d.e.s.k.t.o.p.-.r.u.n.t.i.m.e.-.6...0...4.-.w.i.n.-.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.C.:.7.8.). .[.1.1.:.1.3.:.3.8.:.5.7.2.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.C.:.7.8.). .[.1.1.:.1.3.:.3.8.:.5.7.2.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.C.:.7.8.). .[.1.1.:.1.3.:.3.8.:.5.7.2.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.8.0.7.5.C.4.4.7.-.D.E.F.3.-.4.D.C.C.-.B.B.3.9.-.8.4.9.7.7.1.7.B.E.9.1.E.}.v.4.8...1.9...3.

C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336_001_dotnet_hostfxr_6.0.4_win_x86.msi.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (398), with CRLF line terminators
Category:	dropped
Size (bytes):	96964
Entropy (8bit):	3.792546623741717
Encrypted:	false
SSDEEP:	1536:KiJmfadw8F78gd4oLw08l4P5Z2+Bf3vFQ2wmOmUo09V1GvxjIMjsniCpGf0oRYkQ:KdsjIMjsnLR
MD5:	1D58D7217C9F75D913CE806C9243D7CB
SHA1:	8F426E13B43DE1629282D332A713619598C7E2AD
SHA-256:	0DB652B0E13ACED9239F8F21167C2F53FD2A262131D0EF69D8813CF6F7E08014
SHA-512:	B71D74C3B34F3375E5AA43FD40446B35B1BCAB411CC23ADB0C7C37B9078760EC610BE6FFF3F698FA7E641D9DDA5A409BA8B34D10012075F085C2F02F14B77F82
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.1.:.1.3.:.4.9. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.C.0.C.3.5.B.E.-.E.F.8.5.-.4.2.E.F.-.A.7.A.F.-.6.6.B.7.6.F.7.3.2.A.F.7.}.\...b.e.\.w.i.n.d.o.w.s.d.e.s.k.t.o.p.-.r.u.n.t.i.m.e.-.6...0...4.-.w.i.n.-.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.C.:.4.0.). .[.1.1.:.1.3.:.4.9.:.7.5.9.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.C.:.4.0.). .[.1.1.:.1.3.:.4.9.:.7.5.9.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.C.:.4.0.). .[.1.1.:.1.3.:.4.9.:.7.5.9.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.6.1.3.7.3.0.0.8.-.0.2.8.5.-.4.0.B.8.-.9.3.C.2.-.2.6.C.8.1.1.0.B.C.4.E.D.}.v.4.8...1.9...3.

C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336_002_dotnet_host_6.0.4_win_x86.msi.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (383), with CRLF line terminators
Category:	dropped
Size (bytes):	107574
Entropy (8bit):	3.790742463266124
Encrypted:	false
SSDEEP:	1536:ro8W3K1IU9T8BFabwM5jg6ApZJ2kM8K4g2ZV0yQwIjWjDJSNLjeoFLt8mc:rLcjDJSNLjeoFLt8B
MD5:	4260F919ADB2E4002A13BD84DCAD8ADC
SHA1:	58F4F4D9A9D511399D0475F00C3FED89E340BFC1
SHA-256:	51515608F83C1E476F2C77DE47734F7681B4B0B4873125F82FCFD8B3329601F1
SHA-512:	DEEA7F35E7217E2E41D914F6203A264459269C4E61D778C425070A0C9F3F850CF15A7D5898458577720F09799AA6C8015B174C13AE9F0E879899093BE104C15F
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.1.:.1.3.:.5.0. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.C.0.C.3.5.B.E.-.E.F.8.5.-.4.2.E.F.-.A.7.A.F.-.6.6.B.7.6.F.7.3.2.A.F.7.}.\...b.e.\.w.i.n.d.o.w.s.d.e.s.k.t.o.p.-.r.u.n.t.i.m.e.-.6...0...4.-.w.i.n.-.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.C.:.F.8.). .[.1.1.:.1.3.:.5.0.:.6.0.3.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.C.:.F.8.). .[.1.1.:.1.3.:.5.0.:.6.0.3.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.C.:.F.8.). .[.1.1.:.1.3.:.5.0.:.6.0.3.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.D.B.8.2.E.9.A.B.-.0.1.D.C.-.4.F.9.9.-.A.6.C.7.-.6.7.C.D.D.F.9.0.A.A.D.9.}.v.4.8...1.9...3.

C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336_003_windowsdesktop_runtime_6.0.4_win_x86.msi.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	1030386
Entropy (8bit):	3.8208328475922038
Encrypted:	false
SSDEEP:	3072:iD7zojWmjcdQ/HyYhXj2za7sRFTORk+qnaDInbmT5MkXSi+leJ0swIOJkPqTs3F2:xj9mKHyzt
MD5:	84BF4503D8DA1DB47C938C3047BE065C
SHA1:	B3E4BEA08C9A7A76753E6BE03BF4D702FCC3001D
SHA-256:	9893812EAFC090F1B7395CFB258BC94B33BEED6C334DA34ABC890B2D3F3C9C47
SHA-512:	FC73ED52F4F0E03EB2D9D99E842B8038FE33D7733F0C15CE67A70793DB980A84853FA1C2A7D85A71191870A9A4D0B3D996AF1373C4D963BBFFC594C1ABA1A65E
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.1.:.1.3.:.5.2. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.C.0.C.3.5.B.E.-.E.F.8.5.-.4.2.E.F.-.A.7.A.F.-.6.6.B.7.6.F.7.3.2.A.F.7.}.\...b.e.\.w.i.n.d.o.w.s.d.e.s.k.t.o.p.-.r.u.n.t.i.m.e.-.6...0...4.-.w.i.n.-.x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.C.:.1.8.). .[.1.1.:.1.3.:.5.2.:.2.4.4.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.C.:.1.8.). .[.1.1.:.1.3.:.5.2.:.2.4.4.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.C.:.1.8.). .[.1.1.:.1.3.:.5.2.:.2.4.4.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.2.8.F.5.C.A.4.6.-.2.8.6.A.-.4.C.6.1.-.A.8.6.E.-.5.2.5.F.0.6.E.4.5.6.D.D.}.v.4.8...1.9...3.

C:\Users\user\AppData\Local\Temp\dd_NetCoreCheck_7175234.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.423976698403098
Encrypted:	false
SSDEEP:	3:qRSKXMUfU4PPR9s2YYreKXMUfU4ncN4uRNpAro0nzov+7SKXMUfU4Pjsg9SYz:q0MMUfNrsQreMMUf1c/FoGqSMMUfdsyz
MD5:	AF2CDC295F00A2B6001ADF3D55EA074B
SHA1:	A0AB14E6AB383CEF9F38BDC85078FBC1B04EA73C
SHA-256:	A1EFD13E7AA8AAD9CF1B9A113BC470271BF07C0FB35E430C30D06D2BAE5695B2
SHA-512:	511DA66CACCEBAEB9CE0125D7F3E89B465A897984368B6ECA209798FC59D3F2053B6D4744A3BD9415E7F8209906B41A72F225CDCA9E45C4D8363237360D0DE7C
Malicious:	false
Preview:	[04/26/24,11:13:09] ============= NetCoreCheck Start ===============..[04/26/24,11:13:09] get_hostfxr_path failed: '-2147450749'..[04/26/24,11:13:09] ============= NetCoreCheck End ===============..

C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	711168
Entropy (8bit):	6.513782388052726
Encrypted:	false
SSDEEP:	12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29
MD5:	FFCF263A020AA7794015AF0EDEE5DF0B
SHA1:	BCE1EB5F0EFB2C83F416B1782EA07C776666FDAB
SHA-256:	1D07CFB7104B85FC0DFFD761F6848AD176117E146BBB4079FE993EFA06B94C64
SHA-512:	49F2B062ADFB99C0C7F1012C56F0B52A8850D9F030CC32073B90025B372E4EB373F06A351E9B33264967427B8174C060C8A6110979F0EAF0872F7DA6D5E4308A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&........................................................... ......................................................CODE....$........................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls.....................................rdata....... ......................@..P.reloc......0......................@..P.rsrc...............................@..P.....................f..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70992
Entropy (8bit):	5.988724830033017
Encrypted:	false
SSDEEP:	1536:WuOUkO0UXRiKvbVAc5xt3lGnmdYw+WXsA9iYzvyq9rHUq:rOUu3KvbVtxt1Gnmdt+WXsox9oq
MD5:	181C8F19F974AD8A84B8673D487BBF0D
SHA1:	0AAC45848510264AF4E754975AC24ED6D6A12A41
SHA-256:	CF92CA16F1A432EF0A03F2C920738CD13D007B41433AC1688B1F892611B0E344
SHA-512:	6391E9863EA4231FA892995944A0FC97537CF087FFD6D08FFDA2421D02C03740CB776BA19E37210B0ABEA41A1149F2BD04712871F3C4A8E56769046F4F1AC973
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=[.eS..eS..eS......eS......eS......eS..eR..eS......eS...-..eS......eS......eS.Rich.eS.................PE..L... .[J.....................................................................@......~+....@...... ......................................xW..............P....0..........................................@............................................text...f........................... ..`.data....(..........................@....rsrc...xW.......X..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14496
Entropy (8bit):	6.726375114475028
Encrypted:	false
SSDEEP:	384:79PVUR5kq6FWuFRe8ZpHIXvzGCJEy7ERCtK:UeT8iRIflE0K
MD5:	034CD0A95425744B3D1676EA2E62D6B5
SHA1:	4B875724F6AF0080C78E679D1FAD1AE389BA5202
SHA-256:	89BB77D4C32D6BC0F52DC1FEB60E4235A1BB6070B93AE11D2E9F299B6688B349
SHA-512:	E978B4ACBEE0F3D0A17B8403D07A79768A0586D62064678FE00D344967838CB2FE2CB838A178D7F9BD2FB9AE0F4108C46EFC4972A3BF93A3E2F4A0DA82ECDC4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.........."...0..............)... ...@....@.. ...............................8....`..................................)..O....@..................."...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ...............................................................0..s.........-.......(.........+9.......r...po....-"..r...po....,...r...p.o.........+...X....i2..-..r9..p(......o....(...............`f........(....*BSJB............v4.0.30319......l.......#~..x.......#Strings....H...p...#US.........#GUID...........#Blob...........G..........3..........................................................n.....n...N.<.........v.................n.....:.....S...........b.O...

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\WdfCoInstaller01009.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\is-BQ92G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\is-H5954.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1002728
Entropy (8bit):	7.9188668904013815
Encrypted:	false
SSDEEP:	24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
MD5:	246900CE6474718730ECD4F873234CF5
SHA1:	0C84B56C82E4624824154D27926DED1C45F4B331
SHA-256:	981A17EFFDDBC20377512DDAEC9F22C2B7067E17A3E2A8CCF82BB7BB7B2420B6
SHA-512:	6A9E305BFBFB57D8F8FD16EDABEF9291A8A97E4B9C2AE90622F6C056E518A0A731FBB3E33A2591D87C8E4293D0F983EC515E6A241792962257B82401A8811D5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............8............>....../.-....(.T....9......!......?......:....Rich...........PE..d.....[J.........." ................ {....................................................@.........................................@.......8...P....p.......`.......4..................................................................(............................text............................... ..`.data....:... ......................@....pdata.......`....... ..............@..@.rsrc........p.......*..............@..@.reloc..D............0..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\amd64\winusbcoinstaller2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1002728
Entropy (8bit):	7.9188668904013815
Encrypted:	false
SSDEEP:	24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
MD5:	246900CE6474718730ECD4F873234CF5
SHA1:	0C84B56C82E4624824154D27926DED1C45F4B331
SHA-256:	981A17EFFDDBC20377512DDAEC9F22C2B7067E17A3E2A8CCF82BB7BB7B2420B6
SHA-512:	6A9E305BFBFB57D8F8FD16EDABEF9291A8A97E4B9C2AE90622F6C056E518A0A731FBB3E33A2591D87C8E4293D0F983EC515E6A241792962257B82401A8811D5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............8............>....../.-....(.T....9......!......?......:....Rich...........PE..d.....[J.........." ................ {....................................................@.........................................@.......8...P....p.......`.......4..................................................................(............................text............................... ..`.data....:... ......................@....pdata.......`....... ..............@..@.rsrc........p.......*..............@..@.reloc..D............0..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\dfu.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	7.006601080301474
Encrypted:	false
SSDEEP:	192:MzeS64ecuOquECw7R/7ClxiXNUz4mhTHez3a58wBjtlAcsdyMbH:Mk0w0lUXNbmV+1OUcsowH
MD5:	DC1584015B8581E45E657A480AEF3716
SHA1:	4EFF6B115944D179FED7FDFD52AD9C6AEA2DCDCF
SHA-256:	CC8D83C066AC5FCF328D740C9C0FC11513086BA8B3EDFAED0A61AA3FDFC03CFF
SHA-512:	53DC9CA367B6271900D9866EAD9FB8E41CDF2EF3ADB97635030E910D4693B93D3F4F03FAAEFBC4BA4E46E84173626EC625569BE17C60A0197B63CEE8E2AB2575
Malicious:	false
Preview:	0.$...*.H........$.0.$....1.0...+......0.....+.....7......0...0...+.....7.....N......N.zL\.d.?..151203093615Z0...+.....7.....0../0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......T2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.6...4...0....R7.D.6.6.5.D.6.4.A.9.2.3.F.D.5.C.1.C.C.7.A.2.A.8.B.4.8.E.4.A.6.3.C.0.6.D.A.E.F.A...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+........}f]d.#.\.....Jc.m..0P..+.....7...1B0@...F.i.l.e........w.i.n.u.s.b.c.o.i.n.s.t.a.l.l.e.r.2...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\dfu.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	5.20707595666741
Encrypted:	false
SSDEEP:	192:1jy1KDyCghvj8WkBiPlPoN+Dv+cIomec9RZox51vi+t63mxJt:1jyeyfhL8WkEaN0v+coeSRZox3v/t6Wt
MD5:	13EA19BD5F12583AF168B178AC8B2B63
SHA1:	E417558CF0469E02B524AE99B00866F3DF8FF433
SHA-256:	469A16F5144D133C36389B47903BDD99A2DCB1278736EF0A4D8DA6048797944A
SHA-512:	3E6621C69303154909102A43047D9638CB419A1504590A0184422A4D4B5D0A72FE0EAFA3970F2BF3D4F39A2D59396BF2AA68780AFEF9977B3CB7F30F2D28D0EF
Malicious:	false
Preview:	; ======== libusb 1.0 (WinUSB) device driver ==========..;..; To customize this inf file for your own device..;..; 1. Change "DeviceName" with the name you want your device to appear with ..; on your system...;..; 2. Change "VendorID" and "ProductID" according to those of your device. ..; If your device is plugged in, you can retrieve these values through the ..; Device Manager (regardless of whether the driver is installed or not)...;..; 3. Change "DeviceGUID" to a value that is unique on your system. For more ..; information and tools to help you generate your own GUIDs, see ..; http://en.wikipedia.org/wiki/Universally_Unique_Identifier...;..; 4. Change "DeviceClassGUID" to reflect your USB Device Class. ..; The following Device Classes are listed for reference:..; {745a17a0-74d3-11d0-b6fe-00a0c90f57da} : HID device..; {78a1c341-4539-11d3-b88d-00c04fad5171} : Generic WinUSB device..;..; 5. (Optional) Change the "Date" string...;..; Note 1: if you need to creat

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\is-10AF7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	5.20707595666741
Encrypted:	false
SSDEEP:	192:1jy1KDyCghvj8WkBiPlPoN+Dv+cIomec9RZox51vi+t63mxJt:1jyeyfhL8WkEaN0v+coeSRZox3v/t6Wt
MD5:	13EA19BD5F12583AF168B178AC8B2B63
SHA1:	E417558CF0469E02B524AE99B00866F3DF8FF433
SHA-256:	469A16F5144D133C36389B47903BDD99A2DCB1278736EF0A4D8DA6048797944A
SHA-512:	3E6621C69303154909102A43047D9638CB419A1504590A0184422A4D4B5D0A72FE0EAFA3970F2BF3D4F39A2D59396BF2AA68780AFEF9977B3CB7F30F2D28D0EF
Malicious:	false
Preview:	; ======== libusb 1.0 (WinUSB) device driver ==========..;..; To customize this inf file for your own device..;..; 1. Change "DeviceName" with the name you want your device to appear with ..; on your system...;..; 2. Change "VendorID" and "ProductID" according to those of your device. ..; If your device is plugged in, you can retrieve these values through the ..; Device Manager (regardless of whether the driver is installed or not)...;..; 3. Change "DeviceGUID" to a value that is unique on your system. For more ..; information and tools to help you generate your own GUIDs, see ..; http://en.wikipedia.org/wiki/Universally_Unique_Identifier...;..; 4. Change "DeviceClassGUID" to reflect your USB Device Class. ..; The following Device Classes are listed for reference:..; {745a17a0-74d3-11d0-b6fe-00a0c90f57da} : HID device..; {78a1c341-4539-11d3-b88d-00c04fad5171} : Generic WinUSB device..;..; 5. (Optional) Change the "Date" string...;..; Note 1: if you need to creat

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\is-DO317.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	7.006601080301474
Encrypted:	false
SSDEEP:	192:MzeS64ecuOquECw7R/7ClxiXNUz4mhTHez3a58wBjtlAcsdyMbH:Mk0w0lUXNbmV+1OUcsowH
MD5:	DC1584015B8581E45E657A480AEF3716
SHA1:	4EFF6B115944D179FED7FDFD52AD9C6AEA2DCDCF
SHA-256:	CC8D83C066AC5FCF328D740C9C0FC11513086BA8B3EDFAED0A61AA3FDFC03CFF
SHA-512:	53DC9CA367B6271900D9866EAD9FB8E41CDF2EF3ADB97635030E910D4693B93D3F4F03FAAEFBC4BA4E46E84173626EC625569BE17C60A0197B63CEE8E2AB2575
Malicious:	false
Preview:	0.$...*.H........$.0.$....1.0...+......0.....+.....7......0...0...+.....7.....N......N.zL\.d.?..151203093615Z0...+.....7.....0../0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......T2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.6...4...0....R7.D.6.6.5.D.6.4.A.9.2.3.F.D.5.C.1.C.C.7.A.2.A.8.B.4.8.E.4.A.6.3.C.0.6.D.A.E.F.A...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+........}f]d.#.\.....Jc.m..0P..+.....7...1B0@...F.i.l.e........w.i.n.u.s.b.c.o.i.n.s.t.a.l.l.e.r.2...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\WdfCoInstaller01009.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-5KKTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\is-NEGFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851176
Entropy (8bit):	7.909169105397521
Encrypted:	false
SSDEEP:	12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
MD5:	8E7B9F81E8823FEE2D82F7DE3A44300B
SHA1:	1633B3715014C90D1C552CD757EF5DE33C161DEE
SHA-256:	EBE3B7708DD974EE87EFED3113028D266AF87CA8DBAE77C47C6F7612824D3D6C
SHA-512:	9AE37B2747589A0EB312473D895EF87404F4A395A27E15855826A75B4711EA934CA9A2B289DF0ABE0A8825DEC2D5654A0B1603CF0B039FE25662359B730CE1A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g$'..Jt..Jt..Jt.~.t..Jt..Ktw.Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..JtRich..Jt........PE..L...[.[J...........!.................n....................................... ......at....@.....................................P....@..............................................................PR..@............................................text...x........................... ..`.data..../..........................@....rsrc........@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\dfu\x86\winusbcoinstaller2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851176
Entropy (8bit):	7.909169105397521
Encrypted:	false
SSDEEP:	12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
MD5:	8E7B9F81E8823FEE2D82F7DE3A44300B
SHA1:	1633B3715014C90D1C552CD757EF5DE33C161DEE
SHA-256:	EBE3B7708DD974EE87EFED3113028D266AF87CA8DBAE77C47C6F7612824D3D6C
SHA-512:	9AE37B2747589A0EB312473D895EF87404F4A395A27E15855826A75B4711EA934CA9A2B289DF0ABE0A8825DEC2D5654A0B1603CF0B039FE25662359B730CE1A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g$'..Jt..Jt..Jt.~.t..Jt..Ktw.Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..Jt.~.t..JtRich..Jt........PE..L...[.[J...........!.................n....................................... ......at....@.....................................P....@..............................................................PR..@............................................text...x........................... ..`.data..../..........................@....rsrc........@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-279IB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1373
Entropy (8bit):	7.20424378608028
Encrypted:	false
SSDEEP:	24:NoL3I7JWodfcMI17PcbQ9alMvNqZyQdjMBqHi9YCErGq1gb2QwVbD:uoWVzuXlMUZ5g8Hi9/b2zp
MD5:	197460A709D4F4C8FAC4B9E332205434
SHA1:	007790F6561DAD89B0BCD85585762495E358F8A5
SHA-256:	582DC1D97A790EF04FE2567B1EC88C26B03BF6E99937CAE6A0B50397AD20BBF8
SHA-512:	0B797DC9F107B3CA7EEBDBED7438B3616DF5F61D41B3BA35E6B65797E1D044E13A92CDED42408D844829CF3F791353D473DC0B88F791DF39A641779738DBB43D
Malicious:	false
Preview:	0..Y0..A.......=x..vI`.a}....0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...131210000000Z..231209235959Z0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0.."0...*.H.............0..............,.....h.Q`.q..G..XM#bj..Z.Q....wh..6./!P..._'N....p...\.N........rT...D.R.?A<.J...9.S.!........Xj...=6....$..{.1-=n..B.Ka._.p..}..a.x.h...x....UGS.2..F@....S..[.5W..ba ..0w$.Mb...{h.1.e.....5.+ojr\`.....^.VR.H....}./...8...F.......Z8...........0...0/..+........#0!0...+.....0...http://s2.symcb.com0...U.......0.......0l..U. .e0c0a..`.H...E....0R0&..+.........http://www.symauth.com/cps0(..+.......0...http://www.symauth.com/rpa00..U...)0'0%.#.!..http://s1.symcb.com/pca3-g5.crl0...U.%..0...+.........+.......0...U...........0)..U..."0

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-6D6F7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	7.273533319364418
Encrypted:	false
SSDEEP:	24:u6MIKxMMdMs7qYXPJrQuGTt/JOVTTl8Wihs+MTFqYfEEV88I0vJTXL4z4+m:Fu3rXPJrQ1t/JOUWihVnYcEV88I0vlLN
MD5:	DB3D5DF8F50C1F1795007746C5A163A6
SHA1:	EADBF58D2EBB8C7BDA465871094FD6DB2D41820B
SHA-256:	FDEFA0DCF6C751836ABC3902D4C1A5C47F23A47E350D8C24D4B009549298FB87
SHA-512:	FE1676D1F3311FA8CF8A882C8C4A575BC34AFC65CBC6518C1DD370ADC5E75E524BD4F9ECAE039E2C85F86F10E14B4AE1BE2A7BE72FB5DE57AB2D617437CB0925
Malicious:	false
Preview:	0...0.........L./<.]K.g]..9{.30....H........0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0...151104000000Z..181103235959Z0v1.0...U....US1.0...U....Texas1.0...U....Austin1"0 ..U....Silicon Laboratories Inc.1"0 ..U....Silicon Laboratories Inc.0.."0....H.............0.........=..\|....;N..z..(.".....D..t...Qq.H..B+i8D.{..Z....Ra$.g..@..(......Y.R..6s..a.D5.7CX..j..n..\|..>.... ...2%S..i..^..^v..-X.e....68...M.9....F..3...oZ.WHa.vX........I........M.......&)..R....j:.{.................r..g.[......KO1...U....l\\;.i..........b0..^0...U....0.0...U...........0+..U...$0"0 ......http://sv.symcb.com/sv.crl0f..U. ._0]0[..`.H...E....0L0#..+.........https://d.symcb.com/cps0%..+.......0...https://d.symcb.com/rpa0...U.%..0...+.......0W..+........K0I0...+.....0...http://sv.symcd.com0&..+.....0...http://sv.symcb.com/sv.crt0...U.#..0....;S.y3..}...+....rf0...U......G.'.G..qy.#.(..A..!.0....H.............@

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-ADA36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.300882497090982
Encrypted:	false
SSDEEP:	192:TcuECw7R/7ClxiXNUz4mhTHez3a58wBjtlAcGMyp:7w0lUXNbmV+1OUc3yp
MD5:	C24030B20BA29BD65B4B33671D1441C0
SHA1:	B8C368A33A7BF40EA3CF65228963222634B092A7
SHA-256:	8412F22DBEA0783C61B451C33E923E76D821E665607D6C2E53C66B088082089C
SHA-512:	E8BA700C169DC48CE5B4FF2A467D196E7E8D7544E435375F89EB75469041AB355D4C592E4B8BD6B41D1C21420D5EBC598CC915EA83AC5991C2EEFB5412338F7C
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7.....r0..n0...+.....7............K.7..p.....151203093615Z0...+.....7.....0...0....R8.C.0.7.B.0.0.1.0.9.5.C.C.7.E.0.6.5.1.B.A.B.5.6.1.0.9.1.E.6.6.C.3.6.7.2.7.E.1.F...1..g0>..+.....7...100....F.i.l.e........u.s.b.s.e.r.i.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............\..e..V...l6r~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......T2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.6...4......d0..`0....+.....7......0.....O.S.........X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.8.X.8.6.,.8.X.6.4.,._.v.6.3.,._.v.6.3._.X.6.4.,.1.0.X.8.6.,.1.0.X.6.4...0P..+.....7....B0@...H.W.I.D.2.......,u.s.b.\.v.i.d._.2.4.5.8.&.p.i.d._.0.0.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.2.4.5.8.&.p.i.d._.f.f.f.e.......0...0.........L./<.]K.g]..9{.30....H........0.1.0...U.

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\is-B69TL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	4.971971722062244
Encrypted:	false
SSDEEP:	48:C6DDN+cFEIwF3NR33FAQoXNng33GeAQGTkb6CZSWoKDfWYNy4zSQ:C2DN76tTHv4uHGaT6GSWoKSY
MD5:	741C048DCEF491BF713999951B4B16F4
SHA1:	0E707096405BDAF7FAA27AF9F8E586D9C5D7DF23
SHA-256:	187CF2B52CBE8A206B0CD1F56B195AF0B255D06D6AD1A848414E57EF644FFC01
SHA-512:	0B1BF03B752A58BF9879FC8CEF7355B8F9FAC835A2BD6C114F0B2F5135F903FBCF4358AAE7DC068E9A7E8D3E674756D842E22F9CF179D4BECE5054331D378BEE
Malicious:	false
Preview:	.; Windows USB CDC ACM Setup File.; Copyright (c) 2000 Microsoft Corporation.; Copyright (C) 2010 Bluegiga..[Version] .Signature="$Windows NT$" .Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318} .Provider=%MFGNAME% .LayoutFile=layout.inf.CatalogFile=usbserial.cat.DriverVer=12/03/2015,5.1.2600.0..[Manufacturer] .%MFGNAME%=DeviceList, NTamd64..[DestinationDirs] .DefaultDestDir=12 ..[DefaultInstall]. CopyINF=usbserial.inf..;------------------------------------------------------------------------------.; Windows 2000/XP/Vista-32bit Sections.;------------------------------------------------------------------------------..[DriverInstall.nt] .include=mdmcpq.inf.CopyFiles=DriverCopyFiles.nt.AddReg=DriverInstall.nt.AddReg ..[DriverCopyFiles.nt].usbser.sys,,,0x20..[DriverInstall.nt.AddReg] .HKR,,DevLoader,,*ntkern .HKR,,NTMPDriver,,%DRIVERFILENAME%.sys .HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider" ..[DriverInstall.nt.Services] .AddService=usbser, 0x00000002, Driver

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\siliconLabs.cer (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	7.273533319364418
Encrypted:	false
SSDEEP:	24:u6MIKxMMdMs7qYXPJrQuGTt/JOVTTl8Wihs+MTFqYfEEV88I0vJTXL4z4+m:Fu3rXPJrQ1t/JOUWihVnYcEV88I0vlLN
MD5:	DB3D5DF8F50C1F1795007746C5A163A6
SHA1:	EADBF58D2EBB8C7BDA465871094FD6DB2D41820B
SHA-256:	FDEFA0DCF6C751836ABC3902D4C1A5C47F23A47E350D8C24D4B009549298FB87
SHA-512:	FE1676D1F3311FA8CF8A882C8C4A575BC34AFC65CBC6518C1DD370ADC5E75E524BD4F9ECAE039E2C85F86F10E14B4AE1BE2A7BE72FB5DE57AB2D617437CB0925
Malicious:	false
Preview:	0...0.........L./<.]K.g]..9{.30....H........0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0...151104000000Z..181103235959Z0v1.0...U....US1.0...U....Texas1.0...U....Austin1"0 ..U....Silicon Laboratories Inc.1"0 ..U....Silicon Laboratories Inc.0.."0....H.............0.........=..\|....;N..z..(.".....D..t...Qq.H..B+i8D.{..Z....Ra$.g..@..(......Y.R..6s..a.D5.7CX..j..n..\|..>.... ...2%S..i..^..^v..-X.e....68...M.9....F..3...oZ.WHa.vX........I........M.......&)..R....j:.{.................r..g.[......KO1...U....l\\;.i..........b0..^0...U....0.0...U...........0+..U...$0"0 ......http://sv.symcb.com/sv.crl0f..U. ._0]0[..`.H...E....0L0#..+.........https://d.symcb.com/cps0%..+.......0...https://d.symcb.com/rpa0...U.%..0...+.......0W..+........K0I0...+.....0...http://sv.symcd.com0&..+.....0...http://sv.symcb.com/sv.crt0...U.#..0....;S.y3..}...+....rf0...U......G.'.G..qy.#.(..A..!.0....H.............@

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\symantec.cer (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1373
Entropy (8bit):	7.20424378608028
Encrypted:	false
SSDEEP:	24:NoL3I7JWodfcMI17PcbQ9alMvNqZyQdjMBqHi9YCErGq1gb2QwVbD:uoWVzuXlMUZ5g8Hi9/b2zp
MD5:	197460A709D4F4C8FAC4B9E332205434
SHA1:	007790F6561DAD89B0BCD85585762495E358F8A5
SHA-256:	582DC1D97A790EF04FE2567B1EC88C26B03BF6E99937CAE6A0B50397AD20BBF8
SHA-512:	0B797DC9F107B3CA7EEBDBED7438B3616DF5F61D41B3BA35E6B65797E1D044E13A92CDED42408D844829CF3F791353D473DC0B88F791DF39A641779738DBB43D
Malicious:	false
Preview:	0..Y0..A.......=x..vI`.a}....0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...131210000000Z..231209235959Z0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0.."0...*.H.............0..............,.....h.Q`.q..G..XM#bj..Z.Q....wh..6./!P..._'N....p...\.N........rT...D.R.?A<.J...9.S.!........Xj...=6....$..{.1-=n..B.Ka._.p..}..a.x.h...x....UGS.2..F@....S..[.5W..ba ..0w$.Mb...{h.1.e.....5.+ojr\`.....^.VR.H....}./...8...F.......Z8...........0...0/..+........#0!0...+.....0...http://s2.symcb.com0...U.......0.......0l..U. .e0c0a..`.H...E....0R0&..+.........http://www.symauth.com/cps0(..+.......0...http://www.symauth.com/rpa00..U...)0'0%.#.!..http://s1.symcb.com/pca3-g5.crl0...U.%..0...+.........+.......0...U...........0)..U..."0

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\usbserial.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.300882497090982
Encrypted:	false
SSDEEP:	192:TcuECw7R/7ClxiXNUz4mhTHez3a58wBjtlAcGMyp:7w0lUXNbmV+1OUc3yp
MD5:	C24030B20BA29BD65B4B33671D1441C0
SHA1:	B8C368A33A7BF40EA3CF65228963222634B092A7
SHA-256:	8412F22DBEA0783C61B451C33E923E76D821E665607D6C2E53C66B088082089C
SHA-512:	E8BA700C169DC48CE5B4FF2A467D196E7E8D7544E435375F89EB75469041AB355D4C592E4B8BD6B41D1C21420D5EBC598CC915EA83AC5991C2EEFB5412338F7C
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7.....r0..n0...+.....7............K.7..p.....151203093615Z0...+.....7.....0...0....R8.C.0.7.B.0.0.1.0.9.5.C.C.7.E.0.6.5.1.B.A.B.5.6.1.0.9.1.E.6.6.C.3.6.7.2.7.E.1.F...1..g0>..+.....7...100....F.i.l.e........u.s.b.s.e.r.i.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............\..e..V...l6r~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0z..+.....7...1l0j...O.S.A.t.t.r.......T2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.6...4......d0..`0....+.....7......0.....O.S.........X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.8.X.8.6.,.8.X.6.4.,._.v.6.3.,._.v.6.3._.X.6.4.,.1.0.X.8.6.,.1.0.X.6.4...0P..+.....7....B0@...H.W.I.D.2.......,u.s.b.\.v.i.d._.2.4.5.8.&.p.i.d._.0.0.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.2.4.5.8.&.p.i.d._.f.f.f.e.......0...0.........L./<.]K.g]..9{.30....H........0.1.0...U.

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\bled112\usbserial.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	4.971971722062244
Encrypted:	false
SSDEEP:	48:C6DDN+cFEIwF3NR33FAQoXNng33GeAQGTkb6CZSWoKDfWYNy4zSQ:C2DN76tTHv4uHGaT6GSWoKSY
MD5:	741C048DCEF491BF713999951B4B16F4
SHA1:	0E707096405BDAF7FAA27AF9F8E586D9C5D7DF23
SHA-256:	187CF2B52CBE8A206B0CD1F56B195AF0B255D06D6AD1A848414E57EF644FFC01
SHA-512:	0B1BF03B752A58BF9879FC8CEF7355B8F9FAC835A2BD6C114F0B2F5135F903FBCF4358AAE7DC068E9A7E8D3E674756D842E22F9CF179D4BECE5054331D378BEE
Malicious:	false
Preview:	.; Windows USB CDC ACM Setup File.; Copyright (c) 2000 Microsoft Corporation.; Copyright (C) 2010 Bluegiga..[Version] .Signature="$Windows NT$" .Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318} .Provider=%MFGNAME% .LayoutFile=layout.inf.CatalogFile=usbserial.cat.DriverVer=12/03/2015,5.1.2600.0..[Manufacturer] .%MFGNAME%=DeviceList, NTamd64..[DestinationDirs] .DefaultDestDir=12 ..[DefaultInstall]. CopyINF=usbserial.inf..;------------------------------------------------------------------------------.; Windows 2000/XP/Vista-32bit Sections.;------------------------------------------------------------------------------..[DriverInstall.nt] .include=mdmcpq.inf.CopyFiles=DriverCopyFiles.nt.AddReg=DriverInstall.nt.AddReg ..[DriverCopyFiles.nt].usbser.sys,,,0x20..[DriverInstall.nt.AddReg] .HKR,,DevLoader,,*ntkern .HKR,,NTMPDriver,,%DRIVERFILENAME%.sys .HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider" ..[DriverInstall.nt.Services] .AddService=usbser, 0x00000002, Driver

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52576016
Entropy (8bit):	7.99959543524509
Encrypted:	true
SSDEEP:	1572864:oejHIAVYjEcHMywdDhbHhpM3Puu03Fq3gx:1jV8M/HhS3PwVqI
MD5:	80CD452760F89BFE92B859FB620F1653
SHA1:	87AAAE7A6BD33D3300C1092C36328005E419ACB2
SHA-256:	6E49CE9062F7F64D99ED3C7E6A74034A8BACB8D823E482A2A529EDF1C712E935
SHA-512:	E3E52096D09782B35D6DFE15C8ED8EED978D7DEF198696F2E6F3CE7C83E7526B5E74955DE2CA68AE94BBBD6C1D01D4FAF2F4A5252C1E7C99B0746E2716A0A8E5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa.....................\|....................@..........................`........#...@.................................<...........,;..........@."..(... ...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...,;.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1040384
Entropy (8bit):	5.58931279487482
Encrypted:	false
SSDEEP:	6144:usSOzpPId26dQcEaUrPvwgwkRVagRoDHTj8K1sqI6VLp4XOigSbduP/1HHm/hHAe:KIId79EaUTvwieMozMEcOigSpuPMaLi
MD5:	4192A5B905374E423EC1E545599AA86E
SHA1:	908C09DE28BB3CC09601DA5D4E1F44BECC9DF18F
SHA-256:	567F40A09F1D9E72396296AD194FA7CF48B72361D6E259D6B99DA774C2CD8981
SHA-512:	33A3C8E6565FB88F5CC72CFAA553BB0DDB654A8721F356E542C0346468357D38913DB03D5035BCF2C45254DF1BAF83CF3CDED55C5D22D677379A4D648A65500A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m...................................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-13VD6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14496
Entropy (8bit):	6.726375114475028
Encrypted:	false
SSDEEP:	384:79PVUR5kq6FWuFRe8ZpHIXvzGCJEy7ERCtK:UeT8iRIflE0K
MD5:	034CD0A95425744B3D1676EA2E62D6B5
SHA1:	4B875724F6AF0080C78E679D1FAD1AE389BA5202
SHA-256:	89BB77D4C32D6BC0F52DC1FEB60E4235A1BB6070B93AE11D2E9F299B6688B349
SHA-512:	E978B4ACBEE0F3D0A17B8403D07A79768A0586D62064678FE00D344967838CB2FE2CB838A178D7F9BD2FB9AE0F4108C46EFC4972A3BF93A3E2F4A0DA82ECDC4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.........."...0..............)... ...@....@.. ...............................8....`..................................)..O....@..................."...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ...............................................................0..s.........-.......(.........+9.......r...po....-"..r...po....,...r...p.o.........+...X....i2..-..r9..p(......o....(...............`f........(....*BSJB............v4.0.30319......l.......#~..x.......#Strings....H...p...#US.........#GUID...........#Blob...........G..........3..........................................................n.....n...N.<.........v.................n.....:.....S...........b.O...

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-AL0OI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1040384
Entropy (8bit):	5.58931279487482
Encrypted:	false
SSDEEP:	6144:usSOzpPId26dQcEaUrPvwgwkRVagRoDHTj8K1sqI6VLp4XOigSbduP/1HHm/hHAe:KIId79EaUTvwieMozMEcOigSpuPMaLi
MD5:	4192A5B905374E423EC1E545599AA86E
SHA1:	908C09DE28BB3CC09601DA5D4E1F44BECC9DF18F
SHA-256:	567F40A09F1D9E72396296AD194FA7CF48B72361D6E259D6B99DA774C2CD8981
SHA-512:	33A3C8E6565FB88F5CC72CFAA553BB0DDB654A8721F356E542C0346468357D38913DB03D5035BCF2C45254DF1BAF83CF3CDED55C5D22D677379A4D648A65500A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m...................................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-H9DJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70992
Entropy (8bit):	5.988724830033017
Encrypted:	false
SSDEEP:	1536:WuOUkO0UXRiKvbVAc5xt3lGnmdYw+WXsA9iYzvyq9rHUq:rOUu3KvbVtxt1Gnmdt+WXsox9oq
MD5:	181C8F19F974AD8A84B8673D487BBF0D
SHA1:	0AAC45848510264AF4E754975AC24ED6D6A12A41
SHA-256:	CF92CA16F1A432EF0A03F2C920738CD13D007B41433AC1688B1F892611B0E344
SHA-512:	6391E9863EA4231FA892995944A0FC97537CF087FFD6D08FFDA2421D02C03740CB776BA19E37210B0ABEA41A1149F2BD04712871F3C4A8E56769046F4F1AC973
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=[.eS..eS..eS......eS......eS......eS..eR..eS......eS...-..eS......eS......eS.Rich.eS.................PE..L... .[J.....................................................................@......~+....@...... ......................................xW..............P....0..........................................@............................................text...f........................... ..`.data....(..........................@....rsrc...xW.......X..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\is-JBLBK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52576016
Entropy (8bit):	7.99959543524509
Encrypted:	true
SSDEEP:	1572864:oejHIAVYjEcHMywdDhbHhpM3Puu03Fq3gx:1jV8M/HhS3PwVqI
MD5:	80CD452760F89BFE92B859FB620F1653
SHA1:	87AAAE7A6BD33D3300C1092C36328005E419ACB2
SHA-256:	6E49CE9062F7F64D99ED3C7E6A74034A8BACB8D823E482A2A529EDF1C712E935
SHA-512:	E3E52096D09782B35D6DFE15C8ED8EED978D7DEF198696F2E6F3CE7C83E7526B5E74955DE2CA68AE94BBBD6C1D01D4FAF2F4A5252C1E7C99B0746E2716A0A8E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa.....................\|....................@..........................`........#...@.................................<...........,;..........@."..(... ...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...,;.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110512
Entropy (8bit):	6.40110765981388
Encrypted:	false
SSDEEP:	3072:s30DYngGsrM56P5oL4jeEdu3G7Ex1tTqlR5bx:2nbsMIPSG44Tn
MD5:	92E65CD72CF9F57DEEAC5C0C4186A5BD
SHA1:	B187A4F6C84193D17FD79506206955DD6FABE897
SHA-256:	EF10850B31B3DBE9AD6CF8CB55FB1F81A60EA9C5C0694B4B94B283601EB17C20
SHA-512:	AE70051D857D1A7398FCED3E12EC708E5580D60A3E1A39E89F5FBAFCE7DA499D5D47ED8402DB5D21A0994354673C1EA82ACB5F7CEDD1703E3562EB378C3C7BBE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................v......v......v.......................$...............v..........Rich...................PE..L....y.^..........................................@.................................Y8....@..........................y..X....y...........................#...........\..T....................].......\..@............................................text...*........................... ..`.rdata..............................@..@.data................p..............@....rsrc................t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\is-98D8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18104255
Entropy (8bit):	7.999889206258629
Encrypted:	true
SSDEEP:	393216:7r5h9UbyfC/43ZP9jbTyt/EoglivqYNW8A+EJy7d1m0bn:7dhicCQZPJSEogl3YE8A+EJk1mIn
MD5:	2F8443D48AF26BA07A554BEFA46F142B
SHA1:	FF945CC1B1C5DC824589A4CAE0A675FAB89C91F4
SHA-256:	D20434F5B5E79F3E0A87A5819B15D13D9BB5F944E116B32063D5060618961EE0
SHA-512:	5DC2823B0C6DFB2B5CBCA5B3CBBAB869711531DD12478C5449832868F1C3F244BBF032D8F781787B1852220A3E2DD3DF2FD10F37CD2E77EE0A0D8C5377CD1D87
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@............@......@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18104255
Entropy (8bit):	7.999889206258629
Encrypted:	true
SSDEEP:	393216:7r5h9UbyfC/43ZP9jbTyt/EoglivqYNW8A+EJy7d1m0bn:7dhicCQZPJSEogl3YE8A+EJk1mIn
MD5:	2F8443D48AF26BA07A554BEFA46F142B
SHA1:	FF945CC1B1C5DC824589A4CAE0A675FAB89C91F4
SHA-256:	D20434F5B5E79F3E0A87A5819B15D13D9BB5F944E116B32063D5060618961EE0
SHA-512:	5DC2823B0C6DFB2B5CBCA5B3CBBAB869711531DD12478C5449832868F1C3F244BBF032D8F781787B1852220A3E2DD3DF2FD10F37CD2E77EE0A0D8C5377CD1D87
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@............@......@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.294677916497316
Encrypted:	false
SSDEEP:	24:qcelmCOwgjBN3hpK7JmEznNa8i0iDt3uKK4LUTOZJu9ZzBBL+ijr:qZOwqjChnNa8i0iD44LIriAr
MD5:	F501E8422A4C6E5A49F5A7503B2FFB92
SHA1:	8C18F347CF57959E4DD189A7D79464ED795064D6
SHA-256:	3F1E5CD8BC532C19595BBE03ECA04AB9CD8C33253DA80BCAAD88F27BEA660CFD
SHA-512:	5A6A2B1BC8425C36433576D4C7918A17194A29A07E8163AA02D9628EFCF5F1181C8E0A04F25D3C70F7467674A8CA797C6C475C25A145A69A01A9E146E3611E0E
Malicious:	false
Reputation:	unknown
Preview:	0...0...........!UW_....E....0....H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...120220122946Z..140220122946Z0~1.0...U....DE1.0...U....Bayern1.0...U....Haar1.0...U....Elatec GmbH1.0...U....Elatec GmbH1#0!...H........info-rfid@elatec.com0.."0....H.............0...........(.IB^'...~j..\..u:..........N.a....>w..}....,....`...[....'^G...l.Qz..+.......X.../5.."T...'W..).{9.D........'.S.T0.~o.j(V.f......~.BF.. <......./$.~.....".tZp....f.C`q/;..k.%..zp=......6m\|...q...0?9.....N:_.Oox..v.#.~+.n....;.0...L.....'........T0..P0...U...........0L..U. .E0C0A..+.....2.20402..+........&https://www.globalsign.com/repository/0...U....0.0...U.%..0...+.......0>..U...70503.1./.-http://crl.globalsign.com/gs/gscodesigng2.crl0P..+........D0B0@..+.....0..4http://secure.globalsign.com/cacert/gscodesigng2.crt0...U.......f.A.y...yL..H..8.0...U.#..0....n.....>..t].../Pz0....H.............*.].(.Nk3.M.._..ac...l.K...8...@#.'b....e...\|.

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\is-CFPTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.294677916497316
Encrypted:	false
SSDEEP:	24:qcelmCOwgjBN3hpK7JmEznNa8i0iDt3uKK4LUTOZJu9ZzBBL+ijr:qZOwqjChnNa8i0iD44LIriAr
MD5:	F501E8422A4C6E5A49F5A7503B2FFB92
SHA1:	8C18F347CF57959E4DD189A7D79464ED795064D6
SHA-256:	3F1E5CD8BC532C19595BBE03ECA04AB9CD8C33253DA80BCAAD88F27BEA660CFD
SHA-512:	5A6A2B1BC8425C36433576D4C7918A17194A29A07E8163AA02D9628EFCF5F1181C8E0A04F25D3C70F7467674A8CA797C6C475C25A145A69A01A9E146E3611E0E
Malicious:	false
Reputation:	unknown
Preview:	0...0...........!UW_....E....0....H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...120220122946Z..140220122946Z0~1.0...U....DE1.0...U....Bayern1.0...U....Haar1.0...U....Elatec GmbH1.0...U....Elatec GmbH1#0!...H........info-rfid@elatec.com0.."0....H.............0...........(.IB^'...~j..\..u:..........N.a....>w..}....,....`...[....'^G...l.Qz..+.......X.../5.."T...'W..).{9.D........'.S.T0.~o.j(V.f......~.BF.. <......./$.~.....".tZp....f.C`q/;..k.%..zp=......6m\|...q...0?9.....N:_.Oox..v.#.~+.n....;.0...L.....'........T0..P0...U...........0L..U. .E0C0A..+.....2.20402..+........&https://www.globalsign.com/repository/0...U....0.0...U.%..0...+.......0>..U...70503.1./.-http://crl.globalsign.com/gs/gscodesigng2.crl0P..+........D0B0@..+.....0..4http://secure.globalsign.com/cacert/gscodesigng2.crt0...U.......f.A.y...yL..H..8.0...U.#..0....n.....>..t].../Pz0....H.............*.].(.Nk3.M.._..ac...l.K...8...@#.'b....e...\|.

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\is-DKDRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\is-DPMRF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\twn4cdc.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\twn4cdc.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Users\user\AppData\Local\Temp\is-E3UT2.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E3UT2.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp

Download File

Process:	C:\Users\user\Desktop\2N Driver for External USB Readers.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3280384
Entropy (8bit):	6.3908107738377335
Encrypted:	false
SSDEEP:	49152:Hdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEj/333s8+f:MHDYsqiPRhINnq95FoHVB/333zK
MD5:	0EBFBF63EE915B391F691DB46B024A09
SHA1:	C6BCBB64CF2DD29D278D104C65965A49A1BCB939
SHA-256:	0FB7C8E941F58C93E1CC5E302A1E013B420E9393DA1543126F9E1AFE874C4E03
SHA-512:	BFE53D851D868A634868AA894938F63CE3A046C07F7BA28F979B4B83B85490D32C20E509CC00C765B7CAA32E17B0073BA3140C3F5489D65622433830352D614E
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................2...........@......@....................-.......-..9............................................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\SET773C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\SET774D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9C77.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9CA7.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9D25.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9D45.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\SET9D66.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\ZKFP.inf (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\libusb0.dll (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\libusb0_x64.dll (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\libusb0_x64.sys (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\zkfp.cat (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBEB5.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBEE5.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBEF5.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBFA2.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBFC2.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETBFF2.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC013.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC033.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC063.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC083.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC0A3.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\SETC0F2.tmp

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpD00701.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpD00701x64.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpI00701.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpI00701x64.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpK00701.sys (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpdevctl.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpdevctlx64.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpdevdat.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpdevdatx64.dll (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.cat (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.inf (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\usbdpfp.sys (copy)

Download File

Process:	C:\Windows\DPDrv\DPInst64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1028\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5611
Entropy (8bit):	6.235572422524166
Encrypted:	false
SSDEEP:	96:MToIgDsA9tfHP8+8nhM0WamzLdDF63vGNZ2mfGvsNn957jQUA9Q2Rd0E/sVbCtrE:HtfdT/dJ63vGNhgsNn9KDjtwv
MD5:	B9428C94444693B5E3A392C8D0B95170
SHA1:	0FB22D01F1C11CF74E844C19C96C41B1C0515D71
SHA-256:	C0413EDFD13FD27EEAB7B8CE60963668236466C48F4173C29F84093011C281AF
SHA-512:	70212889F8F8A070FBCC81EF6121999518F2BC7EF369E2A38B3F0F825870E88B9327F837DE884C52E6AC0A1C750F07121CD17EDC2E932C993C73A43275AC1180
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">............. 10 ...............? ......!</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">...</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ....

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1029\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6283
Entropy (8bit):	5.412515462910997
Encrypted:	false
SSDEEP:	96:MTXmBtOxxHOy/9xLfpZJYFZq5y5PBF1ONWo21jvaljZ+5Eh27LWAozGbRfXd:cMIxHOy/95JAQ4dONnUjvWjHWXd
MD5:	27411946EF45B3B8236319421770E5AD
SHA1:	D00D3E2D4FA3429F2578325DE364DFCCE51D8FD4
SHA-256:	C92D3EFD72D6D14148F9931128EE4143AFFD1DA517EB358AB88ED4138C1434A4
SHA-512:	FF24B47504D6E752F1FA5BD388DA75338078F72B5D17094D2BC9426B35A55DE097629C3EC53356723253A8D7373DCB2B2D921BDF0BE6FD4A524C9AA8913277EB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instala.n. program pro [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Pot.ebujete jenom prost.ed., textov. editor a 10 minut .asu.....Jste p.ipraveni? Dejme se tedy do toho!</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">P.edchoz. verze</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz.

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1031\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6321
Entropy (8bit):	5.144950913547635
Encrypted:	false
SSDEEP:	96:MT4UlN7xSbu0N8+08Yp6VaSGjOjB5gBUOzM0vLjCcTcu+MbRk6:2wrzY6xGjOjrQgqCU7
MD5:	B45249A2238A5568B377E58D4CE89E9A
SHA1:	57A68133AF7EF4062559D9144D9CDA4AA28722FB
SHA-256:	0C4203A81DCD01D53378036AF78CFFCF9E9A5AF7754DFBDD56584AE74C21CC61
SHA-512:	6485548B9F4E0CDBD2876B0FC4DCA5C125D260E237E994EE67823EDC72C358CDAD4E1170DF62E67A0D1249F54EE6BEA26741CBF8EAFE952154E182008F31665B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Sie ben.tigen nur eine Shell, einen Text-Editor und 10 Minuten Zeit.....Bereit? Los geht's!</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Vorherige Version</String>.. <String Id="HelpHeader">Hilfe zum Setup</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen a

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1033\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5714
Entropy (8bit):	5.130490122689639
Encrypted:	false
SSDEEP:	96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
MD5:	D5070CB3387A0A22B7046AE5AB53F371
SHA1:	BC9DA146A42BBF9496DE059AC576869004702A97
SHA-256:	81A68046B06E09385BE8449373E7CEB9E79F7724C3CF11F0B18A4489A8D4926A
SHA-512:	8FCF621FB9CE74725C3712E06E5B37B619145078491E828C6069E153359DE3BD5486663B1FA6F3BCF1C994D5C556B9964EA1A1355100A634A6C700EF37D381E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">You just need a shell, a text editor and 10 minutes of your time.....Ready? Set? Let's go!</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Previous version</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1036\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6389
Entropy (8bit):	5.15785538021277
Encrypted:	false
SSDEEP:	96:MTCB7IPd14H1/qt2D7HF9+XLjMYjMEy+YvIsrLQ5k4vbfV+o:Tnt7HF9+7jjjDr
MD5:	9F779700FF90DF7211AE3A3340DDD5FC
SHA1:	A4E05D7A489B095AF4805660D7BAB4F2DA3AF34C
SHA-256:	6AF5C2BC88B1E5CE188A97DD9204061D66369EC2689B3657AFF1DC6188F44F22
SHA-512:	5DCA90FDB1B498BC982CC8489DD13ED492A7856B701D9FB43D46EF01D40B49D9888E7AC35BB5962DCF72241F05A4E006130F94372A7C4D7542B708E71B0663A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Programme d'installation de [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Vous avez juste besoin d'un interpr.teur de commandes, d'un .diteur de texte et de 10.minutes...... vos marques.? Pr.t.? Partez.!</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler ?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Version pr.c.dente</String>.. <String Id="HelpHeader">Aide . l'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [r.pertoire] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du bundle dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface utilisateur minimale, sans invite, ou n'affiche .. ni interface utilisate

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1040\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6153
Entropy (8bit):	5.08027497707843
Encrypted:	false
SSDEEP:	96:MTawWwvw8WutJ/s9FwNNN7Nf9DW+IuhUjH9e5jx9S/l7LthZ/dDLbxDPnH:XYpnhFpCjH9e5jUDDRbnH
MD5:	347BE63418F507E7F2A086726E96FCA8
SHA1:	E42E9EBFA654134CF243841BEED2370BA12A627D
SHA-256:	344ACD0D3665BA489EB30EBC0F902C625E1AD33A4E2B5BA7CDD7E463658D5557
SHA-512:	3BBA2E5A3F5407274EDDB076702E640646DFC7EF43AD9F08C05E99F0ECCA67E6F9DE2DBE4E3743A74107165B935D36C979CEE23A22ADCF6139D5BEC47B541325
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Programma di installazione di [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Bastano solo una shell, un editor di testo e 10 minuti di tempo.....Pronti per iniziare?</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Versione precedente</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita, viene visualizzata l'inte

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1041\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7130
Entropy (8bit):	5.924193901706645
Encrypted:	false
SSDEEP:	96:MTAiXgh+RNmvFo6bnpojeTPk0B/vueX5OA1yag81TCkHdGW2jK+bQaBU7jCfFq/F:hsJgD1D8rag81TCgdGfjK+dMX
MD5:	E5FD798D4BBDD419A602423A699E2854
SHA1:	2ECE478D5CE4DE0C0A864F14CEA6BD365F008D81
SHA-256:	00AEC52B4564BC07302881FCFD510F7CCA535AC9E05CFD95A86738171626F6C4
SHA-512:	AB3B93B635211F112D8D820861FE77E9D7C67018688A6A2A1B82532EA9A97609F02E7E9B0DC658202CE0441554A3CB2622F6EDC61456E0D250AA8F3DF4BCBBF5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">.............. ............ 10 ....................</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">........</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .................................................. ..................

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1042\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6175
Entropy (8bit):	6.0499722174257835
Encrypted:	false
SSDEEP:	96:MTFzghDJJCsgqf6YVgo4uU5VqI54U5TLzpDcmUUcdIoa/2GU/tiLAWw/zRPCEbtn:SgaXdusEAzxhUPjD/zFCK
MD5:	F59A0369A337B58A797DDBB5EBBDCADC
SHA1:	4E6C9501ED901B5C1D4B6713A632E899D223679B
SHA-256:	1B1B0700AA6677AFE3581B8B3F4934BF85F4750C544A108E1D5F1B688078E1CF
SHA-512:	B12134295DDDF5FC4F63E23C98C837AA02E5FCFF5191087FDC7C0B044F472487987966282B8955421DBFD480707305E0E7AF65F307655F876615AB36C24786B8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] .. ...</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">., ... ..., 10.. ... ... ..............? .....!</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.. ..</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... .....

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1045\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	6421
Entropy (8bit):	5.347808263199206
Encrypted:	false
SSDEEP:	96:MT3REmXsPGriQBu2uOI9qUyH42TqU5uKZKezbJFGeZzL5YY1oui1ebf4yA:WRE9PGromUy/eU0KZKQbCBr
MD5:	8CFBEE02F1C88567CD9AA747FF27182E
SHA1:	ED18F294EC1E36629900DB42797F1499DB080F4F
SHA-256:	D92B3838DE7A1685CCBD04FC9C123704FBD198BFD284D8FAECE4A3663494E75A
SHA-512:	63C53C29382BADB2AECFB67284755CAE978AF114F957A1B3466B91DE8559D6DD4B2BD4B993589E3AD25AB316E90D2C99479A4589057DC8B80C88BB552E7EA519
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator pakietu [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Potrzebujemy tylko pow.oki, edytora tekstu i 10 minut czasu.....Wszystko gotowe? Zaczynamy!</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Poprzednia wersja</String>.. <String Id="HelpHeader">Pomoc dotycz.ca instalacji</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wi

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1046\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6068
Entropy (8bit):	5.196129338199214
Encrypted:	false
SSDEEP:	96:MTfBWJal2UsdMPWFdj5VvvQjZ+zyhomLQ8zbG2zWHA:PgS+WH1VvvQKpHg
MD5:	88CB193F0B0C15023D789E0F8FCE3E03
SHA1:	38E1390A410D751C6376F5E23A0933FA08C8AEC5
SHA-256:	4D6A2D306ABE77E7DBDB2609F6198B4CF99B3F9DC15B9DC72951592AD2F64384
SHA-512:	B894E05C79C95D03481211DE8FCDE00D79767AD3B3483AC95D8B16421D719473D7A9829D996B60EC1ABC3830048FEEA1CF49BACAAA3ADDA0DFD5971EC2EA5F1A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalador do [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Voc. s. precisa de um shell, um editor de texto e 10 minutos de seu tempo.....Tudo pronto? Ent.o, vamos nessa!</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Vers.o anterior</String>.. <String Id="HelpHeader">Ajuda de Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio] - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a interface do usu.rio m.nima sem nenhum prompt ou n.o exibe nenhuma interface do usu.rio e.. nenhum prompt. Por padr.o, a interface do usu.rio e t

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1049\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8007
Entropy (8bit):	5.451843005546111
Encrypted:	false
SSDEEP:	96:MTdqIIgo/hyoJ88k193iFXfVvsuiu+q503Gl75N7JRgbGz5bVTxXh:Z/9ZyiFXfVkuiu+fWhwQD
MD5:	1D628F2E1DBAA25BDD8CF2D7F2A9CAF2
SHA1:	5C4F2A69772A20088779E7288FB37CFB6EAF4C42
SHA-256:	C7CC8E0BDD4F82DA33984F553B576412DF69C5E1E5B8479542D024CB6B41D050
SHA-512:	F6D3969F48B42A2F6EED8EFDA3A9EB5F5D9A4B69C6039BD7EB72CDB1E01B2C69DC4BECAA8133B7DDD7A6325CBB17BC56FB11BAFA7FADFD1AFA9A84B6FE3CA0EC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">.......... [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">... ......... ...... ........, ......... ........ . 10...... ..................? ..... ........!</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.......... ......</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] . ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\1055\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6154
Entropy (8bit):	5.342211356119282
Encrypted:	false
SSDEEP:	96:MTIKh5C6PHcIflKNTNgdq91GKbl7zjKjJUSyJpx3DwdPMboZp:IdKNp4KblfjKjCCj
MD5:	2897BAEC061B9A89661744685FE3C217
SHA1:	904753D6DAF2EE3A05319F045E4F2028A8AB576C
SHA-256:	285E32E649EB71A68F29BCA7321A6CADE50D79F94DD89E50ECE1197DD70E7633
SHA-512:	574F3FEC930CF960DD9725CE1298501D7AD88AC59EFCFB61032A2C3F3BBB12EF91BBC1CA63D1516DAD93FA202C25655754AE1C5BC6607B5CA7A0209F7A55576E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Y.kleyicisi</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Yaln.zca bir kabu.a, bir metin d.zenleyicisine ve 10 dakikal.k bir zamana ihtiyac.n.z var.....Haz.r m.s.n.z? Haydi ba.layal.m!</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.nceki s.r.m</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\2052\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	6.2165153145467595
Encrypted:	false
SSDEEP:	96:MTsnfsdy5kQR9GLkE0tVq1bLZ6gWogUtmN3B5DQKaop/Y9b1jnTDA:dJ9/q1bLZ6UgMmN3AP/8
MD5:	ED946A363E47DCC77017EC10B1032C54
SHA1:	C37B26426B51F9E5F405EF7798833FC017E653D4
SHA-256:	3BB9CE59BA1C4B76FA6B35F544E2B04C85387053EDD8B25D8C8D4FE637FB0A85
SHA-512:	FC65E04A87E5ADD299B71F1332D47F9E4D46F7F97139BBAF101CE0A1D7DF9D7DB8C33E4625CA9748C7607F4D43FF93E612B57ACD38DD5264FC6924446BF881BE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">...... shell............ 10 ..............? ...? ......!</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">....</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ................

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\3082\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	5.110353724144242
Encrypted:	false
SSDEEP:	96:MTyvAuLILaisbyxwz9sgIq2RjIk3jnTPjO1Eu2H2i/X05/b2epm:znCLRkMjnTjO10Mm
MD5:	1474C297B47C24D9E8E937CCBF50C4B2
SHA1:	012226924911C23DCC220BD653C329A304B2BA58
SHA-256:	FAB76FA9382A7793309C9B07D5BAAA3EFD8553172D46F8B69E22E30B635BB146
SHA-512:	3428682ED3EC803E709B30251C4233DB7C825EEFBFD718777211B6B80CD5EE36CBA1D08850E6294D4C4148E8D640171FD62764CBEDD7C9AC3BD628B48BF010F5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalador de [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Solo necesita un shell, un editor de texto y 10 minutos......Preparados? .Listos? .Ya!</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Versi.n anterior</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. Install es la opci.n predeterminada...../passive \| /quiet - muestra una IU m.nima sin peticiones, o bien no muestra la IU .. ni las peticiones. De forma predeterminada, se muestran la IU y todas las peticiones...../nore

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (596), with CRLF line terminators
Category:	dropped
Size (bytes):	7728
Entropy (8bit):	3.7575495893991016
Encrypted:	false
SSDEEP:	96:XeV2VS1/n6+g820wInych8xSUn6WgvJ0wAnycZIn6agdR0w8nyc9II1n6jgTr0wI:X0sm/qiaLDiyS92wWpIP8v49+VzB
MD5:	90DAD7034DA0F46538F3FA5AA1C2D99B
SHA1:	C0C9515DC048A527E0A574E6BDDDCDAC0BA56EA4
SHA-256:	758F578C377AFF1964025CAE438F3D9572C8FDD5090067E64C450BE2AFABF6AF
SHA-512:	79A8682FB435FB412102BC683EB85405193A51C3472AB630FE3C7AA456D5A7E122A53C9ACEBE86B0A6C693C55CE459FB0D3BE751300E07473D7BB22DD78CBD35
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .M.e.s.s.a.g.e.=.".#.(.l.o.c...F.a.i.l.u.r.e.N.o.t.S.u.p.p.o.r.t.e.d.C.u.r.r.e.n.t.O.p.e.r.a.t.i.n.g.S.y.s.t.e.m.).". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .D.e.s.k.t.o.p. .R.u.n.t.i.m.e. .-. .6...0...4. .(.x.8.6.).". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.s.". .I.d.=.".{.f.f.0.d.7.b.6.b.-.8.6.2.4.-.4.2.f.0.-.b.9.6.1.-.6.9.e.6.c.b.f.8.9.6.c.1.}.". .U.p.g.r.a.d.e.

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\bg.png

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	PNG image data, 620 x 418, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4601
Entropy (8bit):	6.635104571353389
Encrypted:	false
SSDEEP:	48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
MD5:	9EB0320DFBF2BD541E6A55C01DDC9F20
SHA1:	EB282A66D29594346531B1FF886D455E1DCD6D99
SHA-256:	9095BF7B6BAA0107B40A4A6D727215BE077133A190F4CA9BD89A176842141E79
SHA-512:	9ADA3A1757A493FBB004BD767FAB8F77430AF69D71479F340B8B8EDE904CC94CD733700DB593A4A2D2E1184C0081FD0648318D867128E1CB461021314990931D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...l.........Z..\|....sRGB.........gAMA......a.....pHYs..........o.d... IDATx^..}.].]...}...&..+.Ij.D..qp.b.......v(....h.[...E\|.:.+.h..N...V.....`K.....BR.[....l...z_=.....K..n.....o...s.=.nf.s.9'........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N~.......S.Y.v.>{A......S?..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\eula.rtf

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47889
Entropy (8bit):	5.0783959060546975
Encrypted:	false
SSDEEP:	768:32Kfuh/+YpJLdfxL1/pZ1ApGXjn8lcNLSx0:3Shj9bXQ0
MD5:	CC06442CFC33D0AE6509143325C05110
SHA1:	FC635958A57B88F63545CBEE1A37E3458CC547B0
SHA-256:	72F2E7B06C562F1DD6CB3F6EFDCCD9AE620A183E598856AB3CBA6D712254824A
SHA-512:	4D8A79347104501D89150A738DE24F700DC5D54D7CB05359C853A1189BF12B42E53B9E0B0D4A963C6AAA027D46D80A01AB2740BEE5D145C3597F1A7EFB48D4A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0302020204030204}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Tim

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5714
Entropy (8bit):	5.130490122689639
Encrypted:	false
SSDEEP:	96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
MD5:	D5070CB3387A0A22B7046AE5AB53F371
SHA1:	BC9DA146A42BBF9496DE059AC576869004702A97
SHA-256:	81A68046B06E09385BE8449373E7CEB9E79F7724C3CF11F0B18A4489A8D4926A
SHA-512:	8FCF621FB9CE74725C3712E06E5B37B619145078491E828C6069E153359DE3BD5486663B1FA6F3BCF1C994D5C556B9964EA1A1355100A634A6C700EF37D381E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">You just need a shell, a text editor and 10 minutes of your time.....Ready? Set? Let's go!</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Previous version</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\thm.xml

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11327
Entropy (8bit):	5.15671975859509
Encrypted:	false
SSDEEP:	96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
MD5:	302563A713B142EE41B59E3EEAC53A90
SHA1:	1340E90CC3C6C5FC19A7FEB61D7779F4A4F0FDB5
SHA-256:	83CA096F7BA2C83FC3B3AEB697B8139A788FA35EB8632943E26BB9FFF7C78E63
SHA-512:	C9D4DFC20802BB542178300D1044BB94B35593B834AB0B50875A32953F890E48DA456199128500E2C1FEE26EAAF8C2C4FCAFFB308B37914215F900CDD5C4CBC8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="660" Height="468" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="900" Foreground="FFFFFF" Background="D42B51">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.. <Font Id="5" Height="-14" Weight="500" Foreground="444444">Segoe UI</Font>.... <Text Name="Title" X="11" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" Center="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="0" Y="0" Width="620" Height="75" FontId="1" />..

C:\Users\user\AppData\Local\Temp\{A287890D-DBAC-4823-84AD-E84F6FE6DAFE}\.ba\wixstdba.dll

Download File

Process:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201752
Entropy (8bit):	6.684385468940799
Encrypted:	false
SSDEEP:	3072:4Fj2AYmaHqco56wsPZozShZTjVORuXzv7x5Okw7QWwF4QUdPArtOuw6meOlONtZz:4Fj2ARaKaPZ3TjcAR5OflbQ7tOzKh40V
MD5:	4356EE50F0B1A878E270614780DDF095
SHA1:	B5C0915F023B2E4ED3E122322ABC40C4437909AF
SHA-256:	41A8787FDC9467F563438DABA4131191AA1EB588A81BEB9A89FE8BD886C16104
SHA-512:	B9E482EFE9189683DABFC9FEFF8B386D7EBA4ECF070F42A1EEBEE6052CFB181A19497F831F1EA6429CFCCE1D4865A5D279B24BD738D702902E9887BB9F0C4691
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../.../.../...J...%...J.......}...?...}...>...}...0...J...:...J.......J...2.../...........6.................../.k.............Rich/...........PE..L....RKa...........!.................................................................Z....@.........................@.......,............................B..............T...............................@...............T............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\2N USB Driver.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Apr 26 08:14:07 2024, mtime=Fri Apr 26 08:14:11 2024, atime=Mon Jan 22 09:58:18 2024, length=296096, window=hide
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	4.612086084186756
Encrypted:	false
SSDEEP:	24:8mbCyEcdOENBvn3wAM0hJdAMdAZc/KoUUBtz/qygm:8mmlcdOqBvn3HMYJdAMdAZc/K9UtOyg
MD5:	4A437D7E9FB70ABC3A2F3145B8E8F2D4
SHA1:	F680023BF005EA29268248A92D57FF810C370B54
SHA-256:	7702BAD4D735AAF2E298510900BF593F8D747C6E6FE0A78B03DF11C863D1598F
SHA-512:	C9E7F63817262836EA0447DC9CD1E571C982A8E4F58E7A3E5A9F04F6A0A73EACF0A137C889A48A7CEB2B23CEE181090541F1456DEA2550B99018801C42398F56
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ..........4...........!M...............................P.O. .:i.....+00.../C:\.....................1......X.I..PROGRA~2.........O.I.X.I....................V......;..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1......X.I..2NTELE~1..T......X.I.X.I...........................;..2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.....d.1......X.I..2NUSBD~1..L......X.I.X.I..........................o]%.2.N. .U.S.B. .D.r.i.v.e.r.....`.2.....6XIW .Usbdrv.exe..F......X.I.X.I..............................U.s.b.d.r.v...e.x.e.......p...............-.......o...................C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe..G.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.\.2.N. .U.S.B. .D.r.i.v.e.r.\.U.s.b.d.r.v...e.x.e.6.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.2.N. .T.E.L.E.K.O.M.U.N.I.K.A.C.E.\.2.N. .U.S.B. .D.r.i.v.e.r.>.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.2.N. .T.E.L

C:\Windows\DPDrv\DPInst64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	930272
Entropy (8bit):	5.7366323794740115
Encrypted:	false
SSDEEP:	6144:JcQsynWrZI8I/VELVqZFbq+0pHKmdTJF805CbLLDFSQSAj99HJYnJzDX+v34nQTy:mpRkVWqZRqXVI0oLD7ZxA434QTPh2F
MD5:	C3AC43B2018114A617E946AA8FDF3CAC
SHA1:	2D90F38BC995C9CD5EFEC52109F8BD2468001CA7
SHA-256:	EF6C5FE9F08BE67F24C7DFA5C7BC3D69AB4E387E6065602D45BA358289F05117
SHA-512:	8C471A2575751C5995B10859219B979D75C8E8E4496604C0718268D8367790C5BB8E6DD47C735DCECD02A62DBB0D8FBBB70EA1D085AD7B798491A3D831CD9488
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.hA].;A].;A].;f..;C].;f..;U].;f..;`].;A].;.\.;f..;.].;f..;f].;f..;@].;f..;@].;f..;@].;RichA].;........................PE..d...b.4E..........".................<........................................`.......A....@.......... ..........................................@........q...P..xr...........P..D....................................................................................text... ........................... ..`.data........0......................@....pdata..xr...P...t..."..............@..@.rsrc............r..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dPersona_x64.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Windows\DPDrv\dpDevCtl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpDevCtlx64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpDevDat.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpDevDatx64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpd00701.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpd00701x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpersona_x64.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Windows\DPDrv\dpi00701.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpi00701x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\dpk00701.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Windows\DPDrv\is-1KSCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-5NC7F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Windows\DPDrv\is-6EMJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Windows\DPDrv\is-APUGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-DQHA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-ECSVK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-EL1CK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-GC5D4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Windows\DPDrv\is-J3PKB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-JPCD5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	930272
Entropy (8bit):	5.7366323794740115
Encrypted:	false
SSDEEP:	6144:JcQsynWrZI8I/VELVqZFbq+0pHKmdTJF805CbLLDFSQSAj99HJYnJzDX+v34nQTy:mpRkVWqZRqXVI0oLD7ZxA434QTPh2F
MD5:	C3AC43B2018114A617E946AA8FDF3CAC
SHA1:	2D90F38BC995C9CD5EFEC52109F8BD2468001CA7
SHA-256:	EF6C5FE9F08BE67F24C7DFA5C7BC3D69AB4E387E6065602D45BA358289F05117
SHA-512:	8C471A2575751C5995B10859219B979D75C8E8E4496604C0718268D8367790C5BB8E6DD47C735DCECD02A62DBB0D8FBBB70EA1D085AD7B798491A3D831CD9488
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.hA].;A].;A].;f..;C].;f..;U].;f..;`].;A].;.\.;f..;.].;f..;f].;f..;@].;f..;@].;f..;@].;RichA].;........................PE..d...b.4E..........".................<........................................`.......A....@.......... ..........................................@........q...P..xr...........P..D....................................................................................text... ........................... ..`.data........0......................@....pdata..xr...P...t..."..............@..@.rsrc............r..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-NEUSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-OHV6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\DPDrv\is-RD0A7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Windows\DPDrv\usbdpfp.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Windows\DPINST.LOG

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	6866
Entropy (8bit):	3.671198026648321
Encrypted:	false
SSDEEP:	96:8bsN/RHQv8653Qy0jBArgj7ddxT9z8cIweQ63SG9tJa3HHNA:j5QF00Ie
MD5:	7D6F702B1E22016559BB956CD6617C07
SHA1:	DF8A582FDB317FCEFCA3123914D9A52EF72AF1FD
SHA-256:	F86B8731A7EE10DC4446AD181FB93BD632135C1ABEAFAA8996FD8FD10C1DA0F3
SHA-512:	0160A1859578F6633C65A67D017B59CE6AAEF1DA980AA6EA42AE4CA4002730FE15A02C2D3EAFC9549F0F2B1D5E27854D7D9F2917B80038B354013B65CD1FAFE6
Malicious:	false
Reputation:	unknown
Preview:	..I.N.F.O.:. . . .............................................I.N.F.O.:. . . .0.4./.2.6./.2.0.2.4. .1.1.:.1.4.:.1.2.....I.N.F.O.:. . . .P.r.o.d.u.c.t. .V.e.r.s.i.o.n. .2...1...0...0.......I.N.F.O.:. . . .V.e.r.s.i.o.n.:. .6...0...6.0.0.0. .....I.N.F.O.:. . . .P.l.a.t.f.o.r.m. .I.D.:. .2. .(.N.T.).....I.N.F.O.:. . . .S.e.r.v.i.c.e. .P.a.c.k.:. .0...0.....I.N.F.O.:. . . .S.u.i.t.e.:. .0.x.0.1.0.0.,. .P.r.o.d.u.c.t. .T.y.p.e.:. .1.....I.N.F.O.:. . . .A.r.c.h.i.t.e.c.t.u.r.e.:. .A.M.D.6.4.......I.N.F.O.:. . . .I.n.t.e.r.a.c.t.i.v.e. .W.i.n.d.o.w.s. .S.t.a.t.i.o.n.....I.N.F.O.:. . . .C.o.m.m.a.n.d. .L.i.n.e.:. .'.".C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.C.L.J.4.H...t.m.p.\.d.p.i.n.s.t...e.x.e.". ./.S.A. ./.S.E. ./.S.W. ./.F. ./.C. ./.P.A.T.H. .C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.C.L.J.4.H...t.m.p.\.t.w.n.4.'.....I.N.F.O.:. . . .D.P.I.n.s.t. .i.s. .n.o.t. .m.u.l.t.i.-.

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Windows\INF\oem5.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	85477
Entropy (8bit):	5.406607797912835
Encrypted:	false
SSDEEP:	1536:O+5cdyeoiwllfk7g7MwsJlU0avSqYLG/Oma9GjFO:O+5cgeoXfk07MwsJlU0avSqYLG/Oma9t
MD5:	40F49AB3294CBD538AC1A9687E7D12AA
SHA1:	61A26D6AE7F1E16E93A1E8FD5AF0370B60CC2095
SHA-256:	696C4DBFF53BBBBE3728BF16DE386705300864E39BA7459F79BEB6626029E686
SHA-512:	7EF4A9696A38647A857FCA1B8C29213E8C3C3C9E5622F95BF3DDE72064692B8E95BB1B90685D91B3385D0297D8FDB0FF62CF39555284902D6B15FA09084B5CF7
Malicious:	false
Reputation:	unknown
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\6df02a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {25B8B5B6-686E-443A-93DD-4A03FC1447F9}, Create Time/Date: Mon Mar 28 22:34:04 2022, Last Saved Time/Date: Mon Mar 28 22:34:04 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	25038848
Entropy (8bit):	7.993694661390324
Encrypted:	true
SSDEEP:	393216:8F7jKrMX/v9NiMxo3lVZvpbEjsFiOzTrlf8akZq8l/Bahg3S6fXz1KM7vubjcl5J:8FPKAdipvtJiOblf8xZq8l/dSmD1l7vf
MD5:	CD9EF7D9D429445AFDEA12E5CC78E5A3
SHA1:	59B0161EC1E3476474E1C3AAA919685932C2B974
SHA-256:	B4847FD536D9A6F39D79ABA8B077E313DB64485D79A02B6D69A3E16FA673E037
SHA-512:	76E3CFAA0ECB9CFE957C9601CA3537E0531EFDFA9426E56510414F0323F88D824C98E9EBE6D387DB52C65AB9BB1E01D2680EDC94658D9C4CD76D1484DC66BC33
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df02d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {25B8B5B6-686E-443A-93DD-4A03FC1447F9}, Create Time/Date: Mon Mar 28 22:34:04 2022, Last Saved Time/Date: Mon Mar 28 22:34:04 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	25038848
Entropy (8bit):	7.993694661390324
Encrypted:	true
SSDEEP:	393216:8F7jKrMX/v9NiMxo3lVZvpbEjsFiOzTrlf8akZq8l/Bahg3S6fXz1KM7vubjcl5J:8FPKAdipvtJiOblf8xZq8l/dSmD1l7vf
MD5:	CD9EF7D9D429445AFDEA12E5CC78E5A3
SHA1:	59B0161EC1E3476474E1C3AAA919685932C2B974
SHA-256:	B4847FD536D9A6F39D79ABA8B077E313DB64485D79A02B6D69A3E16FA673E037
SHA-512:	76E3CFAA0ECB9CFE957C9601CA3537E0531EFDFA9426E56510414F0323F88D824C98E9EBE6D387DB52C65AB9BB1E01D2680EDC94658D9C4CD76D1484DC66BC33
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df02e.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host FX Resolver - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host FX Resolver - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}, Create Time/Date: Mon Mar 28 22:28:54 2022, Last Saved Time/Date: Mon Mar 28 22:28:54 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	802816
Entropy (8bit):	6.654815364510836
Encrypted:	false
SSDEEP:	12288:4iSlGY9IBjxMbJxuz+N1qqsCVt07kw3jl2tBds:vSeqTm+f8CVql3CBd
MD5:	E2416A04AA679FCD0CBBC8E705A6A7C7
SHA1:	9408D2A3F620535BDE620243400B34D6D21A1C4C
SHA-256:	B0C5FE8FCF2996B6C340EAB544CFEAEE18578B525762EAC06128E42B6F6B281C
SHA-512:	0C9BF3961BF2C83453E8F06F6BB1793416F492A9EE94D05506D5A1F49DECF01155AFCE128B4F5E92D1B9201E5A80BE16AD0B3A4D25229FCDFD98BDA0FFB03709
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df031.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host FX Resolver - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host FX Resolver - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}, Create Time/Date: Mon Mar 28 22:28:54 2022, Last Saved Time/Date: Mon Mar 28 22:28:54 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	802816
Entropy (8bit):	6.654815364510836
Encrypted:	false
SSDEEP:	12288:4iSlGY9IBjxMbJxuz+N1qqsCVt07kw3jl2tBds:vSeqTm+f8CVql3CBd
MD5:	E2416A04AA679FCD0CBBC8E705A6A7C7
SHA1:	9408D2A3F620535BDE620243400B34D6D21A1C4C
SHA-256:	B0C5FE8FCF2996B6C340EAB544CFEAEE18578B525762EAC06128E42B6F6B281C
SHA-512:	0C9BF3961BF2C83453E8F06F6BB1793416F492A9EE94D05506D5A1F49DECF01155AFCE128B4F5E92D1B9201E5A80BE16AD0B3A4D25229FCDFD98BDA0FFB03709
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df032.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}, Create Time/Date: Mon Mar 28 22:15:24 2022, Last Saved Time/Date: Mon Mar 28 22:15:24 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.471928236216391
Encrypted:	false
SSDEEP:	12288:KIBjxMbJxuz+N1qqGCVt07kw3jl2tBds:LqTm+f2CVql3CBd
MD5:	E272913E581C11624BE39D55E81A07BE
SHA1:	CC9B92914BE59FDF6D227A629B8078B834DE273F
SHA-256:	F80E1AE91FFE984A9F0AD4E7B8BB06A0B6D5C66F2189C33696817E9ACFABC4E9
SHA-512:	80E8CC96FA32BACA5F2F4B6A7781B363BE827D96E37D9419EF11D59FED54A3A4C15F9215E39844725128DB4E8829CBF2CEE1360270E77551488A27ED64B81BDE
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df035.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}, Create Time/Date: Mon Mar 28 22:15:24 2022, Last Saved Time/Date: Mon Mar 28 22:15:24 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.471928236216391
Encrypted:	false
SSDEEP:	12288:KIBjxMbJxuz+N1qqGCVt07kw3jl2tBds:LqTm+f2CVql3CBd
MD5:	E272913E581C11624BE39D55E81A07BE
SHA1:	CC9B92914BE59FDF6D227A629B8078B834DE273F
SHA-256:	F80E1AE91FFE984A9F0AD4E7B8BB06A0B6D5C66F2189C33696817E9ACFABC4E9
SHA-512:	80E8CC96FA32BACA5F2F4B6A7781B363BE827D96E37D9419EF11D59FED54A3A4C15F9215E39844725128DB4E8829CBF2CEE1360270E77551488A27ED64B81BDE
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df036.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Windows Desktop Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Windows Desktop Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {951FC065-6FC2-4A32-9FB6-99EEDC7A8096}, Create Time/Date: Mon Mar 28 22:28:22 2022, Last Saved Time/Date: Mon Mar 28 22:28:22 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	27099136
Entropy (8bit):	7.99437933130602
Encrypted:	true
SSDEEP:	786432:14AC9LZT7/xen9hQfFZJPeElult56O/AU+bq+Cpd:1NC9lTa9wFfTGzT4bqh
MD5:	3CC0458C467FD646AFE4EFC103ECC634
SHA1:	C42C5740E3A10229E250969F22ECDD7376698488
SHA-256:	E67B62CDC6D66720AA82977863F38E3469C45C3CA3F752032DEC709A173C209A
SHA-512:	AB6434BA2DAD9138082AA9D657A850659BD84140D9D90BDA72D54FE688839131C33B333926A306AF27BBD89FA2D7240C73181C530017B01E132834B5A639B819
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6df039.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Windows Desktop Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Windows Desktop Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {951FC065-6FC2-4A32-9FB6-99EEDC7A8096}, Create Time/Date: Mon Mar 28 22:28:22 2022, Last Saved Time/Date: Mon Mar 28 22:28:22 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	27099136
Entropy (8bit):	7.99437933130602
Encrypted:	true
SSDEEP:	786432:14AC9LZT7/xen9hQfFZJPeElult56O/AU+bq+Cpd:1NC9lTa9wFfTGzT4bqh
MD5:	3CC0458C467FD646AFE4EFC103ECC634
SHA1:	C42C5740E3A10229E250969F22ECDD7376698488
SHA-256:	E67B62CDC6D66720AA82977863F38E3469C45C3CA3F752032DEC709A173C209A
SHA-512:	AB6434BA2DAD9138082AA9D657A850659BD84140D9D90BDA72D54FE688839131C33B333926A306AF27BBD89FA2D7240C73181C530017B01E132834B5A639B819
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI16AE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230936
Entropy (8bit):	6.7034341136323015
Encrypted:	false
SSDEEP:	3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5:	D711DA8A6487AEA301E05003F327879F
SHA1:	548D3779ED3AB7309328F174BFB18D7768D27747
SHA-256:	3D855B58CE7DA9F24F1BEF8D0673BA4A97105A7FD88433DE7FB4E156B4306283
SHA-512:	C6D1C938E8A0ACF080DCAB1276D78237E342A98772E23AC887B87A346878C376FB0AF8364E52A36C5B949005AA3218308BC6193F8B580F622EF39D9955C7C681
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)...H.I.H.I.H.I...H.H.I...HyH.I. .H.H.I. .H.H.I. .H.H.I...H.H.I...H.H.I...H.H.I.H.I.H.IV!.H.H.IV!.H.H.IV!.I.H.I.H`I.H.IV!.H.H.IRich.H.I........................PE..L....RKa...........!.........R......6........ ............................................@.........................p.......P........`..x............D...B...p..........T...............................@............ ..,............................text...+........................... ..`.rdata....... ......................@..@.data....#...0......................@....rsrc...x....`....... ..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1BA1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	5.746838695764455
Encrypted:	false
SSDEEP:	48:3juwZ2tBhJzhGMeu0Y3k5H6P31u07l1k9D8SBh38uMDeU1DlnIk7zDxkYAEVlt9Q:3CwZa5LX7rmHsuUe6JVzDxkJEPbYAA
MD5:	AEDA0A24971A0E3E296F5E6A19DBD264
SHA1:	6787E4A95FE339901ED5122BEE6E91A8684A3DF7
SHA-256:	D952AF54036EAA3BCF03A402BC14FD5B1D880D06E4B7862F30E95A42E912CA60
SHA-512:	BBFD345E2EDEA1FBBD79C05813BAA99DB83D66FB46B7F163FC569DB899232AEF894DBF733322270616F214FD1C842F0F5F0B9BBBD9CA087AF4BC4C6DB0CE8BCD
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{61373008-0285-40B8-93C2-26C8110BC4ED}-.Microsoft .NET Host FX Resolver - 6.0.4 (x86) .dotnet-hostfxr-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}.....@.....@.....@.....@.......@.....@.....@.......@....-.Microsoft .NET Host FX Resolver - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{8410E72E-06C1-5982-BC18-60D5E54D80E1}V.02:\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.19.39076_x86\Version.@.......@.....@.....@......&.{27E08BF7-EBE0-5965-9FA8-979FC11CF4DA}8.C:\Program Files (x86)\dotnet\host\fxr\6.0.4\hostfxr.dll.@.......@.....@.....@......&.{1D82A7DD-9994-5FAD-B0B5-FA93D2A54031}?.02:\SOFTWARE\dotnet\Setup\InstalledVersions\x86\hostfxr\Version.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Di

C:\Windows\Installer\MSI1C5D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230936
Entropy (8bit):	6.7034341136323015
Encrypted:	false
SSDEEP:	3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5:	D711DA8A6487AEA301E05003F327879F
SHA1:	548D3779ED3AB7309328F174BFB18D7768D27747
SHA-256:	3D855B58CE7DA9F24F1BEF8D0673BA4A97105A7FD88433DE7FB4E156B4306283
SHA-512:	C6D1C938E8A0ACF080DCAB1276D78237E342A98772E23AC887B87A346878C376FB0AF8364E52A36C5B949005AA3218308BC6193F8B580F622EF39D9955C7C681
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)...H.I.H.I.H.I...H.H.I...HyH.I. .H.H.I. .H.H.I. .H.H.I...H.H.I...H.H.I...H.H.I.H.I.H.IV!.H.H.IV!.H.H.IV!.I.H.I.H`I.H.IV!.H.H.IRich.H.I........................PE..L....RKa...........!.........R......6........ ............................................@.........................p.......P........`..x............D...B...p..........T...............................@............ ..,............................text...+........................... ..`.rdata....... ......................@..@.data....#...0......................@....rsrc...x....`....... ..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1F0E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4314
Entropy (8bit):	5.743640647633857
Encrypted:	false
SSDEEP:	96:6/JoitACBEEeNmJ3tIbSuXe6d+GDzkDEPA:6RDp69kliSuXe64DWA
MD5:	C74F6C6E8B052D4E19140649DC61462D
SHA1:	CB46D62E0286C4A6412DAA82FB905C550482D2E2
SHA-256:	07FD6A64DE906E7E541E999F7A8401D47578FA0A5F0ED781B6E7FB454867D8A7
SHA-512:	5751A307200211CFBB614D1E9198893E4E3C926790D5F20D00F800B2DD54E8EAF4520B1D2398028A44C7E4069A87DB2848BB395ABFE18D29434C514162E27F2D
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}!.Microsoft .NET Host - 6.0.4 (x86)..dotnet-host-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}.....@.....@.....@.....@.......@.....@.....@.......@....!.Microsoft .NET Host - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3255E0B8-D6AE-5877-90FE-F3E586EF9630}X.02:\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Version.@.......@.....@.....@......&.{45399BBB-DDA5-4386-A2E9-618FB3C54A18}(.C:\Program Files (x86)\dotnet\dotnet.exe.@.......@.....@.....@......&.{152B8915-2DC8-5382-8A34-8078B67AF049}B.02:\SOFTWARE\dotnet\Setup\InstalledVersions\x86\sharedhost\Version.@.......@.....@.....@......&.{9687936A-DBE9-5D1A-9273-D5F54BA78702}?.02:\SOFTWARE\dotnet\Setup\InstalledVersions\x

C:\Windows\Installer\MSI21ED.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230936
Entropy (8bit):	6.7034341136323015
Encrypted:	false
SSDEEP:	3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5:	D711DA8A6487AEA301E05003F327879F
SHA1:	548D3779ED3AB7309328F174BFB18D7768D27747
SHA-256:	3D855B58CE7DA9F24F1BEF8D0673BA4A97105A7FD88433DE7FB4E156B4306283
SHA-512:	C6D1C938E8A0ACF080DCAB1276D78237E342A98772E23AC887B87A346878C376FB0AF8364E52A36C5B949005AA3218308BC6193F8B580F622EF39D9955C7C681
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)...H.I.H.I.H.I...H.H.I...HyH.I. .H.H.I. .H.H.I. .H.H.I...H.H.I...H.H.I...H.H.I.H.I.H.IV!.H.H.IV!.H.H.IV!.I.H.I.H`I.H.IV!.H.H.IRich.H.I........................PE..L....RKa...........!.........R......6........ ............................................@.........................p.......P........`..x............D...B...p..........T...............................@............ ..,............................text...+........................... ..`.rdata....... ......................@..@.data....#...0......................@....rsrc...x....`....... ..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2847.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	157787
Entropy (8bit):	5.639002842408592
Encrypted:	false
SSDEEP:	3072:pOrJFqan7hRWSvukZ2gDQ0W/R1szlb4uL17KQRN2xq4EVwtmu5BoVQk5:pLBpi
MD5:	19B6F01A423F2464E695D66DCD615EAD
SHA1:	38370C915D72092C7527F912B4516420D539F8A9
SHA-256:	396ABD368BFD6634B2CE9FA30558FAED56C4C1EEBCDC5696EF8EA58C3865740E
SHA-512:	4758929E529F416B388A171740ED2707623DB8EF184ADDFC1967249E93F8AF4E5AC48E1EF72E3359D1AE6EC5E1A61C7623CB8417F27175063D747DC9BA95ECAE
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{28F5CA46-286A-4C61-A86E-525F06E456DD}/.Microsoft Windows Desktop Runtime - 6.0.4 (x86)(.windowsdesktop-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{951FC065-6FC2-4A32-9FB6-99EEDC7A8096}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Windows Desktop Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E4B9D2D6-B557-5F11-BD49-C6B7B383D40E}Z.02:\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.19.39090_x86\Version.@.......@.....@.....@......&.{9D9C7ACF-CBD3-5C49-B11B-728FF6923F63}Y.C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\Accessibility.dll.@.......@.....@.....@......&.{4139925B-D4C4-592F-A382-33888E016212}_.C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.4\D3DCompiler_47_cor3

C:\Windows\Installer\MSI563E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230936
Entropy (8bit):	6.7034341136323015
Encrypted:	false
SSDEEP:	3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5:	D711DA8A6487AEA301E05003F327879F
SHA1:	548D3779ED3AB7309328F174BFB18D7768D27747
SHA-256:	3D855B58CE7DA9F24F1BEF8D0673BA4A97105A7FD88433DE7FB4E156B4306283
SHA-512:	C6D1C938E8A0ACF080DCAB1276D78237E342A98772E23AC887B87A346878C376FB0AF8364E52A36C5B949005AA3218308BC6193F8B580F622EF39D9955C7C681
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)...H.I.H.I.H.I...H.H.I...HyH.I. .H.H.I. .H.H.I. .H.H.I...H.H.I...H.H.I...H.H.I.H.I.H.IV!.H.H.IV!.H.H.IV!.I.H.I.H`I.H.IV!.H.H.IRich.H.I........................PE..L....RKa...........!.........R......6........ ............................................@.........................p.......P........`..x............D...B...p..........T...............................@............ ..,............................text...+........................... ..`.rdata....... ......................@..@.data....#...0......................@....rsrc...x....`....... ..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI689E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	5.446932720189586
Encrypted:	false
SSDEEP:	12:EgjBdSIvNZxzB/rFZmdT5Yj//HxzBzfNEhHmX/qHXZNDUSEMszVltNnMbSIvgWYB:rBPZxFDFZm3Yj3xFWQXkXZIMEVlt1M2B
MD5:	9847FF41CEE67CA536D45E8C6FB566A5
SHA1:	53E49E953B213E125C8A2B2A6628415C3B2EADCD
SHA-256:	AE873FA592E9532B6A89D5F78ED0F2C706308484B9CD130E21776F040F735A11
SHA-512:	BBEFE50595B2C43B44132B69107272730B7C2C27213648F8495B1402E4C260F12418A51909563278FB79D9116B5D048081C91685CEEAAAC7B7083413D8CEB6B2
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{28F5CA46-286A-4C61-A86E-525F06E456DD}/.Microsoft Windows Desktop Runtime - 6.0.4 (x86)(.windowsdesktop-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{951FC065-6FC2-4A32-9FB6-99EEDC7A8096}.....@.....@.....@.....@.......@.....@.....@.......@..../.Microsoft Windows Desktop Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{28F5CA46-286A-4C61-A86E-525F06E456DD}P.C:\ProgramData\Package Cache\{28F5CA46-286A-4C61-A86E-525F06E456DD}v48.19.39090\...@.....@.....@....

C:\Windows\Installer\MSI69A9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	230936
Entropy (8bit):	6.7034341136323015
Encrypted:	false
SSDEEP:	3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5:	D711DA8A6487AEA301E05003F327879F
SHA1:	548D3779ED3AB7309328F174BFB18D7768D27747
SHA-256:	3D855B58CE7DA9F24F1BEF8D0673BA4A97105A7FD88433DE7FB4E156B4306283
SHA-512:	C6D1C938E8A0ACF080DCAB1276D78237E342A98772E23AC887B87A346878C376FB0AF8364E52A36C5B949005AA3218308BC6193F8B580F622EF39D9955C7C681
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)...H.I.H.I.H.I...H.H.I...HyH.I. .H.H.I. .H.H.I. .H.H.I...H.H.I...H.H.I...H.H.I.H.I.H.IV!.H.H.IV!.H.H.IV!.I.H.I.H`I.H.IV!.H.H.IRich.H.I........................PE..L....RKa...........!.........R......6........ ............................................@.........................p.......P........`..x............D...B...p..........T...............................@............ ..,............................text...+........................... ..`.rdata....... ......................@..@.data....#...0......................@....rsrc...x....`....... ..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF56A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	86242
Entropy (8bit):	5.668639918707215
Encrypted:	false
SSDEEP:	1536:nshffB+OskO/HeFCY7/x9+sttdDaoiZV6wI01VQBHK9PSRpgHoDYVRfA7jHVAjr0:OBv75d/p9
MD5:	370E7027CCF5FDB20BBE7FA89CAFD6DC
SHA1:	E7D2D41E4135AB0C0C3549ABF1FA7277B919897E
SHA-256:	AD9FF0C4031619144DEB10A166A859C94EDC87E266D47CC07F8C348EF792E928
SHA-512:	B3D66BBF94FECE941C7A0972CDB482E6F20A7C504C4C9A799AA10567940DE1F4A025ABFB1550CFC0A7F2DBA25A3061C97560C238E3E4BA4706D119E2DB22DAB0
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{8075C447-DEF3-4DCC-BB39-8497717BE91E}$.Microsoft .NET Runtime - 6.0.4 (x86) .dotnet-runtime-6.0.4-win-x86.msi.@.....@...0.@.....@........&.{25B8B5B6-686E-443A-93DD-4A03FC1447F9}.....@.....@.....@.....@.......@.....@.....@.......@....$.Microsoft .NET Runtime - 6.0.4 (x86)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E6B00585-4D7B-5E7C-8378-587BA69CA51D}R.02:\Software\Classes\Installer\Dependencies\dotnet_runtime_48.19.39076_x86\Version.@.......@.....@.....@......&.{E48FBEE2-D006-58C8-A411-AD76137F9680}I.C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\.version.@.......@.....@.....@......&.{6FB67732-B0AE-50FC-AE6A-9948E48725BC}c.C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.4\api-ms-win-core-console-l1-1-0.dll.@.......@.....@.....@......&.{09F06046-47D7-5

C:\Windows\Installer\SourceHash{28F5CA46-286A-4C61-A86E-525F06E456DD}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1791298911309611
Encrypted:	false
SSDEEP:	12:JSbX72Fjm4iAGiLIlHVRpTh/7777777777777777777777777vDHFFrFZM8l0i8Q:JSQI5XnFZqF
MD5:	642C404F7FEA6982BC0A2BD93F78F552
SHA1:	7823582B07139BB898DFC2CA2F8B63F022BAEA4D
SHA-256:	470127E2CDD2C2E37118187DCC9B0584B7CCA1A5831B8461547330F8CA5DE68E
SHA-512:	6121F8388E13E937B751B19AC6F644E1A0B3F56723AE3E6A84287714AA99C0087B343DEB32206735589126F3EE6F8B75981D6A3F18E152052B181B1A90A6E4D1
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{61373008-0285-40B8-93C2-26C8110BC4ED}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1742138109189972
Encrypted:	false
SSDEEP:	12:JSbX72FjOfciAGiLIlHVRpbh/7777777777777777777777777vDHFUmoOKYFHZb:J8fPQI5/mIFHZl8F
MD5:	CD9F9DCCF801197882F68EF41A13F867
SHA1:	559C444E3CA99EDC995C061F8D0EF32B7EA1D310
SHA-256:	FC678599FA6F72F396AF9DEBDA5DE7209BB7BCFE79B27AEAD6AAD41AB1461288
SHA-512:	2F8BA6349B38C86F2CC5F8660323905AE16E98B9AB46D7F0E665530CB6C8F1B0121CC674DECEC964FD004E42045843BD4E802BFA457973D03B95663FAAEA288E
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{8075C447-DEF3-4DCC-BB39-8497717BE91E}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1734301750973293
Encrypted:	false
SSDEEP:	12:JSbX72Fj/ciAGiLIlHVRpbh/7777777777777777777777777vDHFKj2AESuSTF5:JdQI5/pC5Zl8F
MD5:	7C0D3CA9DA5B6CA94A3515EB761DA776
SHA1:	009121877E5EB28DD3E8BD46C34768EA7706B5BD
SHA-256:	34A89E4C535949726718EF5821889220DD3CC1E1A647BC8BA85907DBDB95527A
SHA-512:	FD047AA0683D4718DAD2679F36DBAC4C4A062239AFE0DE5ADCC7A273A817EDE31289ED8E808980F1BA41DCDBCB1A82502BF3F872EE1E690A4BF0E5F047D90100
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{DB82E9AB-01DC-4F99-A6C7-67CDDF90AAD9}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1715876165885328
Encrypted:	false
SSDEEP:	12:JSbX72FjbkiAGiLIlHVRpIh/7777777777777777777777777vDHFtAj9LBArl0G:JtQI5wHKLB9F
MD5:	8F92E2C155C7E9658D0E032316BF3465
SHA1:	3F871E741B9571EC3DA18744C719DE1CD7169ECF
SHA-256:	A4B3109B6B53D37CAA7D7607E5E973476484703363AC94F3C12B396B70F56685
SHA-512:	A5CA23117E092BEE1D9DE4E9E55EF5E64FB3010BAF9A6298A3D1F27012D73B6E15899D4EE3B524866206E46162D0448095FE29C7754C7064D27178B82B5BEDBF
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6125488226067326
Encrypted:	false
SSDEEP:	48:o8PhPuRc06WXzyFT5bwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:3hP1XFTOUetPZDleN
MD5:	B0A42AD29D68EC21C3D45BAFFB6DAA91
SHA1:	5D722F8DB4977A481B73572406040F1A176D4E8D
SHA-256:	98339DA9F45069D608E0A15D0000D1F1EF5D2D9D9CAD9079F22D4D3ECCF323C4
SHA-512:	BF5705A8CDF33D41B12B685568BFC05DAA6BFE069FF80C538E4A02862D48C91FEFBC1213879C2AAEAA58B443A93CAAD9388B37401C8001F74CF12346C80E7DD8
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.3629940840853285
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauY:zTtbmkExhMJCIpE5
MD5:	EB3E7E0E77E8348DA79082B3124067A2
SHA1:	D96AB2A99E7A3F2224AB4ABB39F130A9DD8D44CD
SHA-256:	C62B0CE34252E159911126DCEBB2B23F9AE6A58A2B47529CE8E87E7BB200FA6C
SHA-512:	66511562DB17CE17996486AB6CEC3E734CA4825410AFAECE555A3BF935DC5357FDE6B4A7909556BDC2F598CDC4ADEB3FC025E1CA274FC3FC9078E2FB66D4A197
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\FPCom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151760
Entropy (8bit):	6.644484662091011
Encrypted:	false
SSDEEP:	3072:HqqnwquQsADzjeJN40uuum5j7RVIM5sjWpNeYKQ9WMie:Xn6bAD+vu1WX
MD5:	98AEBB9C04F2D52CC9D337ED5F7DF53F
SHA1:	5CAA9349E563143928AA5BED297DC4BF985C462C
SHA-256:	11631AF793CBB232F9DE96C16BCA6E13B8C4CD3F5C37ABF5CF91A7A2345671ED
SHA-512:	8BBF8F4B07BFDCA4B3A67767E09B277224D1C682AE09B65A37EC36DC4E3EBD97F311AADDBBD8542F1FAB278FD17E2B38C25F3AC8ECEDE3258EB5F19EB7B3CA3C
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................d....................@..........................`......................................................0...$...............>......H"..................................................................................CODE.... ........................... ..`DATA....P...........................@...BSS.....%................................idata..............................@....edata..............................@..P.reloc..H".......$..................@..P.rsrc....$...0...$..................@..P.............`......................@..P................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPCap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	6.3158448045705855
Encrypted:	false
SSDEEP:	1536:BMwmBuUCdDovkjUAKabnDNOLXkVJs+qybP0l6eoaG5e512Mh8T:uHBcq2Dq1yIFoj5er2Mh2
MD5:	91BF06A384DFDEE7869CE901C845664B
SHA1:	427C4D53425483E87209B27C714E4552443E5F8B
SHA-256:	6A795F895741182491E6DBE47E2EE49ED1BDD36CF8D5E8A1759968660506AAB8
SHA-512:	2A62A9AE784CB7B00FD1146293CDD8312613300CA23B499C1BF7321A78BE3BC1EDF2E5456D4B6BCD068A5912EA3A07F378D7F8C8BAC590D3C8C05EE1D68026E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............f.......f.......f........l..............f.......f.......L.......f......Rich....................PE..L...cx.W...........!................IC..............................................?.....@..........................0.......(..<...............................0...................................( ..@...............X............................text...V........................... ..`.rdata...U.......V..................@..@.data...\|2...@......................@....rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\is-702MI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.606697027164951
Encrypted:	false
SSDEEP:	3072:koXMFtFmwr5KjXniSzUKSX0id92iaq93Qv34cCwukfU4xbShdxyKH7AbOI5Zp+L:kocDj1FKxiqq93Qv3fCJ4djp+
MD5:	C2FE3529B22E51386978C1B4B6963CC8
SHA1:	0B3178295C9A9AB7394993C9B4C37739E46A4217
SHA-256:	89924EAFE7657530C2B73C44EA2A8B6964B7E0B9DB35B6EBF5A631CEE33F32B6
SHA-512:	BC3777ED6446BDB662573CD64A6108917C12F1E3F9F16EE189A3855D39FF8C15596ABAA987D1C663A7FE4767280F2342641AD6D4FAE8D04243547568706BC455
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H(4f.IZ5.IZ5.IZ5.1.5=IZ5.1.5.IZ5.1.5.IZ5+.!5.IZ5.I[5fIZ5.1.5.IZ5.1.5.IZ5.1.5.IZ5Rich.IZ5........PE..L...kx.W...........!................ v..............................................-b....@..........................?.......6..<...............................\...................................8+..@...............h............................text...?........................... ..`.rdata...@.......B..................@..@.data...\D...P...(...(..............@....rsrc................P..............@..@.reloc........... ...R..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\is-E9LLE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.358233973445306
Encrypted:	false
SSDEEP:	1536:iGl5rIeL2xcqzOGqaTUvkCtcWDAgD3Xp3uwTl5SO:im5rIF7KkCh+wB5S
MD5:	9F9F1387FFBD8CC7B69BF45AAB812237
SHA1:	9AFAA08B37A8A94A92B9C416F62058CFEFC7FFB4
SHA-256:	4225264E7E015BFB2A2D76EE529C7C38B2ACA81C9E83BE858FE11342DA4948E3
SHA-512:	34832DC1D74D7A68835C7C571E68D5230021DE503BE2CD60318116D5C8E26F3F97B9574D772C0F647A561F3D7B7D0437584F7BEAEC9EA7672CD6417E40EFC124
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Q.Y.Q.Y.Q.Y.J\|.S.Y.X..\|.Y.X..C.Y.X..!.Y.v'".R.Y.Q.X.2.Y.X..V.Y.X..P.Y.X..P.Y.RichQ.Y.........PE..L...jx.W...........!.........`......]L....................................................@........................../.......(..<....p..................................................................@...............H............................text...?........................... ..`.rdata...1.......2..................@..@.data....-...@.......&..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\is-IGODE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	6.355626141676483
Encrypted:	false
SSDEEP:	1536:ZjPXhenY/+D4OrxvBPo+Svf92dqr9veJkYlnzBPRfcm9dr:RXhD/44MpPo+2fwqrctZkm9
MD5:	DD6A826FC7EEEAF60EADED99E5336337
SHA1:	205C4758050A49E42C4874E240D5CC3CB372707B
SHA-256:	83C7A058D60966445360B45B6BB0B7491982BED6F32DBE40CB301957A7837CFD
SHA-512:	1F7F807FC21F7568D4BA6EE1566B7F28169EBD71E65376A82DCB8B2F06AB377D64FC59021117FD4F528FF08DE4AE19DB2877C7D708C176D144145A376F4A6739
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z.e.).e.).e.)...).e.)..1).e.)...).e.)...).e.)..<).e.).e.).e.)...).e.)..4).e.)..2).e.)Rich.e.)........................PE..L...O..W...........!.........n......K]....... ......................................4(....@..........................Y.......Q..P....................................!...............................H..@............ ..\............................text...-........................... ..`.rdata.. ;... ...<..................@..@.data....2...`.......P..............@....rsrc................d..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\libdpcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.358233973445306
Encrypted:	false
SSDEEP:	1536:iGl5rIeL2xcqzOGqaTUvkCtcWDAgD3Xp3uwTl5SO:im5rIF7KkCh+wB5S
MD5:	9F9F1387FFBD8CC7B69BF45AAB812237
SHA1:	9AFAA08B37A8A94A92B9C416F62058CFEFC7FFB4
SHA-256:	4225264E7E015BFB2A2D76EE529C7C38B2ACA81C9E83BE858FE11342DA4948E3
SHA-512:	34832DC1D74D7A68835C7C571E68D5230021DE503BE2CD60318116D5C8E26F3F97B9574D772C0F647A561F3D7B7D0437584F7BEAEC9EA7672CD6417E40EFC124
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Q.Y.Q.Y.Q.Y.J\|.S.Y.X..\|.Y.X..C.Y.X..!.Y.v'".R.Y.Q.X.2.Y.X..V.Y.X..P.Y.X..P.Y.RichQ.Y.........PE..L...jx.W...........!.........`......]L....................................................@........................../.......(..<....p..................................................................@...............H............................text...?........................... ..`.rdata...1.......2..................@..@.data....-...@.......&..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\libsilkidcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	6.355626141676483
Encrypted:	false
SSDEEP:	1536:ZjPXhenY/+D4OrxvBPo+Svf92dqr9veJkYlnzBPRfcm9dr:RXhD/44MpPo+2fwqrctZkm9
MD5:	DD6A826FC7EEEAF60EADED99E5336337
SHA1:	205C4758050A49E42C4874E240D5CC3CB372707B
SHA-256:	83C7A058D60966445360B45B6BB0B7491982BED6F32DBE40CB301957A7837CFD
SHA-512:	1F7F807FC21F7568D4BA6EE1566B7F28169EBD71E65376A82DCB8B2F06AB377D64FC59021117FD4F528FF08DE4AE19DB2877C7D708C176D144145A376F4A6739
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z.e.).e.).e.)...).e.)..1).e.)...).e.)...).e.)..<).e.).e.).e.)...).e.)..4).e.)..2).e.)Rich.e.)........................PE..L...O..W...........!.........n......K]....... ......................................4(....@..........................Y.......Q..P....................................!...............................H..@............ ..\............................text...-........................... ..`.rdata.. ;... ...<..................@..@.data....2...`.......P..............@....rsrc................d..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ZKFPSensors\libzklibcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.606697027164951
Encrypted:	false
SSDEEP:	3072:koXMFtFmwr5KjXniSzUKSX0id92iaq93Qv34cCwukfU4xbShdxyKH7AbOI5Zp+L:kocDj1FKxiqq93Qv3fCJ4djp+
MD5:	C2FE3529B22E51386978C1B4B6963CC8
SHA1:	0B3178295C9A9AB7394993C9B4C37739E46A4217
SHA-256:	89924EAFE7657530C2B73C44EA2A8B6964B7E0B9DB35B6EBF5A631CEE33F32B6
SHA-512:	BC3777ED6446BDB662573CD64A6108917C12F1E3F9F16EE189A3855D39FF8C15596ABAA987D1C663A7FE4767280F2342641AD6D4FAE8D04243547568706BC455
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H(4f.IZ5.IZ5.IZ5.1.5=IZ5.1.5.IZ5.1.5.IZ5+.!5.IZ5.I[5fIZ5.1.5.IZ5.1.5.IZ5.1.5.IZ5Rich.IZ5........PE..L...kx.W...........!................ v..............................................-b....@..........................?.......6..<...............................\...................................8+..@...............h............................text...?........................... ..`.rdata...@.......B..................@..@.data...\D...P...(...(..............@....rsrc................P..............@..@.reloc........... ...R..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\fppswsk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4320616
Entropy (8bit):	6.489912478204196
Encrypted:	false
SSDEEP:	49152:eZFWl1dKQJ1GoG+XzUDFykIuTBeC729X587Df/0F3KH5yh:SAJ1SARCyI7gcZW
MD5:	F7C9288B13DF92A38D888A73A832C833
SHA1:	463825CA97E03A9215295630D7F75B18F776737E
SHA-256:	6D20AE8BAFC163EC9F2C178A2DE134DE3255651BA8E18974FF204B0830F7558B
SHA-512:	B56CB4D323AAEE13EB8CD3986CDB91C65FB7386B0105A434B35ACEBF3ED6270EC35C3680616D73C220194B4BC785D700B256BA93C5A93391EFB98E712ECC0FEA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#F{tg'.'g'.'g'.'b+.'e'.'..k'f'.'@.h'Y'.'g'.'*'.'.0J'~'.'.8.'c'.'@.x'M&.'.(H'r'.'g'.'.'.'@.{'.'.'@.o'f'.'@.i'f'.'@.m'f'.'Richg'.'........PE..L...M.(K.........."!......,..0.......d....... ,.............................. B......YB...............................4.......4......@5...............A......P5.d....0,.......................2.....................t.4..............................text...J.,.......,................. ..`.rdata....... ,...... ,.............@..@.data........04..p...04.............@....idata........4.. ....4.............@....data1........5.......4.............@....tls......... 5.......4.............@...mx_api.......05.......4.............@....rsrc........@5.......4.............@..@.v-lizer.....P5.......5.............`...................................................................................................................................

C:\Windows\SysWOW64\fpslib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688400
Entropy (8bit):	6.691580706898385
Encrypted:	false
SSDEEP:	12288:lnPxkdzJtF7r2BrEyCRizwXKqJ3g/BnqS7rkx+D1l6:lnPxkdzJtI/wXKq3g/Bnr7rkOl6
MD5:	4A8AA2CB879DDEAE2D8E5BAB5BF310B2
SHA1:	FF956C8593F55CAB33BC087B2F624B14B710E603
SHA-256:	6626B4CA32408BCDB4CFD5E3E84FAF7D1C6C49C4674B9B319CF68286575F416D
SHA-512:	192BD3134910D92778D2DD9EAA4CB2D8A19140B00469B373626162148986CA91D4DF36488A90E8064E2A7684B1261EB56420AEED4612EE9C56C59991E01C94F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................8......G...............).......?.6.....6...............-.....Rich............PE..L...MA.W...........!...............)p.......@............................................@.............................L.......x.... ...............B...?...0...`...B...............................................@...............................text....)......................... ..`.rdata...c...@...d..................@..@.data...hh.......*..................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-0V5J0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165176
Entropy (8bit):	6.560570170271606
Encrypted:	false
SSDEEP:	3072:N0BpDu0388NCcsMe3k0m7oe+qtCQ793QzmJUOdbYh5USxHsg0:Ni6a88NC/kxoFa3vTdYgtg0
MD5:	C49BA01ECCF2393748CB89FAA08D4AD1
SHA1:	145E711B6009A3745C0EDEA6E8FE6B6FDC0F5DE6
SHA-256:	8CCEF519FE35BE1BD03F148D1B8ED50915688A9F14C29FA19A85536B47D27B64
SHA-512:	04638CF7D07AADB26132287C5A267F4EAF4BDD28DE3F1D29A23F7893C257879C6275BDEFF1AB3FE68E9053EC6EB1501AACABF3A1F302D3662E30E15465D0B347
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).D.m.Qm.Qm.Qd..Qy.Qd..Q..Qd..QZ.Qs..Qi.QJ.QQb.Qm.+Q..QJ.GQo.Qd..Qh.Qd..Ql.Qs..Ql.Qd..Ql.QRichm.*Q........................PE..L....b.S...........!......................................................................@..........................6.......).......................l..8.......P.......................................@...............4............................text............................... ..`.rdata...[.......\..................@..@.data...x6...@.......&..............@....rsrc................@..............@..@.reloc..\|%.......&...F..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-1C0V4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118040
Entropy (8bit):	6.796287551172948
Encrypted:	false
SSDEEP:	1536:TTK8CfkHAPmqEVAHKAFP1OPrCN8vq4PKfbMsZ8KFPcE5JeJpnYW4r/Ah:kX1qcderoQmFPcE5JeJpYn
MD5:	BAE20EC3CDF6DB2CFE5961767999895C
SHA1:	1D44161109F1958B2690D4758F46AC2BB4B67B94
SHA-256:	463D59EC9ECA98DA82DF60824E06FEDB88678B8037B5140CD7E0FF043ABECB0A
SHA-512:	898F551EAEDF5320E60BB9E644BA78F48B6031FCAEA3F105EB39BC8FA93B25EAD7D54E6C662DA97EC25DA4349F1B53925CB216F1E0BDA5A0F6F6CE2BAC1EE7AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:...:...:..[u...:...h...:...h...:...h..d:.......:...:..:...h...:...h...:...h...:...h...:..Rich.:..........................PE..L......W...........!.....(...b......IT.......@.......................................P..............................0j..M...\|b..<........................?...........A...............................\..@............@..P............................text....'.......(.................. ..`.rdata..}....@...0...,..............@..@.data... Q...p.......\..............@....rsrc................r..............@..@.reloc..,............x..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-4C9RD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151760
Entropy (8bit):	6.644484662091011
Encrypted:	false
SSDEEP:	3072:HqqnwquQsADzjeJN40uuum5j7RVIM5sjWpNeYKQ9WMie:Xn6bAD+vu1WX
MD5:	98AEBB9C04F2D52CC9D337ED5F7DF53F
SHA1:	5CAA9349E563143928AA5BED297DC4BF985C462C
SHA-256:	11631AF793CBB232F9DE96C16BCA6E13B8C4CD3F5C37ABF5CF91A7A2345671ED
SHA-512:	8BBF8F4B07BFDCA4B3A67767E09B277224D1C682AE09B65A37EC36DC4E3EBD97F311AADDBBD8542F1FAB278FD17E2B38C25F3AC8ECEDE3258EB5F19EB7B3CA3C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Windows\SysWOW64\is-4C9RD.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................d....................@..........................`......................................................0...$...............>......H"..................................................................................CODE.... ........................... ..`DATA....P...........................@...BSS.....%................................idata..............................@....edata..............................@..P.reloc..H".......$..................@..P.rsrc....$...0...$..................@..P.............`......................@..P................................................................................................................................................................................

C:\Windows\SysWOW64\is-52V98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138552
Entropy (8bit):	6.465515781360138
Encrypted:	false
SSDEEP:	3072:YUFy6J79FXJVqpziLye636NL58dxBvOcXVQv2:dTh9FbqpzmC6NLSOY82
MD5:	BA6A317BF53117FA3A5AC4DF716F5F06
SHA1:	193224C2D2A915F1C855BD6A17CD0C66256E2CDE
SHA-256:	549BBC1E38AFBB51A6E4957C1951355CE16ADC35EE5160B642F4FB9E8DAC0466
SHA-512:	97F116EAC522BECED43BE01015518CA2F807531376998D92D5B3EEAFF52B003DE4CC5B689DF39EF7459092D5041A64D1A9D757D1E76725201FF13CFE165F6321
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u....................^.......^.......^........................o....^.......^.......^.......^......Rich............................PE..L......S...........!.....f...................................................P......E.....@.....................................d.......................8.... ..@.......................................@.......................@....................text...ee.......f.................. ..`.rdata...\.......^...j..............@..@.data...............................@....rsrc...............................@..@.reloc...#... ...$..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-591T5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	6.3158448045705855
Encrypted:	false
SSDEEP:	1536:BMwmBuUCdDovkjUAKabnDNOLXkVJs+qybP0l6eoaG5e512Mh8T:uHBcq2Dq1yIFoj5er2Mh2
MD5:	91BF06A384DFDEE7869CE901C845664B
SHA1:	427C4D53425483E87209B27C714E4552443E5F8B
SHA-256:	6A795F895741182491E6DBE47E2EE49ED1BDD36CF8D5E8A1759968660506AAB8
SHA-512:	2A62A9AE784CB7B00FD1146293CDD8312613300CA23B499C1BF7321A78BE3BC1EDF2E5456D4B6BCD068A5912EA3A07F378D7F8C8BAC590D3C8C05EE1D68026E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............f.......f.......f........l..............f.......f.......L.......f......Rich....................PE..L...cx.W...........!................IC..............................................?.....@..........................0.......(..<...............................0...................................( ..@...............X............................text...V........................... ..`.rdata...U.......V..................@..@.data...\|2...@......................@....rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-59OUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5831808
Entropy (8bit):	6.574573699834221
Encrypted:	false
SSDEEP:	49152:43i6/VrgSoJg6MsXI8rA6lEE2sdl4AY8myNxTI9hT06J7jTiL/jnVSpAPkhlQgiI:43d/OJWlJ4EE2sd7mKI370VehlDiHRS
MD5:	9089A801BB66EBCD40D65FAC238647BD
SHA1:	DC33970C166F171115B919E5B698BB0CA99B4BA1
SHA-256:	531C05056C2B7ED7DECE8862F1FEF637992E14103E18683D192E72807ADB43AB
SHA-512:	95128DF50A1BC71EF9E2DF5D46D8FB093755AA451D05377247A7E41B160B627B496D52997D3817364CF52AE0CA5602F0CF350091AE64F5788D589FF4CB13BDF6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%yR.D...D...D....i..D...S...D...H...D....j..D...D...D...[...D....z..E..BKJ..D...D..VD....y.+D....m..D....k..D....o..D..Rich.D..........................PE..L....9WO.........."!......:.........#.,.......:...............................Y.....4.Y..............................KD...... G......pG.(.............X..>....G.hs....:.....................h.B......................&G..............................text... .:.......:................. ..`.rdata...~....:.......:.............@..@.data........`D......`D.............@....idata..C.... G.. ... F.............@....data1..H....@G......@F.............@....tls.........PG......PF.............@...mx_api.......`G......`F.............@....rsrc...(....pG......pF.............@..@.v-lizer.=....G..=....F.............`...................................................................................................................

C:\Windows\SysWOW64\is-5B4KM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688400
Entropy (8bit):	6.691580706898385
Encrypted:	false
SSDEEP:	12288:lnPxkdzJtF7r2BrEyCRizwXKqJ3g/BnqS7rkx+D1l6:lnPxkdzJtI/wXKq3g/Bnr7rkOl6
MD5:	4A8AA2CB879DDEAE2D8E5BAB5BF310B2
SHA1:	FF956C8593F55CAB33BC087B2F624B14B710E603
SHA-256:	6626B4CA32408BCDB4CFD5E3E84FAF7D1C6C49C4674B9B319CF68286575F416D
SHA-512:	192BD3134910D92778D2DD9EAA4CB2D8A19140B00469B373626162148986CA91D4DF36488A90E8064E2A7684B1261EB56420AEED4612EE9C56C59991E01C94F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................8......G...............).......?.6.....6...............-.....Rich............PE..L...MA.W...........!...............)p.......@............................................@.............................L.......x.... ...............B...?...0...`...B...............................................@...............................text....)......................... ..`.rdata...c...@...d..................@..@.data...hh.......*..................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-7O1AC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-8NF8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459064
Entropy (8bit):	6.313605923757661
Encrypted:	false
SSDEEP:	12288:p+ppHCHOKCiYMYwBbkUKZwX5CmkSoABcU/:UCQJw6UKwQTABh/
MD5:	C10863BBBF6A8617F9CED1464B9BF74E
SHA1:	2CB8B1EDAEFFAE27AF9AD6F4B989ABA1670C8606
SHA-256:	689290FCC442BA71A8FA321E42FCE072C375CFD479F35A7B3B67E7237D7EE08F
SHA-512:	C3890918EF2E579D2F0AD133134C22C826A69ECB9088D3263485D94536EE0090BB330C8D0B97F49F5CE21D1E02F58664C9F25281E4438C3E1D31361291AB3753
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..`...`...`..V....`..V....`.......`.......`.......`...a.$.`..V....`..V....`..V....`..V....`.Rich..`.................PE..L......R...........!................G........................................P.......I....@..........................V......$D..........................8.......dU..................................(u..@...............<............................text...J........................... ..`.rdata...a.......b..................@..@.data....C...p..."...L..............@....rsrc................n..............@..@.reloc...r.......t...t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-A1JBL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255800
Entropy (8bit):	6.369747426673245
Encrypted:	false
SSDEEP:	6144:SKAtooJhFASWtDPLI9oPx8Akibgmmvo8BMv:nAtPhWyYx8Li8fvBg
MD5:	E4BC242BD7FD45CC384C0B63F9ED4D18
SHA1:	9FABBBCB926570B35C74CB33D199E658F027165C
SHA-256:	B3F21FA15C0574ECBFA3969E1C7476F9EDA95BF57E758DA203B140CC6AE1BBDD
SHA-512:	E9B3E90FDA25A05B71E20E16932F1C9ACCFE306C875624F2A761E7A15B8F354F031468860FACCB3921722FE7D1A8074CEC155E94BA63F79E94B4D424355C7BD1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............\...\...\.CB\...\.Cv\...\.w\...\.._\...\..O\...\...\S..\.Cw\...\.CG\...\.CF\...\.CA\...\Rich...\................PE..L......R...........!................`........................................ ......p.....@..........................s......4b..........................8........-......................................@............................................text...g........................... ..`.rdata..............................@..@.data....=...........h..............@....rsrc...............................@..@.reloc..hC.......D..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-AP1V0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.059919266371409
Encrypted:	false
SSDEEP:	192:f843l6SfB50EXIILkfaCyJb0va6JyvxNAN44yuBo28L2fDCXa:kmMS5KEXIILKfyJbSOxyNw28L2fX
MD5:	C895EBD2211BEF7EF5E220A0AD2094CA
SHA1:	0383D548E5F31E036201CF56B7BC166176BC5746
SHA-256:	F53D7E5CADD2C36A1D3C49E42144EFE25399FFA8D1F9B8B317B0CD760BFEEFFB
SHA-512:	4F1624CC21FD0EFB41F8493A6066F62D5E61EC5F2BD0BDCA6BDD3AEC5B12E9910C893F7BE304EC592DD54BDB76D806111FAF7176C74BBCA785CB793410A92051
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ax.W...........!................H... ...`....@.. ....................................@.................................XH..S....`..@............................G............................................... ............... ..H............text....(... ..................... ..`.rsrc...@....`.......,..............@..@.reloc...............0..............@..B.................H......H.......,...............................................................0..A.......~"....~"...(....%.....(....}....~.....{....(....,.(....&~#....~.(....&.{....(....&(....&~"....(.....0..........~.....{....(....,.~7.....(....}....~.....{....(....,.~(....@.......@..{.... O.....(......(....&.(.....o....} ....{.....\|.....\|.....\|....(....&~"......0..@........r...p} ...~.....{....(....,..{....(....&.~....}....~"...~5....0..g.......~.....{....(....,.~5....,...i.2...0.~'.

C:\Windows\SysWOW64\is-GVF50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	184120
Entropy (8bit):	6.69342633478373
Encrypted:	false
SSDEEP:	3072:Q/vIYPhJublrfE5hm8uh2VTLajLDH59BM+g0cqHmapxr5Z9Zp:Q/ZuZrfEUh2YzH42x
MD5:	70D80A367E085CDCE671CA52DACF8DE6
SHA1:	DD475109FE1D099F550D04F35F8DD125ADF8079C
SHA-256:	4035443C439B4E6F17DFF9A96FF231BB7B26A947503D28E9EF5EC4851D24AF18
SHA-512:	213FA05805743B165A8E8F12A34FC223E7573174A5C749E6BDCC1780DDD8E218B8D186319F3B1B0F9A6622F96910AB16E6F87A671731DD4433061E80FC83AEF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Zw.].............n&./....n7......n!.....9........n1..............n+......n0......D6......n3.....Rich............PE..L...8c.S...........!..... ..........<3.......0............................................@..........................}.......q..x.......................8...........p2..............................xi..@............0..,............................text............ .................. ..`.rdata..QP...0...R...$..............@..@.data....7...........v..............@....rsrc...............................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-HAADG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.557869243384565
Encrypted:	false
SSDEEP:	1536:RgyebjsN4t+7B+2bNKbULJ55N3sv5Oqw:Ky9qtUXV2v5a
MD5:	128CC65B72B7453C61E944127F273B3F
SHA1:	85C66DC2FC167FDCE429A3B8956335E6121A1827
SHA-256:	538091707189F6471B5C6C6E31F3D4D47AACAD368A976F3B30E17EE625DC08CE
SHA-512:	E81533F09ACAAFC9E887F364454601A24E8B0446D8D5CBB141CA719D14A50DEC4152615C2DCCAECCB5C6FD29C973D7C14C41982A75429E42D2C2ACDA21B5313C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0J4#t+Zpt+Zpt+Zp}S.pj+Zp}S.ph+Zp}S.p.+Zp}S.pv+ZpS.!pq+Zpt+[p"+Zp}S.pv+Zp}S.pu+Zpjy.pu+Zp}S.pu+ZpRicht+Zp................PE..L...ex.W...........!.........\.......=.......................................p............@.......................... ......,...<....P.......................`.. ...P...................................@............................................text............................... ..`.rdata..^3.......4..................@..@.data........0......................@....rsrc........P......................@..@.reloc.......`.......$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-IPKM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	6.624345941101949
Encrypted:	false
SSDEEP:	3072:4vi+88QSSyZUnK4xTic7BUVw93Qv34cCwukfU4xbSjLDyUDtR75MW5UplMYyJ/:H+bJyKRTw93Qv3fCJ44yUnqplMx
MD5:	AF53B2DB4210DC756322FDF27F2E5557
SHA1:	9C41E4B464FDCC9F977B008E1ED800BEF42FD971
SHA-256:	E5320D8C27279E8D4856C49BB3EC54176F4B3F87B69C9053EE9C64BFD153ED31
SHA-512:	FED02F2A58021D3E592B8648352DAAEE643C46DFC5A2067B42911A7731FE8908002150E747AF2058ADB4D1CE1B66B14855933196E0D8A166BE1E2B8BAEFCC13F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.aX................................(...................;.t.........c...................................Rich............................PE..L...hx.W...........!................................................................x.....@..........................X..g....O..d...................................................................p>..@............................................text............................... ..`.rdata..WM.......N..................@..@.data....E...`...*...J..............@....rsrc................t..............@..@.reloc...#.......$...v..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-JDKR1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4320616
Entropy (8bit):	6.489912478204196
Encrypted:	false
SSDEEP:	49152:eZFWl1dKQJ1GoG+XzUDFykIuTBeC729X587Df/0F3KH5yh:SAJ1SARCyI7gcZW
MD5:	F7C9288B13DF92A38D888A73A832C833
SHA1:	463825CA97E03A9215295630D7F75B18F776737E
SHA-256:	6D20AE8BAFC163EC9F2C178A2DE134DE3255651BA8E18974FF204B0830F7558B
SHA-512:	B56CB4D323AAEE13EB8CD3986CDB91C65FB7386B0105A434B35ACEBF3ED6270EC35C3680616D73C220194B4BC785D700B256BA93C5A93391EFB98E712ECC0FEA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#F{tg'.'g'.'g'.'b+.'e'.'..k'f'.'@.h'Y'.'g'.'*'.'.0J'~'.'.8.'c'.'@.x'M&.'.(H'r'.'g'.'.'.'@.{'.'.'@.o'f'.'@.i'f'.'@.m'f'.'Richg'.'........PE..L...M.(K.........."!......,..0.......d....... ,.............................. B......YB...............................4.......4......@5...............A......P5.d....0,.......................2.....................t.4..............................text...J.,.......,................. ..`.rdata....... ,...... ,.............@..@.data........04..p...04.............@....idata........4.. ....4.............@....data1........5.......4.............@....tls......... 5.......4.............@...mx_api.......05.......4.............@....rsrc........@5.......4.............@..@.v-lizer.....P5.......5.............`...................................................................................................................................

C:\Windows\SysWOW64\is-LV194.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	6.429733868491853
Encrypted:	false
SSDEEP:	1536:OzY286PxzchbWVJMSlt5jwcP21wppYAufIY7r2SX1zApBhPi2aCc04AxyPcplEe7:OkZGxziyVJZXRPSImrVXcJc0sGbyvT6
MD5:	8993DE39EAEB498F92ECCE2DEB10E05A
SHA1:	7AA06A762B05A0BDD06D36368456BABC349345A8
SHA-256:	9A1A952412E5B224DDD76EA083E78ECFE65D9C4CD452C642B302F44FBA488AC4
SHA-512:	B2DAB2918A60EB67EC4F47084B3B47639D268B12DBA3B2D5F360955854C3AE92B379D6265CCE6D5D98E18128EED162A6FF69BF8D2DF2A006809908E720713E9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.._.q._.q._.q.D..G.q.D..Q.q.D..=.q.Vo.Z.q._.p...q.D..X.q.D..^.q.D..^.q.Rich_.q.........................PE..L......R...........!................8\.......................................0......j.....@.....................................<....................\...>... ..........................................@...............$............................text............................... ..`.rdata..[/.......0..................@..@.data........ ...@..................@....rsrc................H..............@..@.reloc....... .......L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-N97T5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346936
Entropy (8bit):	6.85039386209873
Encrypted:	false
SSDEEP:	6144:gndpDUUaWnuD7T5HKNO05hOG2FEWdPhVhbkqljHlpC+TEXXVxMbmKIiAOmLjhz:gndpDUUaku3ThK75hOG2FEWdJzVbCwEh
MD5:	5E80B50DDFE719AE693B52EB73B274C5
SHA1:	B9D8F57D5ED01A1162CFB06A47F53E8035BDD947
SHA-256:	17168F1BA924B0397FCE6BFE4108A75DA09F66825BB4F9D40070247C665BAD36
SHA-512:	5A915E763550600A4306D5A17A53ED13CA60BC0F28F30EBC67D7FA519BB8126B71B333003B6ACDB928ED97EB4CF80C736C16CA4D16A26FEFF10C3371C2CF3125
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k.r.k...b.......yeJ.L...ye..E...yeK.....k.e.r...k.t.c...yeN.....yez.c...ye{.c...ye\|.c...Richb...................PE..L...*..S...........!......... .......,....... .......................................B....@.............................q.......(....P...............2..8....`......p!..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`R....... ..................@....rsrc........P......................@..@.reloc..2/...`...0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-NTD91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	6.429625776278673
Encrypted:	false
SSDEEP:	1536:7zY286PxzchbWVJMSlt5jwcP21wppYAufIY7r2SX1zApBhPi2aCc04AxyPcplEeB:7kZGxziyVJZXRPSImrVXcJc0sGbyvgh
MD5:	FE4872D8582C30B06F526877E1D3C26E
SHA1:	187A5AF6D66FFDFEF7CB236E54D633B0EE51D885
SHA-256:	D8F655CD3A60AD5F13505990F544E12923B9F67D5A8124F3D3BF84FF892B76B9
SHA-512:	B20B9543A62E22F507091F8FF91505DBFD5C773C7BCA167C3ABF11D16107E10E967A64DF6F04C045F6A831189ACF939F06E77F59C349C437DF3EF5B02F7C3A58
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.._.q._.q._.q.D..G.q.D..Q.q.D..=.q.Vo.Z.q._.p...q.D..X.q.D..^.q.D..^.q.Rich_.q.........................PE..L......R...........!................8\.......................................0............@.....................................<....................\...>... ..........................................@...............$............................text............................... ..`.rdata..[/.......0..................@..@.data........ ...@..................@....rsrc................H..............@..@.reloc....... .......L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-PR4RR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688400
Entropy (8bit):	6.691580706898385
Encrypted:	false
SSDEEP:	12288:lnPxkdzJtF7r2BrEyCRizwXKqJ3g/BnqS7rkx+D1l6:lnPxkdzJtI/wXKq3g/Bnr7rkOl6
MD5:	4A8AA2CB879DDEAE2D8E5BAB5BF310B2
SHA1:	FF956C8593F55CAB33BC087B2F624B14B710E603
SHA-256:	6626B4CA32408BCDB4CFD5E3E84FAF7D1C6C49C4674B9B319CF68286575F416D
SHA-512:	192BD3134910D92778D2DD9EAA4CB2D8A19140B00469B373626162148986CA91D4DF36488A90E8064E2A7684B1261EB56420AEED4612EE9C56C59991E01C94F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................8......G...............).......?.6.....6...............-.....Rich............PE..L...MA.W...........!...............)p.......@............................................@.............................L.......x.... ...............B...?...0...`...B...............................................@...............................text....)......................... ..`.rdata...c...@...d..................@..@.data...hh.......*..................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-TGQ65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.511252255263352
Encrypted:	false
SSDEEP:	1536:V78V52TE0K60GeKCwy/OV+8lmYQukZRMF:K57v6VhASmYX0RMF
MD5:	ACAEADA6A9B28DCE66AA50893E1962A0
SHA1:	7D241B540D6268F317941F9E0151304EFE9E4FCC
SHA-256:	EDD764C562628ECB2FDB4C8B5C48827C8221278333F632ADACB82C3644CC9B42
SHA-512:	0FEA0D6D5CC8DF6A015AF41E6764E3C885D6634D8EC4320B5C747C3E11B745B25806A0D22F8B21C115BE897BA1CE51BE788F322CE6B3825EDEC0AEE109AC0DD8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..^..I^..I^..IWpYIE..IWpHIE..IWp^I...Iy.I]..I^..I...IWpTI\..IWpOI_..I@ZII_..IWpLI_..IRich^..I........PE..L...bx.W...........!.........l.......5.......................................p...........@.........................@ ..........(....P.......................`..p...0...............................8...@............................................text............................... ..`.rdata..6B.......D..................@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..,....`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libcorrect.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.511252255263352
Encrypted:	false
SSDEEP:	1536:V78V52TE0K60GeKCwy/OV+8lmYQukZRMF:K57v6VhASmYX0RMF
MD5:	ACAEADA6A9B28DCE66AA50893E1962A0
SHA1:	7D241B540D6268F317941F9E0151304EFE9E4FCC
SHA-256:	EDD764C562628ECB2FDB4C8B5C48827C8221278333F632ADACB82C3644CC9B42
SHA-512:	0FEA0D6D5CC8DF6A015AF41E6764E3C885D6634D8EC4320B5C747C3E11B745B25806A0D22F8B21C115BE897BA1CE51BE788F322CE6B3825EDEC0AEE109AC0DD8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..^..I^..I^..IWpYIE..IWpHIE..IWp^I...Iy.I]..I^..I...IWpTI\..IWpOI_..I@ZII_..IWpLI_..IRich^..I........PE..L...bx.W...........!.........l.......5.......................................p...........@.........................@ ..........(....P.......................`..p...0...............................8...@............................................text............................... ..`.rdata..6B.......D..................@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..,....`.......0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libsilkid.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.557869243384565
Encrypted:	false
SSDEEP:	1536:RgyebjsN4t+7B+2bNKbULJ55N3sv5Oqw:Ky9qtUXV2v5a
MD5:	128CC65B72B7453C61E944127F273B3F
SHA1:	85C66DC2FC167FDCE429A3B8956335E6121A1827
SHA-256:	538091707189F6471B5C6C6E31F3D4D47AACAD368A976F3B30E17EE625DC08CE
SHA-512:	E81533F09ACAAFC9E887F364454601A24E8B0446D8D5CBB141CA719D14A50DEC4152615C2DCCAECCB5C6FD29C973D7C14C41982A75429E42D2C2ACDA21B5313C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0J4#t+Zpt+Zpt+Zp}S.pj+Zp}S.ph+Zp}S.p.+Zp}S.pv+ZpS.!pq+Zpt+[p"+Zp}S.pv+Zp}S.pu+Zpjy.pu+Zp}S.pu+ZpRicht+Zp................PE..L...ex.W...........!.........\.......=.......................................p............@.......................... ......,...<....P.......................`.. ...P...................................@............................................text............................... ..`.rdata..^3.......4..................@..@.data........0......................@....rsrc........P......................@..@.reloc.......`.......$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libusb0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libzkfp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	6.624345941101949
Encrypted:	false
SSDEEP:	3072:4vi+88QSSyZUnK4xTic7BUVw93Qv34cCwukfU4xbSjLDyUDtR75MW5UplMYyJ/:H+bJyKRTw93Qv3fCJ44yUnqplMx
MD5:	AF53B2DB4210DC756322FDF27F2E5557
SHA1:	9C41E4B464FDCC9F977B008E1ED800BEF42FD971
SHA-256:	E5320D8C27279E8D4856C49BB3EC54176F4B3F87B69C9053EE9C64BFD153ED31
SHA-512:	FED02F2A58021D3E592B8648352DAAEE643C46DFC5A2067B42911A7731FE8908002150E747AF2058ADB4D1CE1B66B14855933196E0D8A166BE1E2B8BAEFCC13F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.aX................................(...................;.t.........c...................................Rich............................PE..L...hx.W...........!................................................................x.....@..........................X..g....O..d...................................................................p>..@............................................text............................... ..`.rdata..WM.......N..................@..@.data....E...`...*...J..............@....rsrc................t..............@..@.reloc...#.......$...v..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libzkfpcsharp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.059919266371409
Encrypted:	false
SSDEEP:	192:f843l6SfB50EXIILkfaCyJb0va6JyvxNAN44yuBo28L2fDCXa:kmMS5KEXIILKfyJbSOxyNw28L2fX
MD5:	C895EBD2211BEF7EF5E220A0AD2094CA
SHA1:	0383D548E5F31E036201CF56B7BC166176BC5746
SHA-256:	F53D7E5CADD2C36A1D3C49E42144EFE25399FFA8D1F9B8B317B0CD760BFEEFFB
SHA-512:	4F1624CC21FD0EFB41F8493A6066F62D5E61EC5F2BD0BDCA6BDD3AEC5B12E9910C893F7BE304EC592DD54BDB76D806111FAF7176C74BBCA785CB793410A92051
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ax.W...........!................H... ...`....@.. ....................................@.................................XH..S....`..@............................G............................................... ............... ..H............text....(... ..................... ..`.rsrc...@....`.......,..............@..@.reloc...............0..............@..B.................H......H.......,...............................................................0..A.......~"....~"...(....%.....(....}....~.....{....(....,.(....&~#....~.(....&.{....(....&(....&~"....(.....0..........~.....{....(....,.~7.....(....}....~.....{....(....,.~(....@.......@..{.... O.....(......(....&.(.....o....} ....{.....\|.....\|.....\|....(....&~"......0..@........r...p} ...~.....{....(....,..{....(....&.~....}....~"...~5....0..g.......~.....{....(....,.~5....,...i.2...0.~'.

C:\Windows\SysWOW64\match.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	6.429733868491853
Encrypted:	false
SSDEEP:	1536:OzY286PxzchbWVJMSlt5jwcP21wppYAufIY7r2SX1zApBhPi2aCc04AxyPcplEe7:OkZGxziyVJZXRPSImrVXcJc0sGbyvT6
MD5:	8993DE39EAEB498F92ECCE2DEB10E05A
SHA1:	7AA06A762B05A0BDD06D36368456BABC349345A8
SHA-256:	9A1A952412E5B224DDD76EA083E78ECFE65D9C4CD452C642B302F44FBA488AC4
SHA-512:	B2DAB2918A60EB67EC4F47084B3B47639D268B12DBA3B2D5F360955854C3AE92B379D6265CCE6D5D98E18128EED162A6FF69BF8D2DF2A006809908E720713E9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.._.q._.q._.q.D..G.q.D..Q.q.D..=.q.Vo.Z.q._.p...q.D..X.q.D..^.q.D..^.q.Rich_.q.........................PE..L......R...........!................8\.......................................0......j.....@.....................................<....................\...>... ..........................................@...............$............................text............................... ..`.rdata..[/.......0..................@..@.data........ ...@..................@....rsrc................H..............@..@.reloc....... .......L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\matchdll.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	6.429625776278673
Encrypted:	false
SSDEEP:	1536:7zY286PxzchbWVJMSlt5jwcP21wppYAufIY7r2SX1zApBhPi2aCc04AxyPcplEeB:7kZGxziyVJZXRPSImrVXcJc0sGbyvgh
MD5:	FE4872D8582C30B06F526877E1D3C26E
SHA1:	187A5AF6D66FFDFEF7CB236E54D633B0EE51D885
SHA-256:	D8F655CD3A60AD5F13505990F544E12923B9F67D5A8124F3D3BF84FF892B76B9
SHA-512:	B20B9543A62E22F507091F8FF91505DBFD5C773C7BCA167C3ABF11D16107E10E967A64DF6F04C045F6A831189ACF939F06E77F59C349C437DF3EF5B02F7C3A58
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.._.q._.q._.q.D..G.q.D..Q.q.D..=.q.Vo.Z.q._.p...q.D..X.q.D..^.q.D..^.q.Rich_.q.........................PE..L......R...........!................8\.......................................0............@.....................................<....................\...>... ..........................................@...............$............................text............................... ..`.rdata..[/.......0..................@..@.data........ ...@..................@....rsrc................H..............@..@.reloc....... .......L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\zkfinger10-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5831808
Entropy (8bit):	6.574573699834221
Encrypted:	false
SSDEEP:	49152:43i6/VrgSoJg6MsXI8rA6lEE2sdl4AY8myNxTI9hT06J7jTiL/jnVSpAPkhlQgiI:43d/OJWlJ4EE2sd7mKI370VehlDiHRS
MD5:	9089A801BB66EBCD40D65FAC238647BD
SHA1:	DC33970C166F171115B919E5B698BB0CA99B4BA1
SHA-256:	531C05056C2B7ED7DECE8862F1FEF637992E14103E18683D192E72807ADB43AB
SHA-512:	95128DF50A1BC71EF9E2DF5D46D8FB093755AA451D05377247A7E41B160B627B496D52997D3817364CF52AE0CA5602F0CF350091AE64F5788D589FF4CB13BDF6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%yR.D...D...D....i..D...S...D...H...D....j..D...D...D...[...D....z..E..BKJ..D...D..VD....y.+D....m..D....k..D....o..D..Rich.D..........................PE..L....9WO.........."!......:.........#.,.......:...............................Y.....4.Y..............................KD...... G......pG.(.............X..>....G.hs....:.....................h.B......................&G..............................text... .:.......:................. ..`.rdata...~....:.......:.............@..@.data........`D......`D.............@....idata..C.... G.. ... F.............@....data1..H....@G......@F.............@....tls.........PG......PF.............@...mx_api.......`G......`F.............@....rsrc...(....pG......pF.............@..@.v-lizer.=....G..=....F.............`...................................................................................................................

C:\Windows\SysWOW64\zkfinger10.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688400
Entropy (8bit):	6.691580706898385
Encrypted:	false
SSDEEP:	12288:lnPxkdzJtF7r2BrEyCRizwXKqJ3g/BnqS7rkx+D1l6:lnPxkdzJtI/wXKq3g/Bnr7rkOl6
MD5:	4A8AA2CB879DDEAE2D8E5BAB5BF310B2
SHA1:	FF956C8593F55CAB33BC087B2F624B14B710E603
SHA-256:	6626B4CA32408BCDB4CFD5E3E84FAF7D1C6C49C4674B9B319CF68286575F416D
SHA-512:	192BD3134910D92778D2DD9EAA4CB2D8A19140B00469B373626162148986CA91D4DF36488A90E8064E2A7684B1261EB56420AEED4612EE9C56C59991E01C94F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................8......G...............).......?.6.....6...............-.....Rich............PE..L...MA.W...........!...............)p.......@............................................@.............................L.......x.... ...............B...?...0...`...B...............................................@...............................text....)......................... ..`.rdata...c...@...d..................@..@.data...hh.......*..................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\zkfpslibLow.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118040
Entropy (8bit):	6.796287551172948
Encrypted:	false
SSDEEP:	1536:TTK8CfkHAPmqEVAHKAFP1OPrCN8vq4PKfbMsZ8KFPcE5JeJpnYW4r/Ah:kX1qcderoQmFPcE5JeJpYn
MD5:	BAE20EC3CDF6DB2CFE5961767999895C
SHA1:	1D44161109F1958B2690D4758F46AC2BB4B67B94
SHA-256:	463D59EC9ECA98DA82DF60824E06FEDB88678B8037B5140CD7E0FF043ABECB0A
SHA-512:	898F551EAEDF5320E60BB9E644BA78F48B6031FCAEA3F105EB39BC8FA93B25EAD7D54E6C662DA97EC25DA4349F1B53925CB216F1E0BDA5A0F6F6CE2BAC1EE7AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:...:...:..[u...:...h...:...h...:...h..d:.......:...:..:...h...:...h...:...h...:...h...:..Rich.:..........................PE..L......W...........!.....(...b......IT.......@.......................................P..............................0j..M...\|b..<........................?...........A...............................\..@............@..P............................text....'.......(.................. ..`.rdata..}....@...0...,..............@..@.data... Q...p.......\..............@....rsrc................r..............@..@.reloc..,............x..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\SET7A78.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\SET7A89.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\twn4cdc.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7753
Entropy (8bit):	7.356395127366698
Encrypted:	false
SSDEEP:	192:p8AuwOjLnVTgBxe1HCjWe+PjPJ+mMl01p8jSJUbueqTtbhZPB:Sw6n2KtPLJqYpdUb+Tj
MD5:	F99012B0740B247C053531080D2571D9
SHA1:	8751A015792E4B5346EFE27AD99CC6C576EAC744
SHA-256:	09E55F407C81BDFFB86D2C079C8F187467E902182F26604764C40B1A9EEF14C6
SHA-512:	61A8D11422FE9B484E40901DC5641D091DE95B02A116D37A1D8F36861E96BAE06BF5D655F2406F52D6C8EE4B488446798E2A8029F758F83AEB28BCCA2AE7586C
Malicious:	false
Reputation:	unknown
Preview:	0..E...H.........60..2...1.0...+......0.....+.....7......0...0...+.....7.......E(MT2M..ni.....130729144758Z0...+.....7.....0...0....R7.8.0.9.D.5.1.1.0.E.8.2.3.F.F.B.2.5.1.F.7.B.0.A.4.3.6.E.C.F.5.7.3.E.6.A.A.B.D.1...1..O0:..+.....7...1,0...F.i.l.e........t.w.n.4.c.d.c...i.n.f...0J..+.....7...1<0:...O.S.A.t.t.r.......$2.:.5...1.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........x.....?.%.{.Cn.W>j..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0P..+.....7....B0@...O.S.......2X.P.X.8.6.,.V.i.s.t.a.X.8.6.,.7.X.8.6.,.7.X.6.4...0\..+.....7....N0L...H.W.I.D.2.......8u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.7.&.m.i._.0.1...0P..+.....7....B0@...H.W.I.D.1.......,u.s.b.\.v.i.d._.0.9.d.8.&.p.i.d._.0.4.2.0.......0...0..W.......~...\|.NY.K.w...;0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte T

C:\Windows\System32\DriverStore\Temp\{9c8edb3f-4625-0f40-84f0-5e11f5d680a8}\twn4cdc.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	5.167086575941848
Encrypted:	false
SSDEEP:	24:oJo2in2CUVKhiyInyFW9ZiXZRZiXZoKo33XAFEAhvSwm/qKXL9xlmtXHUd+:obi2QnIyFWvaDaHo33X8EAww0PL93G++
MD5:	3E076E508193744B9626F9ED539BD554
SHA1:	9637991C6A1E399F4E10C7C5BD615FAC74CB5D7A
SHA-256:	268FC2586B706E2B61254C26A4911AD03F736285BED934729439200E846CA1FB
SHA-512:	FB5140B62935A48D0974A0024CA959FC5F815F1CA68A00489B12734214A7C6BB1D35550792CB1A257B69C37B4F563DA961C4EF7F28D1FF4EC47D23A87B6239A1
Malicious:	false
Reputation:	unknown
Preview:	[Version].Signature="$Windows NT$".Class=Ports.ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}.Provider=%PRVDR%.CatalogFile=twn4cdc.cat.DriverVer=01/11/2013,5.3.0.6..[SourceDisksNames].1=%DriversDisk%,,,..[SourceDisksFiles]..[Manufacturer].%MFGNAME%=DeviceList,NT,NTamd64..[DestinationDirs].DefaultDestDir = 12..;------------------------------------------------------------------------------.; VID/PID Settings.;------------------------------------------------------------------------------.[DeviceList.NT].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DeviceList.NTamd64].%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0420.%DESCRIPTION%=DriverInstall,USB\VID_09D8&PID_0427&MI_01..[DriverInstall.NT].Include=mdmcpq.inf.CopyFiles=FakeModemCopyFileSection.AddReg=DriverInstall.NT.AddReg..[DriverInstall.NT.AddReg].HKR,,DevLoader,,*ntkern.HKR,,NTMPDriver,,usbser.sys.HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider".

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCC51.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCC71.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCC82.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD00.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD20.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD41.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD70.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCD91.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDC1.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCDF0.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE20.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\SETCE7F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpD00701.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322064
Entropy (8bit):	6.458528184093351
Encrypted:	false
SSDEEP:	6144:amgLsiGIwfANm2Xu4uIEXlcMM+vzVzQm1:amWJGIwfAN3exRr5t1
MD5:	E8BCF046F729253F2BB24EA0E8C047B9
SHA1:	8104533C4BBB4265F71A87BB5D6966EA64974B66
SHA-256:	039966724018CF96157F1EE7F7CDF48F4F20A76192D920D55504ED1DCBA7DE7E
SHA-512:	DF9FA6308C8B0B7128B78BF9BB3314C34F26FCF70799CAAE5F376FA418F99C5D2DB439137718AD4F052D273719A95741D9A5D5BC2D17FC4AD1318281D20E2959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................2......2.N...................2......2......2......2.....Rich............................PE..L...N..K...........!.........@.......k..............................................:B...............................>..c...L4..P........3.......................&......................................@............................................text.............................. ..`.rdata..c...........................@..@.data....:...@... ...@..............@....rsrc....3.......@...`..............@..@.reloc..@'.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpD00701x64.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486928
Entropy (8bit):	6.250345732252882
Encrypted:	false
SSDEEP:	12288:wQ9bgP8ZMXPFO+YXK0FRMjqCe0LK5sjGNCkCEVz:NbPZMfFO+YXfRMjqCe0LKKjGNCkrVz
MD5:	39837E0C027FA2B35E4B406941DC01B3
SHA1:	0E43708086396F5F21D4191FE115449E2E98CA32
SHA-256:	2728B5ED610EF55E89784FD5508B366D2BC7EFDC5BF3E75D51F5DAC82C4DC294
SHA-512:	B534508E0245F822698CB813DA1D31BDD3D6D2BF60C005D510628ADADC8B28CA608082F1C06BFB8A337E3E4A5EB5BF53196D0540C55335A7948EF75559BCED47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.P]..>...>...>.4}C...>.4}S...>.e&E...>...?.}.>.4}P.S.>.4}D...>.4}B...>.4}F...>.Rich..>.................PE..d......K.........." ................p...............................................o...................................................f......P....`...3.......G...T...............................................................................................text.............................. ..`.rdata..............................@..@.data...pG.......&..................@....pdata...G.......H..................@..@.rsrc....3...`...4..................@..@.reloc..l............J..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.284925861277528
Encrypted:	false
SSDEEP:	3072:eXfDLJSrFTDIcSrtLiIiw6SQZtZUrda66H8Ed4HIq:eXJsDdSrz5YYr
MD5:	B7D3259B3BDA026EEFA90F5523B6E996
SHA1:	989B6D1E19134C2329C0749C15904C4ECEC25EA4
SHA-256:	502B9C74FA0F6138A3EBFBB67829BFE267074F78CF6119B35E9975EF2176F503
SHA-512:	AF3D0C4B807CEB2A275A7F219FF98A2776EC62C3686DE20078D6004E729984446EDB9B7C7B4340E03A27C36236DB7E8E6AD0028E1E14E5E1E9BE0E266F04E01F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.!...r...r...r..r...r..r...rh..r...r...r...r..r...r..r...r..r...r..r...rRich...r........................PE..L...C..K...........!.................G....... ......................................................................0a..d....Y..(.......p4...........................!...............................I..@............ ..D............................text............................... ..`.rdata...A... ...P... ..............@..@.data...@....p... ...p..............@....rsrc...p4.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpI00701x64.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296976
Entropy (8bit):	6.312496318992163
Encrypted:	false
SSDEEP:	6144:q8NU6WoVFWctDBihoCbdJN7rJKF8LjosTjgfzO46KHaZOq64DnHMytqeH:lU6SbdJNPJKF8LjosTjgfxadFi6
MD5:	ED673140EA6F2CD1B8FCAFA041F02F2E
SHA1:	D5AD7A43B53A965F4A1A9C76B1C609178993F27D
SHA-256:	107EFB5853E1926BE84164E7D21D5D56C7DCACD6B599838353AE95BAA46ED059
SHA-512:	ED4D0ED91AC6EADD90ACBA5DC783F108469EBFC111CA2169DBCE139D8DDA6E822EA8E15B64509F436D950E159C12D95A08AA8CA685C242059BA92B392F43B123
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lR.............&.......&o......}y..............&l......&x......&~......&z.....Rich............................PE..d......K.........." .....\...........W............................................../...................................................g.......(....`..p4...0...+...n..........l....s...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...P)..........................@....pdata...+...0...,..................@..@.rsrc...p4...`...6...0..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpK00701.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64016
Entropy (8bit):	5.926271967812779
Encrypted:	false
SSDEEP:	1536:sS1FlFdVCgrxkOgO8hcbF6XwlxSidJ8MUiYTbtOjn:sSJbV5kXO8hDAlxSidJ8MUiYPY
MD5:	1DA17AB1AB496963949DF99184796DBC
SHA1:	1194F7ADE39B6B40489E59D10F5BD9D6ACBCA639
SHA-256:	AFFDECC31FA032FF7E3FCF6CEDFE746A5A89804FD72047A3EE03E0915D971BF1
SHA-512:	6B10644BB65DCE8DF9CD90C89A8B2E26895FD1A219973566EE419E0175B4D142173F2F7C5F255F7726F27065727229620DA5821288390B9729743D939AEB4F6C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.U.R...R...R...8..R...;..R...R...R.......R.......R...<..R.....R.......R...6..R...+..R......R..Rich.R..................PE..d......K.........."..........\......d........................................0..................................................................(........4................... .......................................................................................text...@w.......x.................. ..h.rdata..d............\|..............@..H.data...............................@....pdata..............................@..HINIT....d........................... ....rsrc....4.......6..................@..B.reloc..`.... ......................@..B........................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevctl.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272912
Entropy (8bit):	6.265243007385999
Encrypted:	false
SSDEEP:	3072:nfJ8/CKhMlUT9B+fklmk7kIovOLisp51OpqPIR+LLBtb5TwwfzEZiQQbnckC:fMT9AaovwODgX3Jcz
MD5:	7B3F4907BC409960C300AE50420C16A6
SHA1:	ED97B09CB7853CD056E8D7D6318C0EAD13B267A6
SHA-256:	09649414F843036DF5C30846AED6059E0F43E973A729B07E8F690F4B668DDAC7
SHA-512:	81EB78DAF1849F3933B0622A6418DDF9D863A793E41B958E1641E5CD7D42928595DF0ECDD35C5E30AA60117AE896FC0E6692E3F5461020B5BB547AD3FE6637FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.;.~.UC~.UC~.UCY.(Cj.UCY.8C..UC...Cq.UC~.TC..UCY.;C@.UCY./C..UCY.)C..UCY.-C..UCRich~.UC................PE..L......K...........!.........@......~%.......................................0......Vr...............................\|..r....m...........1.......................'......................................@...............\|............................text............................... ..`.rdata..b...........................@..@.data....0....... ..................@....rsrc....1.......@..................@..@.reloc...'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevctlx64.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	414736
Entropy (8bit):	6.078888149142589
Encrypted:	false
SSDEEP:	12288:RuK+luT6cxayLvniG6rxhHLBaszdbK2uWz+i:RuK+luT6cxayTiG6rxhHLBtzdbluAx
MD5:	D1ADF6E4753778A90DC5215EFA831565
SHA1:	0CCFF3F80E07A8E086B37C956552D829C55257EF
SHA-256:	DB72A2515F6D3796AA3FF9ACB2DE22141C90FD9D016F6A6559A6F290E20E35E5
SHA-512:	DFAA69B63797B27E1274CC6DDF1D9D92F3C112AC1210F38E74AFD52B812BEDB9ED8BF968E61BAB45114BEE00D60408AE7383AA388494F7E72A217C53E5B7C491
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...nu.Unu.Unu.UI..Ugu.UI..U1u.U..Uau.Unu.U.u.UI..UQu.UI..Uou.UI..Uou.UI..Uou.URichnu.U................PE..d.....K.........." .................{...............................................D..................................................u...........P...1.......G...:..........<....................................................................................text............................... ..`.rdata..............................@..@.data....;..........................@....pdata...G.......H..................@..@.rsrc....1...P...2..................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevdat.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199184
Entropy (8bit):	6.263532641595098
Encrypted:	false
SSDEEP:	3072:OGGk7ma+XQbQ0eLiDmxDeWmBRRx7wIu37Z7XNkti5SmR:/Gk7mHXmNizSpeSS
MD5:	2ECCD46878DCE0F84DADD29498BD900D
SHA1:	D30AE67C9CA5DC53B8D1583BDAE6C43DBAEC3F37
SHA-256:	20B41562147E635D60E875CBEF43F17D2373CB18FED9F8DFA97C2553B4F1E121
SHA-512:	B397366D11111DC613C7E4CDE245D1A98864BA5B7C1A576C0D3EC7E8228BFFCAE2340BA375978D401B886E765785B207C2D652180D7C6F388130ADF9B5AC93AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.n.{z..{z..{z..\.}.iz..\.m..z..u].rz..{z...z..\.n.Jz..\.z.zz..\.\|.zz..\.x.zz..Rich{z..........................PE..L......K...........!................pZ....... ......................................A............................... n.......d..d........0......................\|....!..............................hJ..@............ ...............................text............................... ..`.rdata...N... ...P... ..............@..@.data...h....p... ...p..............@....rsrc....0.......@..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpdevdatx64.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	314896
Entropy (8bit):	6.25098913308225
Encrypted:	false
SSDEEP:	6144:cbV3jiyvaSefVtAeoU1c855z+FwwBXMOqLQNsrUCe+FSw5Qv3F5vYFHDmB+:6VTTuA+c855zLwBXMOqLQNsrUCeASwLf
MD5:	4B4E309FE52C6AA57674A4124A82B426
SHA1:	8AC2BCB190B5185606B57234527B6D542A6DF11F
SHA-256:	85E0225A8451B23FE9715939DA1A9B8E780ECA3C38277B1AD09ACD9BF5DCE20D
SHA-512:	D6004795A617869A2F46805EAB28C509A077953DA456C61C73A7F64EAB2DD7F1BD75401BDADC068E09C0E0D7238EEE4CB6DFA5070756479443EA2D77E76C3CBA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................D.......D....................D......D.......D.......D......Rich............PE..d.....K.........." .........L.......w....................................... .......v.............................................. C.......7..d........0.......3..............X......................................................`............................text............................... ..`.rdata..............................@..@.data...x9...P......................@....pdata...3.......4...F..............@..@.rsrc....0.......2...z..............@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpersona_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12415
Entropy (8bit):	6.500187664075039
Encrypted:	false
SSDEEP:	192:VLlV5iCc06TGRx0ogJkc7ygt97Bd5R8EV9KHhjXHUz1TrJj3EpLHQQyRF:VDT0XsjXHUX4yQIF
MD5:	50F212C4F9B4A832A410D3E83F6317EA
SHA1:	503BC574ACAA4A79BEA85304A5B7B3A0C85191CA
SHA-256:	29C2B3859FDD96D781E07F3AE778EABADBFA54CBCB437AA00E447978B18F7309
SHA-512:	0387139E4F49D236C09EE36D0BED34258E9518F90A4F486A43A06821A0889ECD6D3EC8341443F7B582D041E0F279CD81D2E072F52DE44B1D0DBE217488AD6A97
Malicious:	false
Reputation:	unknown
Preview:	0.0{..*.H........0l0.0h...1.0...+......0..W..+.....7.....H0..D0...+.....7.......)7.y.@.1Dx.#....100420015251Z0...+.....7.....0..a0....R1.6.4.1.A.2.0.0.4.8.3.7.8.F.1.0.D.B.6.D.8.A.7.F.5.9.6.C.1.8.8.A.A.1.4.3.4.F.7.B...1..k0B..+.....7...1402...F.i.l.e....... d.p.i.0.0.7.0.1.x.6.4...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........A..H7...m..Yl...CO{0....R3.9.E.B.B.8.3.D.3.2.0.1.1.3.5.3.D.8.7.E.7.A.1.0.8.8.D.F.7.B.F.6.4.A.E.7.1.6.B.8...1..e0<..+.....7...1.0,...F.i.l.e........d.p.d.e.v.c.t.l...d.l.l...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\dpersona_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	3.6831902303548523
Encrypted:	false
SSDEEP:	192:QEF4JpmHpmdL2iT3FTGOUSbCEqOVg2XAMXMncMiM3l1RjznKuC:p+Jcc3T1bUVyZc9vVzu
MD5:	91967EB8B8468AADD50E2D880375D8D2
SHA1:	E8FD6EF8CC869DE121501FB543A7C0674D30756F
SHA-256:	D230952D38ECDA93D971FE9798DCA35D0E4C7A7C4B573D0AF47A34B7928C8E92
SHA-512:	58C2F6885AFDBA94B63D2B1E42DE41C561852870D0B6E45496FDEE9FC7D1D1748EAB6E71DE7FDB59B4ABB5AECBF7C81113FE7E975540C5D72886149F1CB4BA1A
Malicious:	false
Reputation:	unknown
Preview:	..;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .d.P.e.r.s.o.n.a._.x.6.4...i.n.f. . .s.e.t.u.p. .f.i.l.e. .f.o.r. .f.i.n.g.e.r.p.r.i.n.t. .d.e.v.i.c.e.s.....;. .C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.6.-.2.0.1.0. .D.i.g.i.t.a.l.P.e.r.s.o.n.a.,. .I.n.c.......;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....;. .V.e.r.s.i.o.n. .a.n.d. .C.l.a.s.s. .i.n.f.o.r.m.a.t.i.o.n.....;.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.". . . . . . . .;. .s.u.p.p.o.r.t. .o.p.e.r.a.t.i.n.g. .s.y.s.t.e.m.s. .W.i.

C:\Windows\System32\DriverStore\Temp\{a8580a04-6b60-8249-86f2-a6693406c210}\usbdpfp.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67088
Entropy (8bit):	5.963066522157694
Encrypted:	false
SSDEEP:	1536:Kfhjwqi1sK1yXUU2MGgjSk7WfL0z+cgVoUoubtOt:KM1Xpf7k7ML0z+cgVoUoY2
MD5:	4846D37BBA87B2E6138074EE076E367E
SHA1:	E2E478EFBC83B2FB604BD60AF032402C3654F176
SHA-256:	098A0D4BCBAD10920E2E05F7DA06F291E711A766AFDF293D2306EE44879F6436
SHA-512:	5A17F715556088B4F9D8DDCB298D03FF8FD61F23CE1C3C80E4F79AE6C34A18526D1829B8CA0D21BE6513F4C6322FA770FDC7902C4569C452BCBA84510BE00C71
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.rb..!b..!b..!k.Y!c..!k.Z!a..!b..!\..!Ey.!e..!Ey.!c..!k.]!o..!k.K!`..!Ey.!`..!k.W!p..!k.J!c..!k.O!c..!Richb..!................PE..d......K.........."..........V......d........................................@......7...........................................................P.......(3...................0.......................................................................................text.............................. ..h.rdata..............................@..H.data...x...........................@....pdata..............................@..HINIT....j........................... ....rsrc...(3.......4..................@..B.reloc..T....0......................@..B........................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SET9FC3.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SET9FE3.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SET9FF4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA004.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\SETA025.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\ZKFP.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0_x64.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\libusb0_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{e375881d-67e7-5545-8051-4ea2d8d54c16}\zkfp.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\ZKFPSensors\is-0I0LF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	268800
Entropy (8bit):	6.390001751143532
Encrypted:	false
SSDEEP:	6144:JsPHAN+emiVW9kvp3xuJIboukzTvEaJ0GSM62ddgt25WAhQ+Zk:IgN7p3lkHSMBdgM5k
MD5:	368041398044ECE066783FEEC4DE2E44
SHA1:	37F5A2FFBB571A33188A5B4CD625B449CA99481B
SHA-256:	D7703A114CBAE3DDF45BAB0FB662C60DE28C42A66DA5A8661599CADDD2CE4A9B
SHA-512:	325DB30AB679FAA0764CA222F9756EDD6991DA1203158D565170B116EB8224BA42DFB7D9F28CAA45346568FE666B480565F76844F8DF4208A9F857FE51455553
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........XBXV9,.V9,.V9,._A..d9,._A...9,._A..]9,.q.W.S9,.V9-.:9,._A.._9,._A..W9,._A..W9,.RichV9,.................PE..d....x.W.........." .....8..........<.............................................../C....@.........................................@...........<....`.......0...&...........p..8...PS...............................................P...............................text....6.......8.................. ..`.rdata...\|...P...~...<..............@..@.data....P..........................@....pdata...&...0...(..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\ZKFPSensors\is-43LAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.174414444345994
Encrypted:	false
SSDEEP:	3072:+1io3jxLq0Kx6OgxqMBfIRe78FsQ1MqzgHO8IYNwP45Gqe:+kijARO7QWKSO8IYNEq
MD5:	558C9E729BCF6F23952A49385A2896C5
SHA1:	7F83D90677752CC48ED2C590EC7F682FE5478559
SHA-256:	033E99323E70399EF4453271FC6F1B64210F80469F5DAF1D7311ABD76B6BF022
SHA-512:	3AA3EBCDF6F4CC526C46AB9FFEA8A0887C212FBAD39C4004EB47BCCB51C7176825ECFB7E046F5E36973C72BC99F0BC0168471A0BA5D0FD38438BD81B3DF9FAAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0.L.^SL.^SL.^SE..S9.^SE..SF.^SE..S~.^Sk`%SK.^SL._S<.^SE..SG.^SE..SM.^SE..SM.^SRichL.^S................PE..d....x.W.........." .....R...........{.......................................P.......^....@.....................................................P....0.......................@..T....s...............................................p...............................text....P.......R.................. ..`.rdata...Q...p...R...V..............@..@.data....>..........................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\ZKFPSensors\is-4L7MR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.094436243426513
Encrypted:	false
SSDEEP:	1536:Mmc8NgTG7p2xaX5RFVEN2L6zZBaAgdktH8GkXRJ3ytl/g5xeeU:Xc8uTG73XbUoL6zraRdRxytlo5x9
MD5:	994A3A65E7BCE57E07272464DE552FA7
SHA1:	9334057BD6FEA257C335A65F94B7EFF587694C83
SHA-256:	1CDE4C5DCD64D14D164E81D987D4E6176AE3A10545C8C7B9195C62AB030F7343
SHA-512:	CA19C57006A0AC3277004742146CA578D9AAA93CE6C42825CDAFA38B51249C0476CCFA525B527F4B4155FC22CB42982259E68E76B43405C8DBF3257D4227CFB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#).BG..BG..BG.....BG..:..BG..:..BG..:..BG...<..BG..BF..BG..:..BG..:..BG..:..BG.Rich.BG.........PE..d....x.W.........." .........x.......[....................................................@..........................................e.......\..<............................... ... #............................................... ...............................text...6........................... ..`.rdata..\|G... ...H..................@..@.data....8...p.......Z..............@....pdata...............r..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3622
Entropy (8bit):	5.362376841756457
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3s5pmspmZwgG:QO00eO00erMwmkB1kAvG
MD5:	5760CBA449DB142C5CD945C5FC35572E
SHA1:	70EB1D1F6A4073F900B431289CDB8B8054FA425B
SHA-256:	8B46508DBFBB97467321F936223F9D1250A1CBBB1270D25CD8BBB70605A549A4
SHA-512:	BE4E3D304DD0EB46C24AAF2F6A65764BE47AA35C43C1FC70E5644524DD14F81748993FF2D37E2CADD7A4BD6894D081DBD6BD99F41F5F372E377704CA9EC5357D
Malicious:	false
Reputation:	unknown
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	850
Entropy (8bit):	4.709094184495284
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTte:vDZhyoZWM9rU5fFcv
MD5:	DFD9FB8F7F85FFDDBF5983CF0DE56660
SHA1:	877634A34ACEA157317D760BBAE46739C6A5C692
SHA-256:	42C9606184A854AF501FE7DF62D3DACAC8D6D13E2DAA0808B791364356414120
SHA-512:	A2CA79FAB26DDA3871ABD8D121B9DE748C192E769F8E192E35B048A6CC51239A632399609C728809C295E6C6984051F6CC78BCEF9E96A5FE277B42480157CB5F
Malicious:	true
Reputation:	unknown
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost...127.0.0.1.localhost.2n.cz

C:\Windows\System32\is-8O2DU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	212280
Entropy (8bit):	6.432870112062363
Encrypted:	false
SSDEEP:	3072:0YcdONwan0ak8Qsnx/MqUC+13nOu+K7012tlfpvhntWlQk7Y0GUL0sxTHBF55c85:AlanmYx/MVC+ROub3txnCLY0GUj1
MD5:	1910E9773AA5BDED6D98249376B6DBDC
SHA1:	B947DD3AA1EFC8D88E8C86A75D65C077CAD35148
SHA-256:	8261B0A5D81C79660ADA5E437C9F3C4871A8119BA5AB3B122EDF905C50CAC3E4
SHA-512:	86261421B3D01B3A78C65D94E445850FD1F314E087115A4D706BFF5E91D1C151821A1A2B900ABF3A7159377115ADBE6F206D12AFFA7CEFA9427A8F43B5D6240F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... ... ... ...XQ.. ...XV.M ...X@.. ...... ...XF.. ... .._ ...X\.. ...XG.. ...rA.. ...XD.. ..Rich. ..........PE..d....c.S.........." .....^...........y...................................................@.................................................\...x....`.......@.......$..8....p..p....t...............................................p..h............................text....].......^.................. ..`.rdata...y...p...z...b..............@..@.data...hB..........................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..d....p......................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\is-8VQ00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\is-C1CQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.1824074891552065
Encrypted:	false
SSDEEP:	192:X843l6SfB50EXIILkfaCyJb0va6JyvxNAN44yuBo18L2f7Fa:MmMS5KEXIILKfyJbSOxyNw18L2fY
MD5:	1DD865CF6041A62078704DC1F6E2A26B
SHA1:	6959BE92F45E0651FCFAB091FE2C9DF166B9B5FB
SHA-256:	A448E8FEF8EF7D93AACFB7606B8DE45B279116373738A9F2368DE8446C3902E6
SHA-512:	EEED2B1D5A680ABA8341EA5BE0A1612609002B771D954760AF740757C68C50ED7A2F3450DD0377B9C20335014EDF7A9ECC08F8E8A9ECBD58FC35D40588203904
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...tx.W.........." .................... ....@...... ....................................@...@......@............... ...............................`..@............................G............................................................... ..H............text...X(... ..................... ..`.rsrc...@....`.......,..............@..@.reloc...............0..............@..BH.......,.......................................................................0..A.......~"....~"...(....%.....(....}....~.....{....(....,.(....&~#....~.(....&.{....(....&(....&~"....(.....0..........~.....{....(....,.~7.....(....}....~.....{....(....,.~(....@.......@..{.... O.....(......(....&.(.....o....} ....{.....\|.....\|.....\|....(....&~"......0..@........r...p} ...~.....{....(....,..{....(....&.~....}....~"...~5....0..g.......~.....{....(....,.~5....,...i.2...0.~'.

C:\Windows\System32\is-DG1QU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127768
Entropy (8bit):	6.554921470042369
Encrypted:	false
SSDEEP:	3072:Y7YH+6HdiGx7G57nSX1CPTMM/c8N5pQDtt/DoA:Y7YHV5xSnSFCPTMIpQD
MD5:	B36F3DC44E9F74FDCCBAF8FDD724A60B
SHA1:	685BB21717B6574FF1B9017BCECE1DD8BA5B7147
SHA-256:	D001D0D60AAE6C2BFB68CA0E3B3F850F7BFED96831BE0D77CC4DF3A66926E482
SHA-512:	7F358D27F4FB548628F177F4ADFC922C016D3B5D3F7D04BC814E1554725CE91B4B4187A3DE53B789A5B09EB37B5B69B87C04D7F83B4AA732E3D986D7748DBA1D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........AW...W...W.....F.Q...I.T.t...I.S.,...I.E.]...p\..R...W.......I.Y.S...I.B.V...I.D.V...I.A.V...RichW...........PE..d....$.W.........." .....<...t.......]....................................... ......x...................................................M...x...<........................?.......... S...............................................P...............................text....:.......<.................. ..`.rdata...?...P...@...@..............@..@.data....\..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\is-DSTA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	974096
Entropy (8bit):	6.429675765196326
Encrypted:	false
SSDEEP:	12288:n+V4B80jynsosfKY8nDv3axtTXgjez5/tgsEQmShpHA7ImB:n+4B80jQsosT8nDvGgja/tTEagIw
MD5:	7F8F12AFF5334B5CB1B90F2DC36017D4
SHA1:	D13776AEE7D2BE98F276ACE43D64FF49F7226485
SHA-256:	A4A04D5486FE5BA55413944C68CEC5EF2AE1B31ADA31B4CCA505017EE676C49E
SHA-512:	CD9535B4C8113E4B8CFC957C21E81A65402B67EDCDC606FE5B6B499DE5D08BC6BFD22C75ADCA0EF42C8EA97FCB157E8BFE4CB189925D2A91273852E0041CC326
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.Fn...n...n...g.l.U...Ir..c...n......g.}.z...g.k....g.b.d...g.z.o...g.y.o...Richn...........................PE..d...tA.W.........." ................H........................................ .......Z....@.............................................L...x...x............@..,........?...... ...0................................................................................text............................... ..`.rdata..............................@..@.data....x..........................@....pdata..,....@......................@..@.rsrc................d..............@..@.reloc...7.......8...f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\is-FDOTF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	6.384705046577867
Encrypted:	false
SSDEEP:	6144:vxGRajaeO9cpgu8Ib+KT7lbNtxISMW/cPajQxllYH69zp4Jtz:ZjaLcpvkSMW7j0Cfz
MD5:	61121836918456856DF0EF105C2C64AC
SHA1:	2386F4BDA3FE63D230423BD696A5BBD22CAB72CB
SHA-256:	470B778EE84F24F79E2DBBCDE05B24A35585854599E0B614AD2D4BFB4A7791E4
SHA-512:	ADC0D382DCD896DFB6C70EC99B1FF8F45931D804D58237840BAFE1353E47F6E496372A5557C6E5B0D443B5B4FEE6FE9F70179F0D8C62F88BE60958D58E9F24F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.Z.-...-...-...UP..-...UF..-...UW..-....W..-...U@..-......-...-..V-....P..-...UY..-...UA..-...UB..-..Rich.-..........................PE..d....x.W.........." .....D..........h................................................r....@.............................................d...h...d............P..t(...................d...............................................`...............................text...JB.......D.................. ..`.rdata.......`.......H..............@..@.data....R.......2..................@....pdata..t(...P...*..................@..@.rsrc...............................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\is-FVSOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.099901784972156
Encrypted:	false
SSDEEP:	1536:OdIBLyFUNavd/p/3Ccbs+9ZAGqE8KaoNlyeXGQ11aDwm1qSbv01qOojY35gUuvJM:OdIBOFUNavdgc4+9ZyEhWsas9SoVojct
MD5:	6AF8EB1334EA765B54593D2FBD9741F5
SHA1:	C845C2898208FEBBACECDD7AB05596586DFD99D9
SHA-256:	BAD6759F87926E35943313D97C875ACA96A7AC7D39E00506F95721C3DE75D5F4
SHA-512:	F02998C80E92DF8F3A38C4773BDD06A77D9B00254E3A4960FE6A802808D493294128043B8B2B23C8CD105DF9F33BD39F0C01D22323A84CD1A54E8C274DB1D66C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8_..@..8I..@..8X..@......@..@..@..8V..@..8N..@...H..@..8M..@.Rich.@.........PE..d...yx.W.........." ................\H..............................................xT....@.........................................`F..i....=..<...............................x...`................................................................................text............................... ..`.rdata...j.......l..................@..@.data....B...P... ...@..............@....pdata...............`..............@..@.rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\is-H2VJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	193848
Entropy (8bit):	6.26689028701298
Encrypted:	false
SSDEEP:	3072:rv2FJiCGPX/n4oWlitZhb0mAl6K2xlT7jF3kRNXewYVkSpq3yp8saxKB0LAfX2Us:rH/n4oWqn0mPTlzF3kRNXerVkcqip88k
MD5:	AD49D392F3A0BBEA08AD9981DA2C5A76
SHA1:	26A19C6AD9EFA1934AAB682D5631E37234032762
SHA-256:	FBB86FE998F4FD61FA46BF0340A654C8A15FC1217219F3A5A21621296A34A7AE
SHA-512:	8506FF5F6F98BB8CB85E579E39D2377362C3783474B68FB32460A0D56A063AC5D86F14A00B789C6ADDBF7FF8F30BCF65C9B23AB6328E95A6AB71F50CBF9DB414
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................]........................R........q....R.................................Rich...................PE..d...fc.S.........." .........................................................0...........@................................................(...................L.......8.... ...... ................................................................................text............................... ..`.rdata.............................@..@.data....=..........................@....pdata..L...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Windows\System32\is-KMSK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	448824
Entropy (8bit):	6.554074564560768
Encrypted:	false
SSDEEP:	6144:g3c6Zl4KZurhK/EnNpBb4TFaac9DnTMV7PxGKKpgTmIX90KaZTqQkUh/bDx4JpQ3:+Zl4KZgKwv4kaGTyrz0ckApFo4o1
MD5:	F86AB243669A2CA20C52F031B1C8B629
SHA1:	F365CC78B750AE075CDA7A4D29C9DDBD6322A1B2
SHA-256:	9391EE8D2D79251F187300853BBEB4A7B20261C3A8F3906947C6CCAA61453FB9
SHA-512:	C647036D2B4DF4F5BA859B5304182C28CFC8C03053286069FF691EB2F40A23ABAA8CCC1B4FAB932D010E0BA4DC0A7C7A6B053A898D4BD90C178818B479453240
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+L..J"..J"..J"..2...J"..J#.J".....J"....QJ".....J"..2...J"......J".....J".....J".....J".....J".Rich.J".................PE..d...k..S.........." ................h........................................@......ch....@.............................................q... ...(.... .......`..pJ......8....0..\.......................................................8............................text............................... ..`.rdata..............................@..@.data....b.......,..................@....pdata..pJ...`...L..................@..@text....1............J..............@.. data....@I.......J...f..............@..@.rsrc........ ......................@..@.reloc..$....0......................@..B................................................................................................................................................................

C:\Windows\System32\is-NR955.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159544
Entropy (8bit):	6.182783009191357
Encrypted:	false
SSDEEP:	3072:FYHgDVO9wjNY82IRaskGPnlBEsN8TOSL6MOTaT0o+x3/OoFejF34+:FLO9wC8H5P5N8TOSL6MOTasO7FR
MD5:	9BF459B5EF1388D6074949898B17D2F9
SHA1:	02C2CBB389E01BCCF943F1EB2B5C1DCE729CEC4C
SHA-256:	DA6B915943F136D78253432B815FD3EA464C670F9AC6FC7F67D4CF617DE45C17
SHA-512:	37868BB16B099EE2F2E6BDDD1966A078D294D79404705827999F6ABC9E7D40D8BC88B5FB8EE8441CD4AF5D6E48E5C50281E9F5C6FF4CDF8F931426A5C60373BA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u...u...u...\|.6.~...n..._...n.......n.;.....\|.&.t.......v...u.......n...p...n.>.t...n.?.t...n.8.t...Richu...........................PE..d...o..S.........." ................P...............................................n#....@.........................................@*..........d............p.......V..8...............................................................p.......@....................text...2........................... ..`.rdata..K...........................@..@.data....:...0......................@....pdata.......p.......4..............@..@.rsrc................J..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\is-OJSTD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.172949745541116
Encrypted:	false
SSDEEP:	1536:mOKjLatBGEq6wGv3sRLdo2U3r75109adMeXWSrJT0/Zir:BtBGE8Gud+VPMA/rJT2M
MD5:	08C0DB3AE3938572C15623D612D465D1
SHA1:	7C82F8986B4DDBD49EE2C7000DA876D7F2938607
SHA-256:	242D156A4F16682AE98D582032B1597F9F6139774BBF37DF6D6426E307574B72
SHA-512:	4D822CEBD15013B35105025D6A491E5579DEDA5AD93F70DB76CE51DF8FF7BA60E33D4F4D4426B813FA9717E0667A619D81DACFF0F55E5005144B289902C1F0A8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......H...H...H..,H...H..+HO..H..=H...H0S.H...H...H[..H..!H...H..:H...H..<H...H..9H...HRich...H................PE..d...wx.W.........." .........Z......l<....................................................@.........................................@...........(....`.......P...............p..D...@................................................................................text............................... ..`.rdata..6*.......,..................@..@.data....)... ......................@....pdata.......P......................@..@.rsrc........`.......&..............@..@.reloc.......p.......,..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\is-RULKA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	298808
Entropy (8bit):	6.053671511169083
Encrypted:	false
SSDEEP:	6144:pgKqgv6i9FOVJTzbCGyRSr39IMFusn9KT3CtPuc6FUi96ymSvoqg8F:pg0iaF6zbCGyRSGMhnwCemSvTF
MD5:	CA3D0BE343760A964CB603DB2AF834A9
SHA1:	1A0AEC452CFA3CEE23CDDD1B2A2B1AA8C1763E66
SHA-256:	F488DAF44BAB6BF648454C4021C789D748E97A86D782F8E5584AB7FD62DCF21E
SHA-512:	553400CD94A7D716C0D95E5616A97BACCF93B7CD312DAD36BCDC9F0448D347824C0EB704A8DDFC0C7B1C94BB5A60D23FFE548730AC802F027328A3BBBB208A2B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*&.{nG.(nG.(nG.(u..(.G.(u.1(dG.(.1.(jG.(g?,(lG.(g?<(}G.(nG.(.G.(u..(VG.(u.4(oG.(u.5(oG.(u.2(oG.(RichnG.(........................PE..d...a..R.........." ................................................................>.....@..................................................................p.../...v..8.......\|...@...................................................P............................text............................... ..`.rdata...=.......>..................@..@.data....K... ...$..................@....pdata.../...p...0...6..............@..@.rsrc................f..............@..@.reloc..d............l..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\is-S4LL1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	565560
Entropy (8bit):	6.005763993777021
Encrypted:	false
SSDEEP:	12288:Mrn8rdaf6oZKnG6Q11H1Mh0Wi9PE5EU8ohEh8:MLAd/G311H1MhwPE5EU8w
MD5:	1A78E7A8663EEF523B3D8F0BDBEC1591
SHA1:	B78961F272936B1EF78C40CA8B8C7CBAEB4398F8
SHA-256:	9E3C03DCFA364BA35A51C934BAED50C224FA7036BB85E742FB3003E1552B981B
SHA-512:	93B11C1074A4B7332E052ADE70E252C573211FF66D2F5B28BDB2522D99233CA7EAC7C3126059D2FA9BF41AA95C5CADABD88451E274AE6B1BCA4F501FE5CA9785
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...M..M..M...M...M...M..M...M..M...M..M...M...M..M2..M...M...M...M..M...M..M...M..MRich..M........................PE..d......R.........." .....r...........................................................m....@.........................................p.......`....................P......8.......`...`................................................................................text....q.......r.................. ..`.rdata..P............v..............@..@.data...8T... ...*..................@....pdata...P.......R..."..............@..@.rsrc................t..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\is-S6M9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	974096
Entropy (8bit):	6.429675765196326
Encrypted:	false
SSDEEP:	12288:n+V4B80jynsosfKY8nDv3axtTXgjez5/tgsEQmShpHA7ImB:n+4B80jQsosT8nDvGgja/tTEagIw
MD5:	7F8F12AFF5334B5CB1B90F2DC36017D4
SHA1:	D13776AEE7D2BE98F276ACE43D64FF49F7226485
SHA-256:	A4A04D5486FE5BA55413944C68CEC5EF2AE1B31ADA31B4CCA505017EE676C49E
SHA-512:	CD9535B4C8113E4B8CFC957C21E81A65402B67EDCDC606FE5B6B499DE5D08BC6BFD22C75ADCA0EF42C8EA97FCB157E8BFE4CB189925D2A91273852E0041CC326
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.Fn...n...n...g.l.U...Ir..c...n......g.}.z...g.k....g.b.d...g.z.o...g.y.o...Richn...........................PE..d...tA.W.........." ................H........................................ .......Z....@.............................................L...x...x............@..,........?...... ...0................................................................................text............................... ..`.rdata..............................@..@.data....x..........................@....pdata..,....@......................@..@.rsrc................d..............@..@.reloc...7.......8...f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\is-U28V6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7333160
Entropy (8bit):	6.199154470748035
Encrypted:	false
SSDEEP:	98304:s90tFsyUqQOhu5qGYQfK4XHjTBzuOuc6C:MIFsyG5FYQS4XHjly5c6C
MD5:	23EAEC58CF0E50F21FB9BAA1D6E463C8
SHA1:	098415CDADCAAA6C9EE70FB5ED4B6793793B92DF
SHA-256:	3E8880E67EE54264A09E398BCBB6BA86F7A043CB9466829ACB9F4D72E55077FB
SHA-512:	42406FCFFDDB0EEEC470B8C540E0EB4FDB22A52EE30025DBC1B4C36E8F615768CE63C88A8DB5D7F897034DA7336BBAE89C9321810585CD42A62D22C59AA23CD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.A...4.d.....?.d.....#.d.7.d.y.d.....5.d.......d.A...".d.7.e...d.......d.....6.d.....6.d.....6.d.Rich7.d.........................PE..d......M.........." .....(K..........n:.......................................q......7p...............................................\.@....`b.......b...... ^.......o.......b.."..@RK.....................P.R.(...................@lb.P............................text....'K......(K................. ..`.rdata..P....@K......,K.............@..@.data........ \.."....\.............@....pdata..h?... ^..@...,].............@..@.idata...(...`b..*...la.............@....data1........b.......a.............@....tls..........b.......a.............@....trace........b.......a.............@..@mx_api........b.......a.............@....rsrc.........b.......a.............@..@.v-lizer~.....b.~.....a.............`...........................

C:\Windows\System32\is-US67P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.2219889994106685
Encrypted:	false
SSDEEP:	1536:+cvJpLG8whhLPIHb7h2F+7uayy7d8l/4aKYtRsyDdFEUaDOEJB55xXpO7:TJpLGNhyHogaRyB/abRJFEtDrB5zX2
MD5:	38220BC554C4B874A1BC76FF86586BE5
SHA1:	94A08FB0533FCF20955743FE69940674FF32CA41
SHA-256:	0EF48406386783A1C7E353EC2B87A636593934B8BCCC28EB29C33A65B39C7B92
SHA-512:	F9E4328207E1832A7F709229AD896AA8FD343103A33D8CF8E388C6E6E3D8E37F2419096732D8B221C696BDFA381D99AB183B9BA3C636A8F9B7EC5A477644808D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.....U..U..U'.9U0.U'.>Us.U'.(U$.U'..U,.U.).U+.U..Uy.U'.4U,.U'./U/.U0.)U/.U'.,U/.URich..U................PE..d...yx.W.........." .........b......8H...............................................Z....@.....................................................<....p.......`..................<.......................................................8............................text...)........................... ..`.rdata..n1.......2..................@..@.data....)...0......................@....pdata.......`......................@..@.rsrc........p.......:..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624840
Entropy (8bit):	7.165075877000891
Encrypted:	false
SSDEEP:	12288:M5mWukhI2jFMSjysAS9X/GsfTDYrGi81LBrukB/FOGOaWXXoC6J9hDnmFJ:M5mWpI2jFM5sFzfTpieL8asLp6DhE
MD5:	9B29FA18CED2536A6AF5978740439137
SHA1:	37769CCB26FCF75C45B12AFC6987F3094622FA52
SHA-256:	E2DEE005D5361F8D3A4934D545BBD0FBEDCC37FD2F555C4A5344F5F6F3CDBEEC
SHA-512:	C33EA247BFAE41C68F63BCD174C08CE8C4889A8980D08E6BC81807C3EE4BA4028CEE735A755631806AA1537E6A8407F78D5815144B80C1B536108D4F34EC95CC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa.....................\|....................@..........................`......L.....@.................................<...........,;..........._...(... ...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...,;.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1028\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5611
Entropy (8bit):	6.235572422524166
Encrypted:	false
SSDEEP:	96:MToIgDsA9tfHP8+8nhM0WamzLdDF63vGNZ2mfGvsNn957jQUA9Q2Rd0E/sVbCtrE:HtfdT/dJ63vGNhgsNn9KDjtwv
MD5:	B9428C94444693B5E3A392C8D0B95170
SHA1:	0FB22D01F1C11CF74E844C19C96C41B1C0515D71
SHA-256:	C0413EDFD13FD27EEAB7B8CE60963668236466C48F4173C29F84093011C281AF
SHA-512:	70212889F8F8A070FBCC81EF6121999518F2BC7EF369E2A38B3F0F825870E88B9327F837DE884C52E6AC0A1C750F07121CD17EDC2E932C993C73A43275AC1180
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">............. 10 ...............? ......!</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">...</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ....

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1029\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6283
Entropy (8bit):	5.412515462910997
Encrypted:	false
SSDEEP:	96:MTXmBtOxxHOy/9xLfpZJYFZq5y5PBF1ONWo21jvaljZ+5Eh27LWAozGbRfXd:cMIxHOy/95JAQ4dONnUjvWjHWXd
MD5:	27411946EF45B3B8236319421770E5AD
SHA1:	D00D3E2D4FA3429F2578325DE364DFCCE51D8FD4
SHA-256:	C92D3EFD72D6D14148F9931128EE4143AFFD1DA517EB358AB88ED4138C1434A4
SHA-512:	FF24B47504D6E752F1FA5BD388DA75338078F72B5D17094D2BC9426B35A55DE097629C3EC53356723253A8D7373DCB2B2D921BDF0BE6FD4A524C9AA8913277EB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instala.n. program pro [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Pot.ebujete jenom prost.ed., textov. editor a 10 minut .asu.....Jste p.ipraveni? Dejme se tedy do toho!</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">P.edchoz. verze</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz.

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1031\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6321
Entropy (8bit):	5.144950913547635
Encrypted:	false
SSDEEP:	96:MT4UlN7xSbu0N8+08Yp6VaSGjOjB5gBUOzM0vLjCcTcu+MbRk6:2wrzY6xGjOjrQgqCU7
MD5:	B45249A2238A5568B377E58D4CE89E9A
SHA1:	57A68133AF7EF4062559D9144D9CDA4AA28722FB
SHA-256:	0C4203A81DCD01D53378036AF78CFFCF9E9A5AF7754DFBDD56584AE74C21CC61
SHA-512:	6485548B9F4E0CDBD2876B0FC4DCA5C125D260E237E994EE67823EDC72C358CDAD4E1170DF62E67A0D1249F54EE6BEA26741CBF8EAFE952154E182008F31665B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Sie ben.tigen nur eine Shell, einen Text-Editor und 10 Minuten Zeit.....Bereit? Los geht's!</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Vorherige Version</String>.. <String Id="HelpHeader">Hilfe zum Setup</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen a

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1033\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5714
Entropy (8bit):	5.130490122689639
Encrypted:	false
SSDEEP:	96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
MD5:	D5070CB3387A0A22B7046AE5AB53F371
SHA1:	BC9DA146A42BBF9496DE059AC576869004702A97
SHA-256:	81A68046B06E09385BE8449373E7CEB9E79F7724C3CF11F0B18A4489A8D4926A
SHA-512:	8FCF621FB9CE74725C3712E06E5B37B619145078491E828C6069E153359DE3BD5486663B1FA6F3BCF1C994D5C556B9964EA1A1355100A634A6C700EF37D381E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">You just need a shell, a text editor and 10 minutes of your time.....Ready? Set? Let's go!</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Previous version</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1036\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6389
Entropy (8bit):	5.15785538021277
Encrypted:	false
SSDEEP:	96:MTCB7IPd14H1/qt2D7HF9+XLjMYjMEy+YvIsrLQ5k4vbfV+o:Tnt7HF9+7jjjDr
MD5:	9F779700FF90DF7211AE3A3340DDD5FC
SHA1:	A4E05D7A489B095AF4805660D7BAB4F2DA3AF34C
SHA-256:	6AF5C2BC88B1E5CE188A97DD9204061D66369EC2689B3657AFF1DC6188F44F22
SHA-512:	5DCA90FDB1B498BC982CC8489DD13ED492A7856B701D9FB43D46EF01D40B49D9888E7AC35BB5962DCF72241F05A4E006130F94372A7C4D7542B708E71B0663A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Programme d'installation de [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Vous avez juste besoin d'un interpr.teur de commandes, d'un .diteur de texte et de 10.minutes...... vos marques.? Pr.t.? Partez.!</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler ?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Version pr.c.dente</String>.. <String Id="HelpHeader">Aide . l'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [r.pertoire] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du bundle dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface utilisateur minimale, sans invite, ou n'affiche .. ni interface utilisate

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1040\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6153
Entropy (8bit):	5.08027497707843
Encrypted:	false
SSDEEP:	96:MTawWwvw8WutJ/s9FwNNN7Nf9DW+IuhUjH9e5jx9S/l7LthZ/dDLbxDPnH:XYpnhFpCjH9e5jUDDRbnH
MD5:	347BE63418F507E7F2A086726E96FCA8
SHA1:	E42E9EBFA654134CF243841BEED2370BA12A627D
SHA-256:	344ACD0D3665BA489EB30EBC0F902C625E1AD33A4E2B5BA7CDD7E463658D5557
SHA-512:	3BBA2E5A3F5407274EDDB076702E640646DFC7EF43AD9F08C05E99F0ECCA67E6F9DE2DBE4E3743A74107165B935D36C979CEE23A22ADCF6139D5BEC47B541325
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Programma di installazione di [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Bastano solo una shell, un editor di testo e 10 minuti di tempo.....Pronti per iniziare?</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Versione precedente</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita, viene visualizzata l'inte

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1041\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7130
Entropy (8bit):	5.924193901706645
Encrypted:	false
SSDEEP:	96:MTAiXgh+RNmvFo6bnpojeTPk0B/vueX5OA1yag81TCkHdGW2jK+bQaBU7jCfFq/F:hsJgD1D8rag81TCgdGfjK+dMX
MD5:	E5FD798D4BBDD419A602423A699E2854
SHA1:	2ECE478D5CE4DE0C0A864F14CEA6BD365F008D81
SHA-256:	00AEC52B4564BC07302881FCFD510F7CCA535AC9E05CFD95A86738171626F6C4
SHA-512:	AB3B93B635211F112D8D820861FE77E9D7C67018688A6A2A1B82532EA9A97609F02E7E9B0DC658202CE0441554A3CB2622F6EDC61456E0D250AA8F3DF4BCBBF5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">.............. ............ 10 ....................</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">........</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .................................................. ..................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1042\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6175
Entropy (8bit):	6.0499722174257835
Encrypted:	false
SSDEEP:	96:MTFzghDJJCsgqf6YVgo4uU5VqI54U5TLzpDcmUUcdIoa/2GU/tiLAWw/zRPCEbtn:SgaXdusEAzxhUPjD/zFCK
MD5:	F59A0369A337B58A797DDBB5EBBDCADC
SHA1:	4E6C9501ED901B5C1D4B6713A632E899D223679B
SHA-256:	1B1B0700AA6677AFE3581B8B3F4934BF85F4750C544A108E1D5F1B688078E1CF
SHA-512:	B12134295DDDF5FC4F63E23C98C837AA02E5FCFF5191087FDC7C0B044F472487987966282B8955421DBFD480707305E0E7AF65F307655F876615AB36C24786B8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] .. ...</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">., ... ..., 10.. ... ... ..............? .....!</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.. ..</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... .....

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1045\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	6421
Entropy (8bit):	5.347808263199206
Encrypted:	false
SSDEEP:	96:MT3REmXsPGriQBu2uOI9qUyH42TqU5uKZKezbJFGeZzL5YY1oui1ebf4yA:WRE9PGromUy/eU0KZKQbCBr
MD5:	8CFBEE02F1C88567CD9AA747FF27182E
SHA1:	ED18F294EC1E36629900DB42797F1499DB080F4F
SHA-256:	D92B3838DE7A1685CCBD04FC9C123704FBD198BFD284D8FAECE4A3663494E75A
SHA-512:	63C53C29382BADB2AECFB67284755CAE978AF114F957A1B3466B91DE8559D6DD4B2BD4B993589E3AD25AB316E90D2C99479A4589057DC8B80C88BB552E7EA519
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator pakietu [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Potrzebujemy tylko pow.oki, edytora tekstu i 10 minut czasu.....Wszystko gotowe? Zaczynamy!</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Poprzednia wersja</String>.. <String Id="HelpHeader">Pomoc dotycz.ca instalacji</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wi

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1046\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6068
Entropy (8bit):	5.196129338199214
Encrypted:	false
SSDEEP:	96:MTfBWJal2UsdMPWFdj5VvvQjZ+zyhomLQ8zbG2zWHA:PgS+WH1VvvQKpHg
MD5:	88CB193F0B0C15023D789E0F8FCE3E03
SHA1:	38E1390A410D751C6376F5E23A0933FA08C8AEC5
SHA-256:	4D6A2D306ABE77E7DBDB2609F6198B4CF99B3F9DC15B9DC72951592AD2F64384
SHA-512:	B894E05C79C95D03481211DE8FCDE00D79767AD3B3483AC95D8B16421D719473D7A9829D996B60EC1ABC3830048FEEA1CF49BACAAA3ADDA0DFD5971EC2EA5F1A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalador do [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Voc. s. precisa de um shell, um editor de texto e 10 minutos de seu tempo.....Tudo pronto? Ent.o, vamos nessa!</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Vers.o anterior</String>.. <String Id="HelpHeader">Ajuda de Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio] - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a interface do usu.rio m.nima sem nenhum prompt ou n.o exibe nenhuma interface do usu.rio e.. nenhum prompt. Por padr.o, a interface do usu.rio e t

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1049\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8007
Entropy (8bit):	5.451843005546111
Encrypted:	false
SSDEEP:	96:MTdqIIgo/hyoJ88k193iFXfVvsuiu+q503Gl75N7JRgbGz5bVTxXh:Z/9ZyiFXfVkuiu+fWhwQD
MD5:	1D628F2E1DBAA25BDD8CF2D7F2A9CAF2
SHA1:	5C4F2A69772A20088779E7288FB37CFB6EAF4C42
SHA-256:	C7CC8E0BDD4F82DA33984F553B576412DF69C5E1E5B8479542D024CB6B41D050
SHA-512:	F6D3969F48B42A2F6EED8EFDA3A9EB5F5D9A4B69C6039BD7EB72CDB1E01B2C69DC4BECAA8133B7DDD7A6325CBB17BC56FB11BAFA7FADFD1AFA9A84B6FE3CA0EC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">.......... [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">... ......... ...... ........, ......... ........ . 10...... ..................? ..... ........!</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.......... ......</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] . ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\1055\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6154
Entropy (8bit):	5.342211356119282
Encrypted:	false
SSDEEP:	96:MTIKh5C6PHcIflKNTNgdq91GKbl7zjKjJUSyJpx3DwdPMboZp:IdKNp4KblfjKjCCj
MD5:	2897BAEC061B9A89661744685FE3C217
SHA1:	904753D6DAF2EE3A05319F045E4F2028A8AB576C
SHA-256:	285E32E649EB71A68F29BCA7321A6CADE50D79F94DD89E50ECE1197DD70E7633
SHA-512:	574F3FEC930CF960DD9725CE1298501D7AD88AC59EFCFB61032A2C3F3BBB12EF91BBC1CA63D1516DAD93FA202C25655754AE1C5BC6607B5CA7A0209F7A55576E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Y.kleyicisi</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Yaln.zca bir kabu.a, bir metin d.zenleyicisine ve 10 dakikal.k bir zamana ihtiyac.n.z var.....Haz.r m.s.n.z? Haydi ba.layal.m!</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">.nceki s.r.m</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\2052\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	6.2165153145467595
Encrypted:	false
SSDEEP:	96:MTsnfsdy5kQR9GLkE0tVq1bLZ6gWogUtmN3B5DQKaop/Y9b1jnTDA:dJ9/q1bLZ6UgMmN3AP/8
MD5:	ED946A363E47DCC77017EC10B1032C54
SHA1:	C37B26426B51F9E5F405EF7798833FC017E653D4
SHA-256:	3BB9CE59BA1C4B76FA6B35F544E2B04C85387053EDD8B25D8C8D4FE637FB0A85
SHA-512:	FC65E04A87E5ADD299B71F1332D47F9E4D46F7F97139BBAF101CE0A1D7DF9D7DB8C33E4625CA9748C7607F4D43FF93E612B57ACD38DD5264FC6924446BF881BE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">...... shell............ 10 ..............? ...? ......!</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">....</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\3082\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	5.110353724144242
Encrypted:	false
SSDEEP:	96:MTyvAuLILaisbyxwz9sgIq2RjIk3jnTPjO1Eu2H2i/X05/b2epm:znCLRkMjnTjO10Mm
MD5:	1474C297B47C24D9E8E937CCBF50C4B2
SHA1:	012226924911C23DCC220BD653C329A304B2BA58
SHA-256:	FAB76FA9382A7793309C9B07D5BAAA3EFD8553172D46F8B69E22E30B635BB146
SHA-512:	3428682ED3EC803E709B30251C4233DB7C825EEFBFD718777211B6B80CD5EE36CBA1D08850E6294D4C4148E8D640171FD62764CBEDD7C9AC3BD628B48BF010F5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalador de [WixBundleName]</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">Solo necesita un shell, un editor de texto y 10 minutos......Preparados? .Listos? .Ya!</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Versi.n anterior</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. Install es la opci.n predeterminada...../passive \| /quiet - muestra una IU m.nima sin peticiones, o bien no muestra la IU .. ni las peticiones. De forma predeterminada, se muestran la IU y todas las peticiones...../nore

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (596), with CRLF line terminators
Category:	dropped
Size (bytes):	7728
Entropy (8bit):	3.7575495893991016
Encrypted:	false
SSDEEP:	96:XeV2VS1/n6+g820wInych8xSUn6WgvJ0wAnycZIn6agdR0w8nyc9II1n6jgTr0wI:X0sm/qiaLDiyS92wWpIP8v49+VzB
MD5:	90DAD7034DA0F46538F3FA5AA1C2D99B
SHA1:	C0C9515DC048A527E0A574E6BDDDCDAC0BA56EA4
SHA-256:	758F578C377AFF1964025CAE438F3D9572C8FDD5090067E64C450BE2AFABF6AF
SHA-512:	79A8682FB435FB412102BC683EB85405193A51C3472AB630FE3C7AA456D5A7E122A53C9ACEBE86B0A6C693C55CE459FB0D3BE751300E07473D7BB22DD78CBD35
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .M.e.s.s.a.g.e.=.".#.(.l.o.c...F.a.i.l.u.r.e.N.o.t.S.u.p.p.o.r.t.e.d.C.u.r.r.e.n.t.O.p.e.r.a.t.i.n.g.S.y.s.t.e.m.).". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .D.e.s.k.t.o.p. .R.u.n.t.i.m.e. .-. .6...0...4. .(.x.8.6.).". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.s.". .I.d.=.".{.f.f.0.d.7.b.6.b.-.8.6.2.4.-.4.2.f.0.-.b.9.6.1.-.6.9.e.6.c.b.f.8.9.6.c.1.}.". .U.p.g.r.a.d.e.

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\bg.png

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	PNG image data, 620 x 418, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4601
Entropy (8bit):	6.635104571353389
Encrypted:	false
SSDEEP:	48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
MD5:	9EB0320DFBF2BD541E6A55C01DDC9F20
SHA1:	EB282A66D29594346531B1FF886D455E1DCD6D99
SHA-256:	9095BF7B6BAA0107B40A4A6D727215BE077133A190F4CA9BD89A176842141E79
SHA-512:	9ADA3A1757A493FBB004BD767FAB8F77430AF69D71479F340B8B8EDE904CC94CD733700DB593A4A2D2E1184C0081FD0648318D867128E1CB461021314990931D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...l.........Z..\|....sRGB.........gAMA......a.....pHYs..........o.d... IDATx^..}.].]...}...&..+.Ij.D..qp.b.......v(....h.[...E\|.:.+.h..N...V.....`K.....BR.[....l...z_=.....K..n.....o...s.=.nf.s.9'........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N~.......S.Y.v.>{A......S?..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..H.`..

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\eula.rtf

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47889
Entropy (8bit):	5.0783959060546975
Encrypted:	false
SSDEEP:	768:32Kfuh/+YpJLdfxL1/pZ1ApGXjn8lcNLSx0:3Shj9bXQ0
MD5:	CC06442CFC33D0AE6509143325C05110
SHA1:	FC635958A57B88F63545CBEE1A37E3458CC547B0
SHA-256:	72F2E7B06C562F1DD6CB3F6EFDCCD9AE620A183E598856AB3CBA6D712254824A
SHA-512:	4D8A79347104501D89150A738DE24F700DC5D54D7CB05359C853A1189BF12B42E53B9E0B0D4A963C6AAA027D46D80A01AB2740BEE5D145C3597F1A7EFB48D4A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0302020204030204}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Tim

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\thm.wxl

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5714
Entropy (8bit):	5.130490122689639
Encrypted:	false
SSDEEP:	96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
MD5:	D5070CB3387A0A22B7046AE5AB53F371
SHA1:	BC9DA146A42BBF9496DE059AC576869004702A97
SHA-256:	81A68046B06E09385BE8449373E7CEB9E79F7724C3CF11F0B18A4489A8D4926A
SHA-512:	8FCF621FB9CE74725C3712E06E5B37B619145078491E828C6069E153359DE3BD5486663B1FA6F3BCF1C994D5C556B9964EA1A1355100A634A6C700EF37D381E3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installer</String>.. <String Id="Title">[BUNDLEMONIKER]</String>.. <String Id="Motto">You just need a shell, a text editor and 10 minutes of your time.....Ready? Set? Let's go!</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="ExecuteUpgradeRelatedBundleMessage">Previous version</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\thm.xml

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11327
Entropy (8bit):	5.15671975859509
Encrypted:	false
SSDEEP:	96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
MD5:	302563A713B142EE41B59E3EEAC53A90
SHA1:	1340E90CC3C6C5FC19A7FEB61D7779F4A4F0FDB5
SHA-256:	83CA096F7BA2C83FC3B3AEB697B8139A788FA35EB8632943E26BB9FFF7C78E63
SHA-512:	C9D4DFC20802BB542178300D1044BB94B35593B834AB0B50875A32953F890E48DA456199128500E2C1FEE26EAAF8C2C4FCAFFB308B37914215F900CDD5C4CBC8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="660" Height="468" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="900" Foreground="FFFFFF" Background="D42B51">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.. <Font Id="5" Height="-14" Weight="500" Foreground="444444">Segoe UI</Font>.... <Text Name="Title" X="11" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" Center="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="0" Y="0" Width="620" Height="75" FontId="1" />..

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.ba\wixstdba.dll

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201752
Entropy (8bit):	6.684385468940799
Encrypted:	false
SSDEEP:	3072:4Fj2AYmaHqco56wsPZozShZTjVORuXzv7x5Okw7QWwF4QUdPArtOuw6meOlONtZz:4Fj2ARaKaPZ3TjcAR5OflbQ7tOzKh40V
MD5:	4356EE50F0B1A878E270614780DDF095
SHA1:	B5C0915F023B2E4ED3E122322ABC40C4437909AF
SHA-256:	41A8787FDC9467F563438DABA4131191AA1EB588A81BEB9A89FE8BD886C16104
SHA-512:	B9E482EFE9189683DABFC9FEFF8B386D7EBA4ECF070F42A1EEBEE6052CFB181A19497F831F1EA6429CFCCE1D4865A5D279B24BD738D702902E9887BB9F0C4691
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../.../.../...J...%...J.......}...?...}...>...}...0...J...:...J.......J...2.../...........6.................../.k.............Rich/...........PE..L....RKa...........!.................................................................Z....@.........................@.......,............................B..............T...............................@...............T............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624840
Entropy (8bit):	7.165075877000891
Encrypted:	false
SSDEEP:	12288:M5mWukhI2jFMSjysAS9X/GsfTDYrGi81LBrukB/FOGOaWXXoC6J9hDnmFJ:M5mWpI2jFM5sFzfTpieL8asLp6DhE
MD5:	9B29FA18CED2536A6AF5978740439137
SHA1:	37769CCB26FCF75C45B12AFC6987F3094622FA52
SHA-256:	E2DEE005D5361F8D3A4934D545BBD0FBEDCC37FD2F555C4A5344F5F6F3CDBEEC
SHA-512:	C33EA247BFAE41C68F63BCD174C08CE8C4889A8980D08E6BC81807C3EE4BA4028CEE735A755631806AA1537E6A8407F78D5815144B80C1B536108D4F34EC95CC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[.s...s...s.......s......$s.......s.......s.......s.......s.......s.......s...s...r.......s....Q..s...s9..s.......s..Rich.s..........................PE..L....RKa.....................\|....................@..........................`......L.....@.................................<...........,;..........._...(... ...=...{..T....................{.......z..@............................................text.............................. ..`.rdata..t...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...,;.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\dotnet_host_6.0.4_win_x86.msi

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {1C8C434D-4CB6-4F19-92B0-739C1BB52D6B}, Create Time/Date: Mon Mar 28 22:15:24 2022, Last Saved Time/Date: Mon Mar 28 22:15:24 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.471928236216391
Encrypted:	false
SSDEEP:	12288:KIBjxMbJxuz+N1qqGCVt07kw3jl2tBds:LqTm+f2CVql3CBd
MD5:	E272913E581C11624BE39D55E81A07BE
SHA1:	CC9B92914BE59FDF6D227A629B8078B834DE273F
SHA-256:	F80E1AE91FFE984A9F0AD4E7B8BB06A0B6D5C66F2189C33696817E9ACFABC4E9
SHA-512:	80E8CC96FA32BACA5F2F4B6A7781B363BE827D96E37D9419EF11D59FED54A3A4C15F9215E39844725128DB4E8829CBF2CEE1360270E77551488A27ED64B81BDE
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\dotnet_hostfxr_6.0.4_win_x86.msi

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Host FX Resolver - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Host FX Resolver - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {175CFDB7-5B52-4EF8-8B9B-924D8E65D96A}, Create Time/Date: Mon Mar 28 22:28:54 2022, Last Saved Time/Date: Mon Mar 28 22:28:54 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	802816
Entropy (8bit):	6.654815364510836
Encrypted:	false
SSDEEP:	12288:4iSlGY9IBjxMbJxuz+N1qqsCVt07kw3jl2tBds:vSeqTm+f8CVql3CBd
MD5:	E2416A04AA679FCD0CBBC8E705A6A7C7
SHA1:	9408D2A3F620535BDE620243400B34D6D21A1C4C
SHA-256:	B0C5FE8FCF2996B6C340EAB544CFEAEE18578B525762EAC06128E42B6F6B281C
SHA-512:	0C9BF3961BF2C83453E8F06F6BB1793416F492A9EE94D05506D5A1F49DECF01155AFCE128B4F5E92D1B9201E5A80BE16AD0B3A4D25229FCDFD98BDA0FFB03709
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\dotnet_runtime_6.0.4_win_x86.msi

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft .NET Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft .NET Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {25B8B5B6-686E-443A-93DD-4A03FC1447F9}, Create Time/Date: Mon Mar 28 22:34:04 2022, Last Saved Time/Date: Mon Mar 28 22:34:04 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	25038848
Entropy (8bit):	7.993694661390324
Encrypted:	true
SSDEEP:	393216:8F7jKrMX/v9NiMxo3lVZvpbEjsFiOzTrlf8akZq8l/Bahg3S6fXz1KM7vubjcl5J:8FPKAdipvtJiOblf8xZq8l/dSmD1l7vf
MD5:	CD9EF7D9D429445AFDEA12E5CC78E5A3
SHA1:	59B0161EC1E3476474E1C3AAA919685932C2B974
SHA-256:	B4847FD536D9A6F39D79ABA8B077E313DB64485D79A02B6D69A3E16FA673E037
SHA-512:	76E3CFAA0ECB9CFE957C9601CA3537E0531EFDFA9426E56510414F0323F88D824C98E9EBE6D387DB52C65AB9BB1E01D2680EDC94658D9C4CD76D1484DC66BC33
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\windowsdesktop_runtime_6.0.4_win_x86.msi

Download File

Process:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Windows Desktop Runtime - 6.0.4 (x86), Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Windows Desktop Runtime - 6.0.4 (x86)., Template: Intel;1033, Revision Number: {951FC065-6FC2-4A32-9FB6-99EEDC7A8096}, Create Time/Date: Mon Mar 28 22:28:22 2022, Last Saved Time/Date: Mon Mar 28 22:28:22 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	27099136
Entropy (8bit):	7.99437933130602
Encrypted:	true
SSDEEP:	786432:14AC9LZT7/xen9hQfFZJPeElult56O/AU+bq+Cpd:1NC9lTa9wFfTGzT4bqh
MD5:	3CC0458C467FD646AFE4EFC103ECC634
SHA1:	C42C5740E3A10229E250969F22ECDD7376698488
SHA-256:	E67B62CDC6D66720AA82977863F38E3469C45C3CA3F752032DEC709A173C209A
SHA-512:	AB6434BA2DAD9138082AA9D657A850659BD84140D9D90BDA72D54FE688839131C33B333926A306AF27BBD89FA2D7240C73181C530017B01E132834B5A639B819
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF02E1325C5741F6FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5838690760379122
Encrypted:	false
SSDEEP:	48:Lvh8PhGuRc06WXziFT5LEdgxfmSSjndidVEcZvMCSsndidVEQWzx:QhG1nFT6gxfdPJGEx
MD5:	32C6F965FA5511503DE1025ACA0FC0BF
SHA1:	650F013DC4CC28598E0ECE293074ECC32D0FB320
SHA-256:	716DABD5E278CE873F8491594E8788926BE40040A8334EC74936CA557ED4E877
SHA-512:	74C83210FA931510222BEABCC17D52B4CAE556DACC2B6A6D2892F027F880BEED72353D8E23BD4DA7FF09F09B721F0D5E71C9AD020E387B8F46A8D128D0CD5699
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF04E0F45A44A1F6BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2655862414179269
Encrypted:	false
SSDEEP:	48:YfOugth8FXzzT5tzEdgxfmSSjndidVEcZvMCSsndidVEQWzx:+OSNTEgxfdPJGEx
MD5:	4479B39AE21A09D0CE77C997EC914AB4
SHA1:	FC2F06DEDD374BC61E1A46443D40978472C77DBE
SHA-256:	4CF98FBA0C64D5A6C5BB5DA2667D69199AFEF7577F42EF1826C9A05E30E94A8C
SHA-512:	8459972BE8BB89A1F91D3AC3ECB10229ABB4CDDB24BEF7A60521371848AD2C92F31F98E607B4E3867341E5CBEA3B1495D6BB4BD806DB17908F09177367DE34B9
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF073DDC2012BE80B3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6125488226067326
Encrypted:	false
SSDEEP:	48:o8PhPuRc06WXzyFT5bwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:3hP1XFTOUetPZDleN
MD5:	B0A42AD29D68EC21C3D45BAFFB6DAA91
SHA1:	5D722F8DB4977A481B73572406040F1A176D4E8D
SHA-256:	98339DA9F45069D608E0A15D0000D1F1EF5D2D9D9CAD9079F22D4D3ECCF323C4
SHA-512:	BF5705A8CDF33D41B12B685568BFC05DAA6BFE069FF80C538E4A02862D48C91FEFBC1213879C2AAEAA58B443A93CAAD9388B37401C8001F74CF12346C80E7DD8
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0BFF768E3081E247.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.13581971172723176
Encrypted:	false
SSDEEP:	24:+pQEEuipVGnd9ipV5nduEVWZYgNlGJZkH8+RdMCle86:+6EEuSsnd9SjnduEcZvMO8edF6
MD5:	1776EE11B63BB24E6FF1832A6198866C
SHA1:	2884F7A3B0FD04861288E2C6ADA28E0DC468EB3C
SHA-256:	EAB18048B8355B1B036D8820C58E8CC3216F4C3D2D098208175F0AB79ED0026E
SHA-512:	87890CAD0C2FE0A3330B59D8707A72A6F64AF79DC3612717705CFAD886AF5F9F8EEDDDB33CCEF7A2BF15360363A627DA5DFA4BFD3488EAAED7F48B7697957FEA
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0C681851DD2150B8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.15067383731187994
Encrypted:	false
SSDEEP:	48:7xcWcEuSsndidGSjndidVEcZvMP8adgxD:7xcFNPh2gx
MD5:	7A59748DC8AE03BA03E7DCA02A21183A
SHA1:	B3F1E1370D079D548B2E2BCC83DAD08778423341
SHA-256:	FDE418B036F6B0585957CA69EE24D65A30A7F1C468CDD6B542BE9D36F7B7662A
SHA-512:	14E07EBF5DB5EB6422C5820D24300DE7971386AA9CEE76B94238347E5FBDF61091521486C5DE2C55D63A8BC7800A8AA2FE2CBC2726F22CE6BC7395824681211C
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0F2014B92D304338.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF273AA090A4D63131.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2CE3646552DFD96A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2854122243658859
Encrypted:	false
SSDEEP:	48:BaXuvth8FXzDT5blwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:AXv9TV+UetPZDleN
MD5:	CA0A1CFB4DA1E0444445274CBB99BBDF
SHA1:	F6A5A270E2F0A703993DA2D7E495B92C339D4C02
SHA-256:	0B897A0E66978A326AF9C2B1F537E736B519764E1391343AD2BF474DCD3ECFF8
SHA-512:	E897CB567DEDBD27B30EF4356C8F1387B7766DAAFAF8604EDF2325E97C6781A66040A241D230EABB38E2529347DB08FE0B08DD2B3E6EBA6ED7101FB6B59431CD
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF308E18B8BA3FF67B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.153893113800032
Encrypted:	false
SSDEEP:	24:5sXFUEuipVGndidVIipV5ndidVHEVWZYgNlGJZkgJ8+7dMClycjZ:5iUEuSsndidGSjndidVEcZvMjJ80dLd
MD5:	0648F10957DF2F4CD0D1748330E3F930
SHA1:	7D51D2C052379095C1C13666E0CA65219C4BDD53
SHA-256:	78E201FBACC840FECD63813D42FF8F4E00BF4BD2A5B445D01B9F834E811CA971
SHA-512:	ECA06DF8852869967A6463D83B8EDBD35DBED50E7FE6DAB24C9D237143C002DE94845FEC9CA2572B15A6401E87B3B2E1685C12DBCDB2981ABAC3E1DDBDD5F827
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3CA6BB94385B987E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3E3740D64E740B02.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07732799585740281
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOtAxN9Kt+PIEKiVky6l51:2F0i8n0itFzDHFtAj9LBAr
MD5:	0FEBA16620F4629BA705D5C031E297EA
SHA1:	3B25894449C1DF6F3659F2F82ACDA022BBF51649
SHA-256:	0288D6044D937FD415BED5A8B6A4A765607A31C2021335DF5F6B0E016AED24AC
SHA-512:	1596DF7D0768A8FA6017F752B85937E9E3AB13176786F6FC75C6541EA68DA1C9072639D0CDDAFD38AE12D8FDFADC4BD97FBFE9BE3E0C99B86F77DF97D21BB61A
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF40327F853805232A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4120511588445820.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F1399BDA59E8582.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5478D351C98CAB7E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5866760583208857
Encrypted:	false
SSDEEP:	48:48PhGuRc06WXzEFT5LDdMImwsmSjnd64duEcZvMySsnd64dIEQC1I:HhG15FT7MImwzlJ08I
MD5:	8B9EF9D71806B8B123C5616E1BF65117
SHA1:	7756F0D9CD223BFDFBFE0A20FA69DCAD6C59B2F7
SHA-256:	E49F20ACC44C703CE5156AAF6C2D8546A634037C3AE253444969E99A3164577F
SHA-512:	9A6C6536DDF0CD9D78474687DA99920C4F7FF6AE2A644CB3892D6DFE5BB13007E5AADBF2A982193EC9E6B88D118FB8E72645B130A7C7A6084A6503F928053EFF
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6053BBBD5687DA32.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF615C29BE886EE5D4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5928483104573938
Encrypted:	false
SSDEEP:	48:J8PhGuRc06WXzyFT5LVdLgI1SSjndidVEcZvMCSsndidVEQi:EhG1XFTdUISPJG
MD5:	A2BDEE0139CDE00D58D2E56C9668430C
SHA1:	22BB3EB9F53022E1AA020BE735C3350053417F30
SHA-256:	D2A3AAA6F11262277A5D4FA379E4320578656ADD61FAC0A76E5F3602B63E593A
SHA-512:	5F35B61C3DE0D21D4496F6D487878969DA06DF903FF7EDC51D0EE18CF74654BED0A8CCCBD5A1BC321D228EB663F88FE59EC29AF4A9BB2CA001B943A75AF0259C
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF648830C9C1DBCE31.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2387423598623137
Encrypted:	false
SSDEEP:	48:uazuBth8FXzzT5s2dFcCVSjnduEcZvMqSsndIEQ6:Nz5NTBFc+lpc
MD5:	87D2E6F729082CF81161A8EE73238505
SHA1:	B41FEEF58CF01EB1B6815708956039A7055B61E1
SHA-256:	3AC8B04D7C3B3E146D84A93822071B54F06071927CFBDE75650EFCF7A402B088
SHA-512:	68FBC649C1EBBE9BAF79F8BD450A6402F7DD88BD887892B23FCD8202EDC673AEA75B0C405D1B00D2865225559378D96621452B4DB2CDEC8B34C3D9B3C086212E
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7D327DB1E2C44069.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2854122243658859
Encrypted:	false
SSDEEP:	48:BaXuvth8FXzDT5blwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:AXv9TV+UetPZDleN
MD5:	CA0A1CFB4DA1E0444445274CBB99BBDF
SHA1:	F6A5A270E2F0A703993DA2D7E495B92C339D4C02
SHA-256:	0B897A0E66978A326AF9C2B1F537E736B519764E1391343AD2BF474DCD3ECFF8
SHA-512:	E897CB567DEDBD27B30EF4356C8F1387B7766DAAFAF8604EDF2325E97C6781A66040A241D230EABB38E2529347DB08FE0B08DD2B3E6EBA6ED7101FB6B59431CD
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7E1BD232899637BD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2655862414179269
Encrypted:	false
SSDEEP:	48:YfOugth8FXzzT5tzEdgxfmSSjndidVEcZvMCSsndidVEQWzx:+OSNTEgxfdPJGEx
MD5:	4479B39AE21A09D0CE77C997EC914AB4
SHA1:	FC2F06DEDD374BC61E1A46443D40978472C77DBE
SHA-256:	4CF98FBA0C64D5A6C5BB5DA2667D69199AFEF7577F42EF1826C9A05E30E94A8C
SHA-512:	8459972BE8BB89A1F91D3AC3ECB10229ABB4CDDB24BEF7A60521371848AD2C92F31F98E607B4E3867341E5CBEA3B1495D6BB4BD806DB17908F09177367DE34B9
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7E313C389AFCD08C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2714841849037102
Encrypted:	false
SSDEEP:	48:dJOugth8FXzDT5tzVdLgI1SSjndidVEcZvMCSsndidVEQi:fOS9THUISPJG
MD5:	A04F5C81232D7E6F15171224416727D5
SHA1:	EBCC13EEF0FDF8A5AA5DDAC48B3BBAA9EE2860D9
SHA-256:	6DE3887D8258913B5099B060166CE38CE0D19D1241D61897729C33CF4663259B
SHA-512:	2C602B5EF480F074CABBFFFAA008D5A76C4609519B5B4F2427D14EA1E8E25322D943A79FE179D9C089566F565F6BF453F22EFC3098FA1BF9393CD1E062F8FEA4
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF81CFDB7356910AFF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5838690760379122
Encrypted:	false
SSDEEP:	48:Lvh8PhGuRc06WXziFT5LEdgxfmSSjndidVEcZvMCSsndidVEQWzx:QhG1nFT6gxfdPJGEx
MD5:	32C6F965FA5511503DE1025ACA0FC0BF
SHA1:	650F013DC4CC28598E0ECE293074ECC32D0FB320
SHA-256:	716DABD5E278CE873F8491594E8788926BE40040A8334EC74936CA557ED4E877
SHA-512:	74C83210FA931510222BEABCC17D52B4CAE556DACC2B6A6D2892F027F880BEED72353D8E23BD4DA7FF09F09B721F0D5E71C9AD020E387B8F46A8D128D0CD5699
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF83F862C3DFE72A5F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.16125067731828258
Encrypted:	false
SSDEEP:	48:5imWeUJ4SsndidGSjndidVEqdGPv8eidLQ:5oe9NPZLee
MD5:	99D44E943A4777CAAB1D0AABA1F453F5
SHA1:	4CFDFD9D9D34C000AB6C2BDDC2D2B1FD2D82B0F8
SHA-256:	3B6829F75789CAC0DE4973CD3A1A7450345EA16274B200A9A03FD97D5812F894
SHA-512:	701AEF92B1971A7ED65D2EF45F2AB2080D9B33F5559F2EC6725F7CA7B707B6A9CB0D32871B4D5E3004A08F5CECE0BFAA8C1795534D0753FD6CE9666A2BC3C377
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF870240AC6A97A7AA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF978ED8717316A932.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2387423598623137
Encrypted:	false
SSDEEP:	48:uazuBth8FXzzT5s2dFcCVSjnduEcZvMqSsndIEQ6:Nz5NTBFc+lpc
MD5:	87D2E6F729082CF81161A8EE73238505
SHA1:	B41FEEF58CF01EB1B6815708956039A7055B61E1
SHA-256:	3AC8B04D7C3B3E146D84A93822071B54F06071927CFBDE75650EFCF7A402B088
SHA-512:	68FBC649C1EBBE9BAF79F8BD450A6402F7DD88BD887892B23FCD8202EDC673AEA75B0C405D1B00D2865225559378D96621452B4DB2CDEC8B34C3D9B3C086212E
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9D812FA38141A13E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA371C569DC3608E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA37E28BCA66D9AB3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA3D8DA9457644059.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2714841849037102
Encrypted:	false
SSDEEP:	48:dJOugth8FXzDT5tzVdLgI1SSjndidVEcZvMCSsndidVEQi:fOS9THUISPJG
MD5:	A04F5C81232D7E6F15171224416727D5
SHA1:	EBCC13EEF0FDF8A5AA5DDAC48B3BBAA9EE2860D9
SHA-256:	6DE3887D8258913B5099B060166CE38CE0D19D1241D61897729C33CF4663259B
SHA-512:	2C602B5EF480F074CABBFFFAA008D5A76C4609519B5B4F2427D14EA1E8E25322D943A79FE179D9C089566F565F6BF453F22EFC3098FA1BF9393CD1E062F8FEA4
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA59DFB66A42DCEF3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07888542448944588
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOKj2AESzaQHT3Q59IIEKIVky6lMt/:2F0i8n0itFzDHFKj2AESuSTFZMM1
MD5:	FDECE8B5B77827D00F35573FFEFBCE9C
SHA1:	7DCEC3DF1485F0F6EEB08683ED7F9DB1744AD47C
SHA-256:	564D8DAA352FEDDF4CCA88302EE24791101365E382853756CEC3BBA7E1DE06A3
SHA-512:	22B5D5A5F38AA16EE58DF19B9C18ED3E8776C27688D79FDCE96BE0C6FC9E27E622CEF2E0048659AE882F0B49383D89F128271FFD95AEE8D1C199C09FFF12C70D
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFACA28CFE4077B02F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAEE366F6380AD414.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07943819850731783
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOUmolAKYFHIEKIVky6lMt/:2F0i8n0itFzDHFUmoOKYFHZMM1
MD5:	FB1D7531356D01721BECEA635F9A1092
SHA1:	C47405E384FBA528032BFA734028FEF824C93F17
SHA-256:	C9FCE07ED0BC08224B5D66192A244A92CE3FCFD5829A4293DBBE938325E6E467
SHA-512:	BAE3B0B279448712D730B82ED1A9165FB27BACA232DC02D004704612982293A2078BBB14C3A2783012EFE01EA0097DF1669C4B90E8F5D16D412BBF54C5D9D8C3
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB1B118110838FAA1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2854122243658859
Encrypted:	false
SSDEEP:	48:BaXuvth8FXzDT5blwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:AXv9TV+UetPZDleN
MD5:	CA0A1CFB4DA1E0444445274CBB99BBDF
SHA1:	F6A5A270E2F0A703993DA2D7E495B92C339D4C02
SHA-256:	0B897A0E66978A326AF9C2B1F537E736B519764E1391343AD2BF474DCD3ECFF8
SHA-512:	E897CB567DEDBD27B30EF4356C8F1387B7766DAAFAF8604EDF2325E97C6781A66040A241D230EABB38E2529347DB08FE0B08DD2B3E6EBA6ED7101FB6B59431CD
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB471EF7C7AD89925.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.267695360455091
Encrypted:	false
SSDEEP:	48:hFOuAth8FXz5T5tzDdMImwsmSjnd64duEcZvMySsnd64dIEQC1I:fOy3TxMImwzlJ08I
MD5:	38A942E3A16685DD83E577C81B29C9E9
SHA1:	FBFBBD2EBFA5BFA2ACC4165EE0C1496866F17AA8
SHA-256:	ADD4BEC2A38DF5244A24C7C777A109AA887674AFFA9C2F34937126C731FD3EBA
SHA-512:	EB6169E53DCBA30DE0BD3820BE16D5DE3005A79314596FCF61B3D3DA774D5CBEDB78590893BAFADF3624E855767671ADF93D497838C4420A5B3ABB1ACE996BDB
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB74B8B289670BD19.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB74CA34FE64CA86B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5928483104573938
Encrypted:	false
SSDEEP:	48:J8PhGuRc06WXzyFT5LVdLgI1SSjndidVEcZvMCSsndidVEQi:EhG1XFTdUISPJG
MD5:	A2BDEE0139CDE00D58D2E56C9668430C
SHA1:	22BB3EB9F53022E1AA020BE735C3350053417F30
SHA-256:	D2A3AAA6F11262277A5D4FA379E4320578656ADD61FAC0A76E5F3602B63E593A
SHA-512:	5F35B61C3DE0D21D4496F6D487878969DA06DF903FF7EDC51D0EE18CF74654BED0A8CCCBD5A1BC321D228EB663F88FE59EC29AF4A9BB2CA001B943A75AF0259C
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB9AB80D635114019.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.547603443427818
Encrypted:	false
SSDEEP:	48:Y8PhruRc06WXziFT5b2dFcCVSjnduEcZvMqSsndIEQ6:nhr1nFTUFc+lpc
MD5:	A97CD52157450D5E5EB9721AE5307EFF
SHA1:	1380D2F7440C74FC34FD6CAB00518434E5B8E071
SHA-256:	E8EB10A69C55AFA228F3D7149AB97C60CDC38E8BC30BFF8183D1C29F0E259698
SHA-512:	FF5F516F763C4600C167ACA7AA583DC99F77242395344E6A0271D714174C77151573EA018372F74472BBC11A4E92D335FF86EA089724779D0C0AEB7BB895BA35
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBC16D4700A9F50E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC1C3A5F229893B5B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.267695360455091
Encrypted:	false
SSDEEP:	48:hFOuAth8FXz5T5tzDdMImwsmSjnd64duEcZvMySsnd64dIEQC1I:fOy3TxMImwzlJ08I
MD5:	38A942E3A16685DD83E577C81B29C9E9
SHA1:	FBFBBD2EBFA5BFA2ACC4165EE0C1496866F17AA8
SHA-256:	ADD4BEC2A38DF5244A24C7C777A109AA887674AFFA9C2F34937126C731FD3EBA
SHA-512:	EB6169E53DCBA30DE0BD3820BE16D5DE3005A79314596FCF61B3D3DA774D5CBEDB78590893BAFADF3624E855767671ADF93D497838C4420A5B3ABB1ACE996BDB
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC2410CCC13B343D0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC365605F8A9C5765.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC3ABFA91151225C3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC40A90BFC9C37C2D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2655862414179269
Encrypted:	false
SSDEEP:	48:YfOugth8FXzzT5tzEdgxfmSSjndidVEcZvMCSsndidVEQWzx:+OSNTEgxfdPJGEx
MD5:	4479B39AE21A09D0CE77C997EC914AB4
SHA1:	FC2F06DEDD374BC61E1A46443D40978472C77DBE
SHA-256:	4CF98FBA0C64D5A6C5BB5DA2667D69199AFEF7577F42EF1826C9A05E30E94A8C
SHA-512:	8459972BE8BB89A1F91D3AC3ECB10229ABB4CDDB24BEF7A60521371848AD2C92F31F98E607B4E3867341E5CBEA3B1495D6BB4BD806DB17908F09177367DE34B9
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC73011A9A062BB96.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC8BB07E54D776699.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCA10BC6C53D42037.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCF4B199163D9B651.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD2E821A5F5600023.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD3C9FCE0D6D9DEA1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.1515538337984637
Encrypted:	false
SSDEEP:	48:FI+CkEuSsnd64d9Sjnd64duEcZvM78wdMImL:FI+pHlFoMIm
MD5:	7A6C61B09D48FBBE3B38075B27E4630B
SHA1:	93A7F2FC998974CE44BA9320BA836728BF8DBA1B
SHA-256:	36DE957E90AE4C743E7035E904C12C67F6773386633E4EACF0445C8A14509D42
SHA-512:	3C028F355F7F04C71640D005EDF8E5502454E4E80B5DC8E969D18E370E44946CEB11A4095360DCC52442EDC1A89B43170144338E939F7E598E6649D9F203102B
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD65C6D355183CE4F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2714841849037102
Encrypted:	false
SSDEEP:	48:dJOugth8FXzDT5tzVdLgI1SSjndidVEcZvMCSsndidVEQi:fOS9THUISPJG
MD5:	A04F5C81232D7E6F15171224416727D5
SHA1:	EBCC13EEF0FDF8A5AA5DDAC48B3BBAA9EE2860D9
SHA-256:	6DE3887D8258913B5099B060166CE38CE0D19D1241D61897729C33CF4663259B
SHA-512:	2C602B5EF480F074CABBFFFAA008D5A76C4609519B5B4F2427D14EA1E8E25322D943A79FE179D9C089566F565F6BF453F22EFC3098FA1BF9393CD1E062F8FEA4
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDEC7575EBC53A3D7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2387423598623137
Encrypted:	false
SSDEEP:	48:uazuBth8FXzzT5s2dFcCVSjnduEcZvMqSsndIEQ6:Nz5NTBFc+lpc
MD5:	87D2E6F729082CF81161A8EE73238505
SHA1:	B41FEEF58CF01EB1B6815708956039A7055B61E1
SHA-256:	3AC8B04D7C3B3E146D84A93822071B54F06071927CFBDE75650EFCF7A402B088
SHA-512:	68FBC649C1EBBE9BAF79F8BD450A6402F7DD88BD887892B23FCD8202EDC673AEA75B0C405D1B00D2865225559378D96621452B4DB2CDEC8B34C3D9B3C086212E
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE3449184CF03C8F6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.547603443427818
Encrypted:	false
SSDEEP:	48:Y8PhruRc06WXziFT5b2dFcCVSjnduEcZvMqSsndIEQ6:nhr1nFTUFc+lpc
MD5:	A97CD52157450D5E5EB9721AE5307EFF
SHA1:	1380D2F7440C74FC34FD6CAB00518434E5B8E071
SHA-256:	E8EB10A69C55AFA228F3D7149AB97C60CDC38E8BC30BFF8183D1C29F0E259698
SHA-512:	FF5F516F763C4600C167ACA7AA583DC99F77242395344E6A0271D714174C77151573EA018372F74472BBC11A4E92D335FF86EA089724779D0C0AEB7BB895BA35
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE848457587FF4DC1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF179E1BDB7566653.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.267695360455091
Encrypted:	false
SSDEEP:	48:hFOuAth8FXz5T5tzDdMImwsmSjnd64duEcZvMySsnd64dIEQC1I:fOy3TxMImwzlJ08I
MD5:	38A942E3A16685DD83E577C81B29C9E9
SHA1:	FBFBBD2EBFA5BFA2ACC4165EE0C1496866F17AA8
SHA-256:	ADD4BEC2A38DF5244A24C7C777A109AA887674AFFA9C2F34937126C731FD3EBA
SHA-512:	EB6169E53DCBA30DE0BD3820BE16D5DE3005A79314596FCF61B3D3DA774D5CBEDB78590893BAFADF3624E855767671ADF93D497838C4420A5B3ABB1ACE996BDB
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF2CB432C18D34C1E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF647532772DD071D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF8334F87AC2F2773.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0827556596479799
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOT/xw5/wr4IIEKoVky6l8:2F0i8n0itFzDHFFrFZM8
MD5:	8EE3A964C48D3E5131C255DB2876C084
SHA1:	0D22D959AE991FA43DCFFC54B0AC9E3CBEF3A139
SHA-256:	45CE27CD3F73CCC0A0202B04F617825DBD4A17BED35126EB1008FDA3F9B08B6F
SHA-512:	F3DC51C91E6910E35A84335E73DBB246C51CF0651031496A3F2F97CC6E822639DA760AA0B1C66C6CE5354098335AC7269F8AB51E6607F9F3363B1E1EFEBD4BC6
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFB7D49B698D1CF46.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6125488226067326
Encrypted:	false
SSDEEP:	48:o8PhPuRc06WXzyFT5bwdLgeOKSjndidVEqdGPqSsndidfWeUJSi:3hP1XFTOUetPZDleN
MD5:	B0A42AD29D68EC21C3D45BAFFB6DAA91
SHA1:	5D722F8DB4977A481B73572406040F1A176D4E8D
SHA-256:	98339DA9F45069D608E0A15D0000D1F1EF5D2D9D9CAD9079F22D4D3ECCF323C4
SHA-512:	BF5705A8CDF33D41B12B685568BFC05DAA6BFE069FF80C538E4A02862D48C91FEFBC1213879C2AAEAA58B443A93CAAD9388B37401C8001F74CF12346C80E7DD8
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFC254D32DAC58723.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5866760583208857
Encrypted:	false
SSDEEP:	48:48PhGuRc06WXzEFT5LDdMImwsmSjnd64duEcZvMySsnd64dIEQC1I:HhG15FT7MImwzlJ08I
MD5:	8B9EF9D71806B8B123C5616E1BF65117
SHA1:	7756F0D9CD223BFDFBFE0A20FA69DCAD6C59B2F7
SHA-256:	E49F20ACC44C703CE5156AAF6C2D8546A634037C3AE253444969E99A3164577F
SHA-512:	9A6C6536DDF0CD9D78474687DA99920C4F7FF6AE2A644CB3892D6DFE5BB13007E5AADBF2A982193EC9E6B88D118FB8E72645B130A7C7A6084A6503F928053EFF
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\DPClback.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	298808
Entropy (8bit):	6.053671511169083
Encrypted:	false
SSDEEP:	6144:pgKqgv6i9FOVJTzbCGyRSr39IMFusn9KT3CtPuc6FUi96ymSvoqg8F:pg0iaF6zbCGyRSGMhnwCemSvTF
MD5:	CA3D0BE343760A964CB603DB2AF834A9
SHA1:	1A0AEC452CFA3CEE23CDDD1B2A2B1AA8C1763E66
SHA-256:	F488DAF44BAB6BF648454C4021C789D748E97A86D782F8E5584AB7FD62DCF21E
SHA-512:	553400CD94A7D716C0D95E5616A97BACCF93B7CD312DAD36BCDC9F0448D347824C0EB704A8DDFC0C7B1C94BB5A60D23FFE548730AC802F027328A3BBBB208A2B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*&.{nG.(nG.(nG.(u..(.G.(u.1(dG.(.1.(jG.(g?,(lG.(g?<(}G.(nG.(.G.(u..(VG.(u.4(oG.(u.5(oG.(u.2(oG.(RichnG.(........................PE..d...a..R.........." ................................................................>.....@..................................................................p.../...v..8.......\|...@...................................................P............................text............................... ..`.rdata...=.......>..................@..@.data....K... ...$..................@....pdata.../...p...0...6..............@..@.rsrc................f..............@..@.reloc..d............l..............@..B................................................................................................................................................................................................................................................

C:\Windows\system32\DPFPApi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	565560
Entropy (8bit):	6.005763993777021
Encrypted:	false
SSDEEP:	12288:Mrn8rdaf6oZKnG6Q11H1Mh0Wi9PE5EU8ohEh8:MLAd/G311H1MhwPE5EU8w
MD5:	1A78E7A8663EEF523B3D8F0BDBEC1591
SHA1:	B78961F272936B1EF78C40CA8B8C7CBAEB4398F8
SHA-256:	9E3C03DCFA364BA35A51C934BAED50C224FA7036BB85E742FB3003E1552B981B
SHA-512:	93B11C1074A4B7332E052ADE70E252C573211FF66D2F5B28BDB2522D99233CA7EAC7C3126059D2FA9BF41AA95C5CADABD88451E274AE6B1BCA4F501FE5CA9785
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...M..M..M...M...M...M..M...M..M...M..M...M...M..M2..M...M...M...M..M...M..M...M..MRich..M........................PE..d......R.........." .....r...........................................................m....@.........................................p.......`....................P......8.......`...`................................................................................text....q.......r.................. ..`.rdata..P............v..............@..@.data...8T... ...*..................@....pdata...P.......R..."..............@..@.rsrc................t..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................

C:\Windows\system32\ZKFPCap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.099901784972156
Encrypted:	false
SSDEEP:	1536:OdIBLyFUNavd/p/3Ccbs+9ZAGqE8KaoNlyeXGQ11aDwm1qSbv01qOojY35gUuvJM:OdIBOFUNavdgc4+9ZyEhWsas9SoVojct
MD5:	6AF8EB1334EA765B54593D2FBD9741F5
SHA1:	C845C2898208FEBBACECDD7AB05596586DFD99D9
SHA-256:	BAD6759F87926E35943313D97C875ACA96A7AC7D39E00506F95721C3DE75D5F4
SHA-512:	F02998C80E92DF8F3A38C4773BDD06A77D9B00254E3A4960FE6A802808D493294128043B8B2B23C8CD105DF9F33BD39F0C01D22323A84CD1A54E8C274DB1D66C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8_..@..8I..@..8X..@......@..@..@..8V..@..8N..@...H..@..8M..@.Rich.@.........PE..d...yx.W.........." ................\H..............................................xT....@.........................................`F..i....=..<...............................x...`................................................................................text............................... ..`.rdata...j.......l..................@..@.data....B...P... ...@..............@....pdata...............`..............@..@.rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\system32\ZKFPSensors\libdpcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.094436243426513
Encrypted:	false
SSDEEP:	1536:Mmc8NgTG7p2xaX5RFVEN2L6zZBaAgdktH8GkXRJ3ytl/g5xeeU:Xc8uTG73XbUoL6zraRdRxytlo5x9
MD5:	994A3A65E7BCE57E07272464DE552FA7
SHA1:	9334057BD6FEA257C335A65F94B7EFF587694C83
SHA-256:	1CDE4C5DCD64D14D164E81D987D4E6176AE3A10545C8C7B9195C62AB030F7343
SHA-512:	CA19C57006A0AC3277004742146CA578D9AAA93CE6C42825CDAFA38B51249C0476CCFA525B527F4B4155FC22CB42982259E68E76B43405C8DBF3257D4227CFB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#).BG..BG..BG.....BG..:..BG..:..BG..:..BG...<..BG..BF..BG..:..BG..:..BG..:..BG.Rich.BG.........PE..d....x.W.........." .........x.......[....................................................@..........................................e.......\..<............................... ... #............................................... ...............................text...6........................... ..`.rdata..\|G... ...H..................@..@.data....8...p.......Z..............@....pdata...............r..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\system32\ZKFPSensors\libsilkidcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.174414444345994
Encrypted:	false
SSDEEP:	3072:+1io3jxLq0Kx6OgxqMBfIRe78FsQ1MqzgHO8IYNwP45Gqe:+kijARO7QWKSO8IYNEq
MD5:	558C9E729BCF6F23952A49385A2896C5
SHA1:	7F83D90677752CC48ED2C590EC7F682FE5478559
SHA-256:	033E99323E70399EF4453271FC6F1B64210F80469F5DAF1D7311ABD76B6BF022
SHA-512:	3AA3EBCDF6F4CC526C46AB9FFEA8A0887C212FBAD39C4004EB47BCCB51C7176825ECFB7E046F5E36973C72BC99F0BC0168471A0BA5D0FD38438BD81B3DF9FAAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0.L.^SL.^SL.^SE..S9.^SE..SF.^SE..S~.^Sk`%SK.^SL._S<.^SE..SG.^SE..SM.^SE..SM.^SRichL.^S................PE..d....x.W.........." .....R...........{.......................................P.......^....@.....................................................P....0.......................@..T....s...............................................p...............................text....P.......R.................. ..`.rdata...Q...p...R...V..............@..@.data....>..........................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\system32\ZKFPSensors\libzklibcap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	268800
Entropy (8bit):	6.390001751143532
Encrypted:	false
SSDEEP:	6144:JsPHAN+emiVW9kvp3xuJIboukzTvEaJ0GSM62ddgt25WAhQ+Zk:IgN7p3lkHSMBdgM5k
MD5:	368041398044ECE066783FEEC4DE2E44
SHA1:	37F5A2FFBB571A33188A5B4CD625B449CA99481B
SHA-256:	D7703A114CBAE3DDF45BAB0FB662C60DE28C42A66DA5A8661599CADDD2CE4A9B
SHA-512:	325DB30AB679FAA0764CA222F9756EDD6991DA1203158D565170B116EB8224BA42DFB7D9F28CAA45346568FE666B480565F76844F8DF4208A9F857FE51455553
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........XBXV9,.V9,.V9,._A..d9,._A...9,._A..]9,.q.W.S9,.V9-.:9,._A.._9,._A..W9,._A..W9,.RichV9,.................PE..d....x.W.........." .....8..........<.............................................../C....@.........................................@...........<....`.......0...&...........p..8...PS...............................................P...............................text....6.......8.................. ..`.rdata...\|...P...~...<..............@..@.data....P..........................@....pdata...&...0...(..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\system32\dpfj.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	448824
Entropy (8bit):	6.554074564560768
Encrypted:	false
SSDEEP:	6144:g3c6Zl4KZurhK/EnNpBb4TFaac9DnTMV7PxGKKpgTmIX90KaZTqQkUh/bDx4JpQ3:+Zl4KZgKwv4kaGTyrz0ckApFo4o1
MD5:	F86AB243669A2CA20C52F031B1C8B629
SHA1:	F365CC78B750AE075CDA7A4D29C9DDBD6322A1B2
SHA-256:	9391EE8D2D79251F187300853BBEB4A7B20261C3A8F3906947C6CCAA61453FB9
SHA-512:	C647036D2B4DF4F5BA859B5304182C28CFC8C03053286069FF691EB2F40A23ABAA8CCC1B4FAB932D010E0BA4DC0A7C7A6B053A898D4BD90C178818B479453240
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+L..J"..J"..J"..2...J"..J#.J".....J"....QJ".....J"..2...J"......J".....J".....J".....J".....J".Rich.J".................PE..d...k..S.........." ................h........................................@......ch....@.............................................q... ...(.... .......`..pJ......8....0..\.......................................................8............................text............................... ..`.rdata..............................@..@.data....b.......,..................@....pdata..pJ...`...L..................@..@text....1............J..............@.. data....@I.......J...f..............@..@.rsrc........ ......................@..@.reloc..$....0......................@..B................................................................................................................................................................

C:\Windows\system32\dpfpdd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159544
Entropy (8bit):	6.182783009191357
Encrypted:	false
SSDEEP:	3072:FYHgDVO9wjNY82IRaskGPnlBEsN8TOSL6MOTaT0o+x3/OoFejF34+:FLO9wC8H5P5N8TOSL6MOTasO7FR
MD5:	9BF459B5EF1388D6074949898B17D2F9
SHA1:	02C2CBB389E01BCCF943F1EB2B5C1DCE729CEC4C
SHA-256:	DA6B915943F136D78253432B815FD3EA464C670F9AC6FC7F67D4CF617DE45C17
SHA-512:	37868BB16B099EE2F2E6BDDD1966A078D294D79404705827999F6ABC9E7D40D8BC88B5FB8EE8441CD4AF5D6E48E5C50281E9F5C6FF4CDF8F931426A5C60373BA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u...u...u...\|.6.~...n..._...n.......n.;.....\|.&.t.......v...u.......n...p...n.>.t...n.?.t...n.8.t...Richu...........................PE..d...o..S.........." ................P...............................................n#....@.........................................@*..........d............p.......V..8...............................................................p.......@....................text...2........................... ..`.rdata..K...........................@..@.data....:...0......................@....pdata.......p.......4..............@..@.rsrc................J..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

C:\Windows\system32\dpfpdd5000.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	212280
Entropy (8bit):	6.432870112062363
Encrypted:	false
SSDEEP:	3072:0YcdONwan0ak8Qsnx/MqUC+13nOu+K7012tlfpvhntWlQk7Y0GUL0sxTHBF55c85:AlanmYx/MVC+ROub3txnCLY0GUj1
MD5:	1910E9773AA5BDED6D98249376B6DBDC
SHA1:	B947DD3AA1EFC8D88E8C86A75D65C077CAD35148
SHA-256:	8261B0A5D81C79660ADA5E437C9F3C4871A8119BA5AB3B122EDF905C50CAC3E4
SHA-512:	86261421B3D01B3A78C65D94E445850FD1F314E087115A4D706BFF5E91D1C151821A1A2B900ABF3A7159377115ADBE6F206D12AFFA7CEFA9427A8F43B5D6240F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... ... ... ...XQ.. ...XV.M ...X@.. ...... ...XF.. ... .._ ...X\.. ...XG.. ...rA.. ...XD.. ..Rich. ..........PE..d....c.S.........." .....^...........y...................................................@.................................................\...x....`.......@.......$..8....p..p....t...............................................p..h............................text....].......^.................. ..`.rdata...y...p...z...b..............@..@.data...hB..........................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..d....p......................@..B................................................................................................................................................................................................................................................................

C:\Windows\system32\dpuvc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	193848
Entropy (8bit):	6.26689028701298
Encrypted:	false
SSDEEP:	3072:rv2FJiCGPX/n4oWlitZhb0mAl6K2xlT7jF3kRNXewYVkSpq3yp8saxKB0LAfX2Us:rH/n4oWqn0mPTlzF3kRNXerVkcqip88k
MD5:	AD49D392F3A0BBEA08AD9981DA2C5A76
SHA1:	26A19C6AD9EFA1934AAB682D5631E37234032762
SHA-256:	FBB86FE998F4FD61FA46BF0340A654C8A15FC1217219F3A5A21621296A34A7AE
SHA-512:	8506FF5F6F98BB8CB85E579E39D2377362C3783474B68FB32460A0D56A063AC5D86F14A00B789C6ADDBF7FF8F30BCF65C9B23AB6328E95A6AB71F50CBF9DB414
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................]........................R........q....R.................................Rich...................PE..d...fc.S.........." .........................................................0...........@................................................(...................L.......8.... ...... ................................................................................text............................... ..`.rdata.............................@..@.data....=..........................@....pdata..L...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Windows\system32\fppswsk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7333160
Entropy (8bit):	6.199154470748035
Encrypted:	false
SSDEEP:	98304:s90tFsyUqQOhu5qGYQfK4XHjTBzuOuc6C:MIFsyG5FYQS4XHjly5c6C
MD5:	23EAEC58CF0E50F21FB9BAA1D6E463C8
SHA1:	098415CDADCAAA6C9EE70FB5ED4B6793793B92DF
SHA-256:	3E8880E67EE54264A09E398BCBB6BA86F7A043CB9466829ACB9F4D72E55077FB
SHA-512:	42406FCFFDDB0EEEC470B8C540E0EB4FDB22A52EE30025DBC1B4C36E8F615768CE63C88A8DB5D7F897034DA7336BBAE89C9321810585CD42A62D22C59AA23CD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.A...4.d.....?.d.....#.d.7.d.y.d.....5.d.......d.A...".d.7.e...d.......d.....6.d.....6.d.....6.d.Rich7.d.........................PE..d......M.........." .....(K..........n:.......................................q......7p...............................................\.@....`b.......b...... ^.......o.......b.."..@RK.....................P.R.(...................@lb.P............................text....'K......(K................. ..`.rdata..P....@K......,K.............@..@.data........ \.."....\.............@....pdata..h?... ^..@...,].............@..@.idata...(...`b..*...la.............@....data1........b.......a.............@....tls..........b.......a.............@....trace........b.......a.............@..@mx_api........b.......a.............@....rsrc.........b.......a.............@..@.v-lizer~.....b.~.....a.............`...........................

C:\Windows\system32\fpslib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	974096
Entropy (8bit):	6.429675765196326
Encrypted:	false
SSDEEP:	12288:n+V4B80jynsosfKY8nDv3axtTXgjez5/tgsEQmShpHA7ImB:n+4B80jQsosT8nDvGgja/tTEagIw
MD5:	7F8F12AFF5334B5CB1B90F2DC36017D4
SHA1:	D13776AEE7D2BE98F276ACE43D64FF49F7226485
SHA-256:	A4A04D5486FE5BA55413944C68CEC5EF2AE1B31ADA31B4CCA505017EE676C49E
SHA-512:	CD9535B4C8113E4B8CFC957C21E81A65402B67EDCDC606FE5B6B499DE5D08BC6BFD22C75ADCA0EF42C8EA97FCB157E8BFE4CB189925D2A91273852E0041CC326
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.Fn...n...n...g.l.U...Ir..c...n......g.}.z...g.k....g.b.d...g.z.o...g.y.o...Richn...........................PE..d...tA.W.........." ................H........................................ .......Z....@.............................................L...x...x............@..,........?...... ...0................................................................................text............................... ..`.rdata..............................@..@.data....x..........................@....pdata..,....@......................@..@.rsrc................d..............@..@.reloc...7.......8...f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\system32\libcorrect.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.172949745541116
Encrypted:	false
SSDEEP:	1536:mOKjLatBGEq6wGv3sRLdo2U3r75109adMeXWSrJT0/Zir:BtBGE8Gud+VPMA/rJT2M
MD5:	08C0DB3AE3938572C15623D612D465D1
SHA1:	7C82F8986B4DDBD49EE2C7000DA876D7F2938607
SHA-256:	242D156A4F16682AE98D582032B1597F9F6139774BBF37DF6D6426E307574B72
SHA-512:	4D822CEBD15013B35105025D6A491E5579DEDA5AD93F70DB76CE51DF8FF7BA60E33D4F4D4426B813FA9717E0667A619D81DACFF0F55E5005144B289902C1F0A8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......H...H...H..,H...H..+HO..H..=H...H0S.H...H...H[..H..!H...H..:H...H..<H...H..9H...HRich...H................PE..d...wx.W.........." .........Z......l<....................................................@.........................................@...........(....`.......P...............p..D...@................................................................................text............................... ..`.rdata..6*.......,..................@..@.data....)... ......................@....pdata.......P......................@..@.rsrc........`.......&..............@..@.reloc.......p.......,..............@..B................................................................................................................................................................................................................................................................

C:\Windows\system32\libsilkid.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.2219889994106685
Encrypted:	false
SSDEEP:	1536:+cvJpLG8whhLPIHb7h2F+7uayy7d8l/4aKYtRsyDdFEUaDOEJB55xXpO7:TJpLGNhyHogaRyB/abRJFEtDrB5zX2
MD5:	38220BC554C4B874A1BC76FF86586BE5
SHA1:	94A08FB0533FCF20955743FE69940674FF32CA41
SHA-256:	0EF48406386783A1C7E353EC2B87A636593934B8BCCC28EB29C33A65B39C7B92
SHA-512:	F9E4328207E1832A7F709229AD896AA8FD343103A33D8CF8E388C6E6E3D8E37F2419096732D8B221C696BDFA381D99AB183B9BA3C636A8F9B7EC5A477644808D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.....U..U..U'.9U0.U'.>Us.U'.(U$.U'..U,.U.).U+.U..Uy.U'.4U,.U'./U/.U0.)U/.U'.,U/.URich..U................PE..d...yx.W.........." .........b......8H...............................................Z....@.....................................................<....p.......`..................<.......................................................8............................text...)........................... ..`.rdata..n1.......2..................@..@.data....)...0......................@....pdata.......`......................@..@.rsrc........p.......:..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................................

C:\Windows\system32\libusb0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\system32\libzkfp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	6.384705046577867
Encrypted:	false
SSDEEP:	6144:vxGRajaeO9cpgu8Ib+KT7lbNtxISMW/cPajQxllYH69zp4Jtz:ZjaLcpvkSMW7j0Cfz
MD5:	61121836918456856DF0EF105C2C64AC
SHA1:	2386F4BDA3FE63D230423BD696A5BBD22CAB72CB
SHA-256:	470B778EE84F24F79E2DBBCDE05B24A35585854599E0B614AD2D4BFB4A7791E4
SHA-512:	ADC0D382DCD896DFB6C70EC99B1FF8F45931D804D58237840BAFE1353E47F6E496372A5557C6E5B0D443B5B4FEE6FE9F70179F0D8C62F88BE60958D58E9F24F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.Z.-...-...-...UP..-...UF..-...UW..-....W..-...U@..-......-...-..V-....P..-...UY..-...UA..-...UB..-..Rich.-..........................PE..d....x.W.........." .....D..........h................................................r....@.............................................d...h...d............P..t(...................d...............................................`...............................text...JB.......D.................. ..`.rdata.......`.......H..............@..@.data....R.......2..................@....pdata..t(...P...*..................@..@.rsrc...............................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................................

C:\Windows\system32\libzkfpcsharp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.1824074891552065
Encrypted:	false
SSDEEP:	192:X843l6SfB50EXIILkfaCyJb0va6JyvxNAN44yuBo18L2f7Fa:MmMS5KEXIILKfyJbSOxyNw18L2fY
MD5:	1DD865CF6041A62078704DC1F6E2A26B
SHA1:	6959BE92F45E0651FCFAB091FE2C9DF166B9B5FB
SHA-256:	A448E8FEF8EF7D93AACFB7606B8DE45B279116373738A9F2368DE8446C3902E6
SHA-512:	EEED2B1D5A680ABA8341EA5BE0A1612609002B771D954760AF740757C68C50ED7A2F3450DD0377B9C20335014EDF7A9ECC08F8E8A9ECBD58FC35D40588203904
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...tx.W.........." .................... ....@...... ....................................@...@......@............... ...............................`..@............................G............................................................... ..H............text...X(... ..................... ..`.rsrc...@....`.......,..............@..@.reloc...............0..............@..BH.......,.......................................................................0..A.......~"....~"...(....%.....(....}....~.....{....(....,.(....&~#....~.(....&.{....(....&(....&~"....(.....0..........~.....{....(....,.~7.....(....}....~.....{....(....,.~(....@.......@..{.... O.....(......(....&.(.....o....} ....{.....\|.....\|.....\|....(....&~"......0..@........r...p} ...~.....{....(....,..{....(....&.~....}....~"...~5....0..g.......~.....{....(....,.~5....,...i.2...0.~'.

C:\Windows\system32\zkfinger10.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	974096
Entropy (8bit):	6.429675765196326
Encrypted:	false
SSDEEP:	12288:n+V4B80jynsosfKY8nDv3axtTXgjez5/tgsEQmShpHA7ImB:n+4B80jQsosT8nDvGgja/tTEagIw
MD5:	7F8F12AFF5334B5CB1B90F2DC36017D4
SHA1:	D13776AEE7D2BE98F276ACE43D64FF49F7226485
SHA-256:	A4A04D5486FE5BA55413944C68CEC5EF2AE1B31ADA31B4CCA505017EE676C49E
SHA-512:	CD9535B4C8113E4B8CFC957C21E81A65402B67EDCDC606FE5B6B499DE5D08BC6BFD22C75ADCA0EF42C8EA97FCB157E8BFE4CB189925D2A91273852E0041CC326
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.Fn...n...n...g.l.U...Ir..c...n......g.}.z...g.k....g.b.d...g.z.o...g.y.o...Richn...........................PE..d...tA.W.........." ................H........................................ .......Z....@.............................................L...x...x............@..,........?...... ...0................................................................................text............................... ..`.rdata..............................@..@.data....x..........................@....pdata..,....@......................@..@.rsrc................d..............@..@.reloc...7.......8...f..............@..B................................................................................................................................................................................................................................................................

C:\Windows\system32\zkfpslibLow.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127768
Entropy (8bit):	6.554921470042369
Encrypted:	false
SSDEEP:	3072:Y7YH+6HdiGx7G57nSX1CPTMM/c8N5pQDtt/DoA:Y7YHV5xSnSFCPTMIpQD
MD5:	B36F3DC44E9F74FDCCBAF8FDD724A60B
SHA1:	685BB21717B6574FF1B9017BCECE1DD8BA5B7147
SHA-256:	D001D0D60AAE6C2BFB68CA0E3B3F850F7BFED96831BE0D77CC4DF3A66926E482
SHA-512:	7F358D27F4FB548628F177F4ADFC922C016D3B5D3F7D04BC814E1554725CE91B4B4187A3DE53B789A5B09EB37B5B69B87C04D7F83B4AA732E3D986D7748DBA1D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........AW...W...W.....F.Q...I.T.t...I.S.,...I.E.]...p\..R...W.......I.Y.S...I.B.V...I.D.V...I.A.V...RichW...........PE..d....$.W.........." .....<...t.......]....................................... ......x...................................................M...x...<........................?.......... S...............................................P...............................text....:.......<.................. ..`.rdata...?...P...@...@..............@..@.data....\..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\syswow64\DPFPApi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459064
Entropy (8bit):	6.313605923757661
Encrypted:	false
SSDEEP:	12288:p+ppHCHOKCiYMYwBbkUKZwX5CmkSoABcU/:UCQJw6UKwQTABh/
MD5:	C10863BBBF6A8617F9CED1464B9BF74E
SHA1:	2CB8B1EDAEFFAE27AF9AD6F4B989ABA1670C8606
SHA-256:	689290FCC442BA71A8FA321E42FCE072C375CFD479F35A7B3B67E7237D7EE08F
SHA-512:	C3890918EF2E579D2F0AD133134C22C826A69ECB9088D3263485D94536EE0090BB330C8D0B97F49F5CE21D1E02F58664C9F25281E4438C3E1D31361291AB3753
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..`...`...`..V....`..V....`.......`.......`.......`...a.$.`..V....`..V....`..V....`..V....`.Rich..`.................PE..L......R...........!................G........................................P.......I....@..........................V......$D..........................8.......dU..................................(u..@...............<............................text...J........................... ..`.rdata...a.......b..................@..@.data....C...p..."...L..............@....rsrc................n..............@..@.reloc...r.......t...t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\syswow64\DpClback.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255800
Entropy (8bit):	6.369747426673245
Encrypted:	false
SSDEEP:	6144:SKAtooJhFASWtDPLI9oPx8Akibgmmvo8BMv:nAtPhWyYx8Li8fvBg
MD5:	E4BC242BD7FD45CC384C0B63F9ED4D18
SHA1:	9FABBBCB926570B35C74CB33D199E658F027165C
SHA-256:	B3F21FA15C0574ECBFA3969E1C7476F9EDA95BF57E758DA203B140CC6AE1BBDD
SHA-512:	E9B3E90FDA25A05B71E20E16932F1C9ACCFE306C875624F2A761E7A15B8F354F031468860FACCB3921722FE7D1A8074CEC155E94BA63F79E94B4D424355C7BD1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............\...\...\.CB\...\.Cv\...\.w\...\.._\...\..O\...\...\S..\.Cw\...\.CG\...\.CF\...\.CA\...\Rich...\................PE..L......R...........!................`........................................ ......p.....@..........................s......4b..........................8........-......................................@............................................text...g........................... ..`.rdata..............................@..@.data....=...........h..............@....rsrc...............................@..@.reloc..hC.......D..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\syswow64\dpfj.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346936
Entropy (8bit):	6.85039386209873
Encrypted:	false
SSDEEP:	6144:gndpDUUaWnuD7T5HKNO05hOG2FEWdPhVhbkqljHlpC+TEXXVxMbmKIiAOmLjhz:gndpDUUaku3ThK75hOG2FEWdJzVbCwEh
MD5:	5E80B50DDFE719AE693B52EB73B274C5
SHA1:	B9D8F57D5ED01A1162CFB06A47F53E8035BDD947
SHA-256:	17168F1BA924B0397FCE6BFE4108A75DA09F66825BB4F9D40070247C665BAD36
SHA-512:	5A915E763550600A4306D5A17A53ED13CA60BC0F28F30EBC67D7FA519BB8126B71B333003B6ACDB928ED97EB4CF80C736C16CA4D16A26FEFF10C3371C2CF3125
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k.r.k...b.......yeJ.L...ye..E...yeK.....k.e.r...k.t.c...yeN.....yez.c...ye{.c...ye\|.c...Richb...................PE..L...*..S...........!......... .......,....... .......................................B....@.............................q.......(....P...............2..8....`......p!..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`R....... ..................@....rsrc........P......................@..@.reloc..2/...`...0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\syswow64\dpfpdd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138552
Entropy (8bit):	6.465515781360138
Encrypted:	false
SSDEEP:	3072:YUFy6J79FXJVqpziLye636NL58dxBvOcXVQv2:dTh9FbqpzmC6NLSOY82
MD5:	BA6A317BF53117FA3A5AC4DF716F5F06
SHA1:	193224C2D2A915F1C855BD6A17CD0C66256E2CDE
SHA-256:	549BBC1E38AFBB51A6E4957C1951355CE16ADC35EE5160B642F4FB9E8DAC0466
SHA-512:	97F116EAC522BECED43BE01015518CA2F807531376998D92D5B3EEAFF52B003DE4CC5B689DF39EF7459092D5041A64D1A9D757D1E76725201FF13CFE165F6321
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u....................^.......^.......^........................o....^.......^.......^.......^......Rich............................PE..L......S...........!.....f...................................................P......E.....@.....................................d.......................8.... ..@.......................................@.......................@....................text...ee.......f.................. ..`.rdata...\.......^...j..............@..@.data...............................@....rsrc...............................@..@.reloc...#... ...$..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\syswow64\dpfpdd5000.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	184120
Entropy (8bit):	6.69342633478373
Encrypted:	false
SSDEEP:	3072:Q/vIYPhJublrfE5hm8uh2VTLajLDH59BM+g0cqHmapxr5Z9Zp:Q/ZuZrfEUh2YzH42x
MD5:	70D80A367E085CDCE671CA52DACF8DE6
SHA1:	DD475109FE1D099F550D04F35F8DD125ADF8079C
SHA-256:	4035443C439B4E6F17DFF9A96FF231BB7B26A947503D28E9EF5EC4851D24AF18
SHA-512:	213FA05805743B165A8E8F12A34FC223E7573174A5C749E6BDCC1780DDD8E218B8D186319F3B1B0F9A6622F96910AB16E6F87A671731DD4433061E80FC83AEF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Zw.].............n&./....n7......n!.....9........n1..............n+......n0......D6......n3.....Rich............PE..L...8c.S...........!..... ..........<3.......0............................................@..........................}.......q..x.......................8...........p2..............................xi..@............0..,............................text............ .................. ..`.rdata..QP...0...R...$..............@..@.data....7...........v..............@....rsrc...............................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\syswow64\dpuvc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165176
Entropy (8bit):	6.560570170271606
Encrypted:	false
SSDEEP:	3072:N0BpDu0388NCcsMe3k0m7oe+qtCQ793QzmJUOdbYh5USxHsg0:Ni6a88NC/kxoFa3vTdYgtg0
MD5:	C49BA01ECCF2393748CB89FAA08D4AD1
SHA1:	145E711B6009A3745C0EDEA6E8FE6B6FDC0F5DE6
SHA-256:	8CCEF519FE35BE1BD03F148D1B8ED50915688A9F14C29FA19A85536B47D27B64
SHA-512:	04638CF7D07AADB26132287C5A267F4EAF4BDD28DE3F1D29A23F7893C257879C6275BDEFF1AB3FE68E9053EC6EB1501AACABF3A1F302D3662E30E15465D0B347
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).D.m.Qm.Qm.Qd..Qy.Qd..Q..Qd..QZ.Qs..Qi.QJ.QQb.Qm.+Q..QJ.GQo.Qd..Qh.Qd..Ql.Qs..Ql.Qd..Ql.QRichm.*Q........................PE..L....b.S...........!......................................................................@..........................6.......).......................l..8.......P.......................................@...............4............................text............................... ..`.rdata...[.......\..................@..@.data...x6...@.......&..............@....rsrc................@..............@..@.reloc..\|%.......&...F..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\zkdrv\is-1GES6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\zkdrv\is-ASR1N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\zkdrv\is-C6HAI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51384
Entropy (8bit):	6.985795450520992
Encrypted:	false
SSDEEP:	768:hlqi7sKYNXhDedEP4ofzGTdJ0q7iC+zic9KdBDDi/cH:fZQlem4QemquC+zickdFDqcH
MD5:	F4FA6E733280D783A7473FDF174A8A0A
SHA1:	ABBD995A4E80356D43E1FA6A9C96F955F8EAC9AE
SHA-256:	C50DAB9B457205171833FE87F3C64BFB5EFFC8AE26244FB778B2E84B0CED9427
SHA-512:	33D728D1A453F73BF1506B1AC6BE30A216337CBA1EEDA3566C59B25ED8EA78DE80046F71AF1AA52D87F25B746DFB334B8FDB90640D37CAFF964294444E76FEA2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................1..{uq.(uq.(uq.(uq.(Mq.(,R.(pq.(R..(oq.(R..(tq.(R..(tq.(Richuq.(........................PE..L...J..O.................r...........v.......p.......................................8......................................Dv..<....\|...................B..........pq...............................................p...............................text....k.......l.................. ..h.rdata..\....p.......p..............@..H.data........u.......u..............@...INIT.........v.......v..........

C:\Windows\zkdrv\is-HGQH9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

C:\Windows\zkdrv\is-LRLHQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\zkdrv\is-MEAI8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows\zkdrv\libusb0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76480
Entropy (8bit):	6.832087313732252
Encrypted:	false
SSDEEP:	1536:ay92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5Ilmk8C+zigqxDqJJ:azwLjtSIi8MNoIjCh5Ilmr2y
MD5:	A0263041D4A4023A8E78F7F417404A42
SHA1:	90A0F6DD891F2B166317BEC604008D624009C678
SHA-256:	771743D4FD9B325FD8F583487B0001A4D36C0A5554FEBA59CDBAAA75C6FDB615
SHA-512:	0346FD5E328FCBF8E55F31D257B330FBA494DAE00A9CC57CDDF5ABBB9D4A7FE40806D71EFEBAD0585C83632208D1F11B78C7385224BB653DBB8D59E2DC8B5C3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L...H..O...........!........."......?.............@.......................................@..............................................................B...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\zkdrv\libusb0.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51384
Entropy (8bit):	6.985795450520992
Encrypted:	false
SSDEEP:	768:hlqi7sKYNXhDedEP4ofzGTdJ0q7iC+zic9KdBDDi/cH:fZQlem4QemquC+zickdFDqcH
MD5:	F4FA6E733280D783A7473FDF174A8A0A
SHA1:	ABBD995A4E80356D43E1FA6A9C96F955F8EAC9AE
SHA-256:	C50DAB9B457205171833FE87F3C64BFB5EFFC8AE26244FB778B2E84B0CED9427
SHA-512:	33D728D1A453F73BF1506B1AC6BE30A216337CBA1EEDA3566C59B25ED8EA78DE80046F71AF1AA52D87F25B746DFB334B8FDB90640D37CAFF964294444E76FEA2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................1..{uq.(uq.(uq.(uq.(Mq.(,R.(pq.(R..(oq.(R..(tq.(R..(tq.(Richuq.(........................PE..L...J..O.................r...........v.......p.......................................8......................................Dv..<....\|...................B..........pq...............................................p...............................text....k.......l.................. ..h.rdata..\....p.......p..............@..H.data........u.......u..............@...INIT.........v.......v..........

C:\Windows\zkdrv\libusb0_x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85184
Entropy (8bit):	6.571819770739886
Encrypted:	false
SSDEEP:	1536:dZ4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivagC+ziuatDqV:dZCxbEtayHpnkOBMmtPJzivaaU+
MD5:	FE7548FC329229576D6E672F9EE08CE6
SHA1:	8E5D4E944FC341AC787D236EA9B48C75637E0719
SHA-256:	D4C35E72E3DFA67F18576DF927CAF9FDBADF148231B98AC22BDC5BB11F6BD796
SHA-512:	4FCF3D0458D557BF33792CE11E09832300410C6DF88B1EE12B07142EFF867495AAA7CB3AA00CC6A6A9B19F01E447B25103EC0DE75FDDCA306026BA1330DDED2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d...M..O.........." ......... ......4.........@..............................P......D4....@.................................................X........0....... ...........B...@.......................................................................................text...H........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\zkdrv\libusb0_x64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61624
Entropy (8bit):	6.673465597043928
Encrypted:	false
SSDEEP:	768:cFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QmC+ziGUBPDDi/qX3:3Conbt8wifuQRtR7QmC+zinBrDqqX3
MD5:	77AFFF0483D5F84E41717CC358528A5E
SHA1:	37084CCE0B4B63780C9CC465CD54446E680E2986
SHA-256:	ECC512BA6A0FB290EECE70D82EDF9FC0891D336B39E7AE37E0156544150785CD
SHA-512:	4E6BEA9EF8DC1CA8ECBE05E96F18019C20C57108EC6ADC45EE1D423C30B65B31F0C8170E25A86809E8E8CB08AC8F7F8526769DB283ED5BC448C70486BC3D7FF2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........i...i...i...h...i..?....i..?....i..d....i..d....i..?....i..d....i..d....i..d....i.Rich..i.........................PE..d...O..O..........".................................................................M.......................................................d...<........................B......8....................................................................................text............................... ..h.rdata..T...........................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows\zkdrv\zkfp.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	data
Category:	dropped
Size (bytes):	10581
Entropy (8bit):	6.894495661659454
Encrypted:	false
SSDEEP:	192:YTwxTETpTM9TY2vWEkTCZlYQmI/mOYEi8YfwVh+3Ef5KYpBjSg3n6u:yw5ex0hJhY2h+3Ef5dpBjZX6u
MD5:	D3F97B9069CA4EEED99F5474F8AFEAD5
SHA1:	B89020D02650517826A3F513210A40ED9B122073
SHA-256:	C4AC2E14D7C2AFE8D62675AFE5A41EE62811A4BAF57E4C60B0816B849BA4C7AC
SHA-512:	6F1CFCB081CBB6FC28602AFE48DF7E9FF4C66B6388159AF1A0374F054B436D5BF4F08E6557B1B24D993640215886D8550794C14B6A48D2F09B87A43E7C5FE91F
Malicious:	false
Reputation:	unknown
Preview:	0.)Q...H........)B0.)>...1.0...+......0.....+.....7......0...0...+.....7.....&=..V..B.3.u2..I..160314110838Z0...+.....7.....0...0....R0.7.D.5.0.2.3.D.7.B.2.0.9.A.7.D.7.B.2.F.B.6.2.5.B.8.9.8.6.8.5.F.2.0.7.1.F.1.1.1...1..q0:..+.....7...1,0...F.i.l.e........l.i.b.u.s.b.0...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........={ .}{/.%..h_ q..0....R0.A.C.6.0.D.0.E.3.C.2.8.0.1.A.9.9.D.D.5.5.E.F.2.F.B.A.C.D.4.8.9.C.6.4.A.2.C.3.D...1..q0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...2...0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\zkdrv\zkfp.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10382
Entropy (8bit):	3.7424359739408053
Encrypted:	false
SSDEEP:	192:ep/j8VORIV8PcNxK3ADm3qdqUF1uXKEmzdp7jSBglfhhOv:w/j8VORIV8PcNxK3ADm3qdqUF1uXKEmY
MD5:	283C2123020A1D80E1DC50F97C8E902E
SHA1:	6261F70E969A71E92CC2D841B4D9D2FAAFA4A34C
SHA-256:	0150DCCCC9071053B20EDA0416C478319177667C773CE4639B5E2745374A6A2F
SHA-512:	4360B26AD4D5C439D651B9C37315A46CC218CF1D71E19C6BB2472C6FCB9D215A885ACA058966156AB696D327176EA98E06076ACC7BE672AA18133C9C5DDFAE46
Malicious:	false
Reputation:	unknown
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .l.i.b.u.s.b.-.w.i.n.3.2. .(.G.N.U. .L.G.P.L.).........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .".U.S.B.".....C.l.a.s.s.G.u.i.d. . . .=. .{.3.6.F.C.9.E.6.0.-.C.4.6.5.-.1.1.C.F.-.8.0.5.6.-.4.4.4.5.5.3.5.4.0.0.0.0.}.....P.r.o.v.i.d.e.r. . . . .=. .".Z.K.T.e.c.o. .I.n.c...".....C.a.t.a.l.o.g.F.i.l.e. .=. .z.k.f.p...c.a.t.....D.r.i.v.e.r.V.e.r. . . .=. .0.6./.1.0./.2.0.1.2.,. .1...2...6...0.........[.D.e.v.i.c.e.s.].....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.0.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.4.....%.U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5...D.e.v.i.c.e.D.e.s.c.%. .=. .L.I.B.U.S.B._.W.I.N.3.2._.D.E.V.,. .U.S.B.\.V.I.D._.1.B.5.5.&.P.I.D._.0.8.2.5.....

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.5110854081804286
Encrypted:	false
SSDEEP:	3:RoHQGQB5:RZGU5
MD5:	E3AC0178A28CF8E44D82A62FAE2290D7
SHA1:	C0F1C66E831ADD5EA81B19BFA0E85D1D2CA192BA
SHA-256:	2C61108AC0158F555B0632F5658D79D502B0929F2090848A7DEB77158667D43C
SHA-512:	F7C2290526630DEF784459621007F389D720034D3BCE1EFF9B761C7A959061FDB465B9D239290EB543E7B0CFB41682361D0400459621F8756A8A09782F33693A
Malicious:	false
Reputation:	unknown
Preview:	CertMgr Succeeded..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.995676859280721
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	2N Driver for External USB Readers.exe
File size:	35'906'760 bytes
MD5:	e3dd4a7013de228f707e6acacd69acce
SHA1:	3bfc3ebc9be3747e4dc88cb822c26e20715e1110
SHA256:	aa4d8231efa01b1e141dbd392c8bff871c7692b04e0de8e14bcca2c71ee5d146
SHA512:	48ef857d9ff98296026306f5a6f212e2f68c5389e2ecfe175175f003d01238179cc1f6f82dfaded7d6e1561d2aa3318c1fae785e72a1b9da76ba2d29329f39d8
SSDEEP:	786432:d2Jzurw9eA6aFddNOW5uA9c6KoPdnhvAOquc9Z0wPU+x9ki1x:d2JzurSbxd15u6kgAOquiZ0wfLkYx
TLSH:	3477336F7764743FD5764B3152FBC210893B5E61A42A8D1E0BE43A8CCF365A41E3BA06
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	1733868c8e963317

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6258476F [Thu Apr 14 16:10:23 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	05/05/2023 17:01:53 04/06/2026 17:01:53
Subject Chain	CN=2N TELEKOMUNIKACE a.s., O=2N TELEKOMUNIKACE a.s., L=Prague, C=CZ
Version:	3
Thumbprint MD5:	F1C0BC7E0E420BBC15E898ACB346A8A3
Thumbprint SHA-1:	5FF592EE590974F9BBE941BE5A2896E2FBC8EB08
Thumbprint SHA-256:	27C44AA160E179CE4382A4B61D90CBA3DD6FBA2288392550300B877961FEF6F1
Serial:	5426B2583A7A3757F227CB54

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007EFC18C06E15h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007EFC18CA9907h
call 00007EFC18CA945Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007EFC18C1C8B4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007EFC18C01A07h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007EFC18C1DA37h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007EFC18CA998Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007EFC18CAFBAAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007EFC18C1E32Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x2cfb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x223c228	0x22a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x2cfb8	0x2d000	51e3fe03d1c5b56d983e5811d09b9acb	False	0.32327473958333336	data	5.884431684032734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7588	0x7729	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.997639731191608
RT_ICON	0xcecb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.13548444339287827
RT_ICON	0xdf4dc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.1572156821526172
RT_ICON	0xe8984	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.23033774208786018
RT_ICON	0xecbac	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3066390041493776
RT_ICON	0xef154	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4054878048780488
RT_ICON	0xf01fc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.475
RT_ICON	0xf0b84	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.599290780141844
RT_STRING	0xf0fec	0x360	data			0.34375
RT_STRING	0xf134c	0x260	data			0.3256578947368421
RT_STRING	0xf15ac	0x45c	data			0.4068100358422939
RT_STRING	0xf1a08	0x40c	data			0.3754826254826255
RT_STRING	0xf1e14	0x2d4	data			0.39226519337016574
RT_STRING	0xf20e8	0xb8	data			0.6467391304347826
RT_STRING	0xf21a0	0x9c	data			0.6410256410256411
RT_STRING	0xf223c	0x374	data			0.4230769230769231
RT_STRING	0xf25b0	0x398	data			0.3358695652173913
RT_STRING	0xf2948	0x368	data			0.3795871559633027
RT_STRING	0xf2cb0	0x2a4	data			0.4275147928994083
RT_RCDATA	0xf2f54	0x10	data			1.5
RT_RCDATA	0xf2f64	0x2c4	data			0.6384180790960452
RT_RCDATA	0xf3228	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0xf3254	0x76	data	English	United States	0.7372881355932204
RT_VERSION	0xf32cc	0x584	data	English	United States	0.2769121813031161
RT_MANIFEST	0xf3850	0x765	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39091389329107235

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	11:13:08
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\2N Driver for External USB Readers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2N Driver for External USB Readers.exe"
Imagebase:	0x400000
File size:	35'906'760 bytes
MD5 hash:	E3DD4A7013DE228F707E6ACACD69ACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:13:08
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H9TV7.tmp\2N Driver for External USB Readers.tmp" /SL5="$103E4,35010763,947200,C:\Users\user\Desktop\2N Driver for External USB Readers.exe"
Imagebase:	0x400000
File size:	3'280'384 bytes
MD5 hash:	0EBFBF63EE915B391F691DB46B024A09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:13:08
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 6.0.4
Imagebase:	0x1000000
File size:	110'512 bytes
MD5 hash:	92E65CD72CF9F57DEEAC5C0C4186A5BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:13:09
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:13:35
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" /lcid 2057 /passive /norestart
Imagebase:	0xdb0000
File size:	52'576'016 bytes
MD5 hash:	80CD452760F89BFE92B859FB620F1653
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:13:35
Start date:	26/04/2024
Path:	C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{833D38B6-EF1E-40E4-8C3B-08BEF0235559}\.cr\dotnet60desktop.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe" -burn.filehandle.attached=520 -burn.filehandle.self=516 /lcid 2057 /passive /norestart
Imagebase:	0xb20000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:13:36
Start date:	26/04/2024
Path:	C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{CC0C35BE-EF85-42EF-A7AF-66B76F732AF7}\.be\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{4C86AD50-ECFF-4E0C-8859-69C2F732A1B6} {4190C1E9-DF0B-4777-B67E-25C22799E37B} 6884
Imagebase:	0xe60000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:13:38
Start date:	26/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff70b850000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:13:48
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 5F08179E706612A6B7A04DE10E46E3A3
Imagebase:	0x70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:13:50
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 0AE14355DA77B8EC5D78BBA627A31F90
Imagebase:	0x70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:13:51
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /burn.runonce
Imagebase:	0xcd0000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:13:51
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Imagebase:	0xcd0000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:13:51
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\user\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.4_(x86)_20240426111336.log" /lcid 2057
Imagebase:	0xcd0000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:13:51
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 9A6BE86B09F849551CC63C9676854998
Imagebase:	0x70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:14:01
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{ff0d7b6b-8624-42f0-b961-69e6cbf896c1}\windowsdesktop-runtime-6.0.4-win-x86.exe" -q -burn.elevated BurnPipe.{5B3AA127-E574-49A0-B320-16AAE8743C18} {B68FB661-CED6-45D2-8A04-5EF32E491C00} 2896
Imagebase:	0xcd0000
File size:	624'840 bytes
MD5 hash:	9B29FA18CED2536A6AF5978740439137
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:14:04
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 029EEC1918DF13259116589682A83A05
Imagebase:	0x70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:14:09
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 42ABA69F9D42EED2BA1E1226AEC89AC1
Imagebase:	0x70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:14:11
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Usbdrv.exe" "2N USB Driver" DISABLE ALL
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:14:11
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:14:11
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\HostsHelper.exe" C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x1827ee30000
File size:	14'496 bytes
MD5 hash:	034CD0A95425744B3D1676EA2E62D6B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:14:11
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:14:12
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine ROOT
Imagebase:	0x4a0000
File size:	70'992 bytes
MD5 hash:	181C8F19F974AD8A84B8673D487BBF0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:14:12
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:14:12
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.Exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\CertMgr.exe" -add -c "C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4\elatec.cer" -s -r localMachine TrustedPublisher
Imagebase:	0x4a0000
File size:	70'992 bytes
MD5 hash:	181C8F19F974AD8A84B8673D487BBF0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:14:12
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:14:12
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dpinst.exe" /SA /SE /SW /F /C /PATH C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\twn4
Imagebase:	0x7ff79b130000
File size:	1'040'384 bytes
MD5 hash:	4192A5B905374E423EC1E545599AA86E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:14:13
Start date:	26/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	11:14:13
Start date:	26/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{086a8776-17e2-2141-ba4a-f3610c91f26a}\twn4cdc.inf" "9" "42c8444f7" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\users\user\appdata\local\temp\is-clj4h.tmp\twn4"
Imagebase:	0x7ff7e55c0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:14:15
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-
Imagebase:	0x400000
File size:	18'104'255 bytes
MD5 hash:	2F8443D48AF26BA07A554BEFA46F142B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:14:15
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BED4C.tmp\setup.tmp" /SL5="$705E0,17762851,56832,C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\silk\setup.exe" /VERYSILENT /NORESTART /SP-
Imagebase:	0x400000
File size:	711'168 bytes
MD5 hash:	FFCF263A020AA7794015AF0EDEE5DF0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:14:22
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" libusb0.dll,usb_install_driver_np_rundll C:\Windows\zkdrv\ZKFP.inf
Imagebase:	0x7ff605fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:14:23
Start date:	26/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{09607da7-062f-814c-af33-b727806a2bd1}\ZKFP.inf" "9" "429e2a833" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\zkdrv"
Imagebase:	0x7ff7e55c0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:14:28
Start date:	26/04/2024
Path:	C:\Windows\DPDrv\DPInst64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\dpdrv\DPInst64.exe" /s
Imagebase:	0x7ff6bea10000
File size:	930'272 bytes
MD5 hash:	C3AC43B2018114A617E946AA8FDF3CAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:14:32
Start date:	26/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{6f710580-cd7c-a041-8cb9-c2dfc257af95}\dpersona_x64.inf" "9" "47ae312af" "000000000000018C" "WinSta0\Default" "0000000000000194" "208" "c:\windows\dpdrv"
Imagebase:	0x7ff7e55c0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:14:39
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPCms.dll"
Imagebase:	0x1b0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:14:39
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPDevTS.dll"
Imagebase:	0x1b0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:14:39
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DpFnd2.dll"
Imagebase:	0x1b0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:14:39
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\FPSensor\support\u.are.u\win32\DPJasPer.dll"
Imagebase:	0x1b0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	1448
Total number of Limit Nodes:	14

Executed Functions

Function 0100141B Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 199
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(UseExisting,?), ref: 01001451
_get_hostfxr_path@12.NETCORECHECK(?,?,00000000), ref: 0100148E
LoadLibraryW.KERNEL32(?), ref: 010014DB
GetLastError.KERNEL32 ref: 010014EA

Strings

Framework Version: '%s', xrefs: 01001593
Using existing runtimeconfig file '%s', xrefs: 01001566
hostfxr_close failed: '%d', xrefs: 01001659
Failed to load library '%s', error = '%d', xrefs: 010014F8
hostfxr_close, xrefs: 01001515
Failed to create temp runtime config file., xrefs: 010015E7
Failed to get exports from hostfxr., xrefs: 01001692
UseExisting, xrefs: 0100144C
hostfxr_initialize_for_runtime_config, xrefs: 0100150B
Framework Name: '%s', xrefs: 0100157D
hostfxr_initialize_for_runtime_config failed: '%d', xrefs: 0100166C
hostfxr_initialize_for_runtime_config succeeded., xrefs: 01001636
Calling hostfxr_initialize_for_runtime_config..., xrefs: 010015FA
Failed to get runtime config file path., xrefs: 010015B6
Found HostFxr: '%s', xrefs: 010014C6
get_hostfxr_path failed: '%d', xrefs: 01001498

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLastLibraryLoad_get_hostfxr_path@12_wcsicmp
String ID: Calling hostfxr_initialize_for_runtime_config...$Failed to create temp runtime config file.$Failed to get exports from hostfxr.$Failed to get runtime config file path.$Failed to load library '%s', error = '%d'$Found HostFxr: '%s'$Framework Name: '%s'$Framework Version: '%s'$UseExisting$Using existing runtimeconfig file '%s'$get_hostfxr_path failed: '%d'$hostfxr_close$hostfxr_close failed: '%d'$hostfxr_initialize_for_runtime_config$hostfxr_initialize_for_runtime_config failed: '%d'$hostfxr_initialize_for_runtime_config succeeded.
API String ID: 4167111913-169232420
Opcode ID: 02291d61de18d7fc35dc0bf07d8d119fb45590d2653020225565c40aab9273b6
Instruction ID: e35fe8f10055cdf1c222f3b5a538d49fc248a05303e5571d364614def451c46b
Opcode Fuzzy Hash: 02291d61de18d7fc35dc0bf07d8d119fb45590d2653020225565c40aab9273b6
Instruction Fuzzy Hash: F1513AB1A44209ABFF236714DC51AEE33B89F64705F0440A9F9C5EB1D4DF38DA848EA5

Uniqueness

Uniqueness Score: -1.00%

Function 010050CF Relevance: 28.4, APIs: 2, Strings: 14, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 010050D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 01005175

Part of subcall function 01002BDD: __EH_prolog3_GS.LIBCMT ref: 01002BE4
Part of subcall function 01002BDD: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000020,01004FAB,?,hostfxr.dll,?,000000C4,010054B2,?), ref: 01002C6C

Part of subcall function 01006138: __EH_prolog3_GS.LIBCMT ref: 0100613F
Part of subcall function 01006138: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01006396

Part of subcall function 01005CB6: __EH_prolog3_GS.LIBCMT ref: 01005CBD
Part of subcall function 01005CB6: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(0000001C,010052FE,?,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01005D68

Part of subcall function 010059C3: __EH_prolog3.LIBCMT ref: 010059CA
Part of subcall function 010059C3: EnterCriticalSection.KERNEL32(01019A90,00000010,010065F2,Failed to read environment variable [%s], HRESULT: 0x%X,COREHOST_TRACE,?,?,?,01005749,00000034,01001B0D), ref: 010059D8
Part of subcall function 010059C3: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00000000,?,?,?,?,01005749,00000034,01001B0D), ref: 010059FB
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,00000001,01005749,00000034,01001B0D), ref: 01005A44
Part of subcall function 010059C3: fputws.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 01005A4C
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A54
Part of subcall function 010059C3: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 01005A5D
Part of subcall function 010059C3: OutputDebugStringW.KERNELBASE(?), ref: 01005A79
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A8A
Part of subcall function 010059C3: LeaveCriticalSection.KERNEL32(01019A90), ref: 01005ABA

Strings

The .NET runtime can be found at:, xrefs: 010053DA
fxr, xrefs: 010052BF
Using environment variable %s=[%s] as runtime location., xrefs: 0100522D
hostfxr.dll, xrefs: 01005107, 010053BE
Resolved fxr [%s]..., xrefs: 01005196
Using global installation location [%s] as runtime location., xrefs: 01005273
host, xrefs: 010052AB
DOTNET_ROOT, xrefs: 010051EC
A fatal error occurred, the default install location cannot be obtained., xrefs: 01005254
5.0.0-preview.6.20264.1, xrefs: 010053FA
DOTNET_ROOT(x86), xrefs: 010051E5
or register the runtime location in [, xrefs: 0100532A
- %s&apphost_version=%s, xrefs: 01005400
A fatal error occurred. The required library %s could not be found.If this is a self-contained application, that library should e, xrefs: 010053C3

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3__invalid_parameter_noinfo_noreturn$__acrt_iob_func$CriticalSection$DebugEnterH_prolog3LeaveOutputString__stdio_common_vswprintffputwcfputws
String ID: - %s&apphost_version=%s$ or register the runtime location in [$5.0.0-preview.6.20264.1$A fatal error occurred, the default install location cannot be obtained.$A fatal error occurred. The required library %s could not be found.If this is a self-contained application, that library should e$DOTNET_ROOT$DOTNET_ROOT(x86)$Resolved fxr [%s]...$The .NET runtime can be found at:$Using environment variable %s=[%s] as runtime location.$Using global installation location [%s] as runtime location.$fxr$host$hostfxr.dll
API String ID: 3534758334-4169186014
Opcode ID: bec7defb18d0b2eb46d73897a50bd94ad3336af9a863826c629c067206fd2af2
Instruction ID: 9043b2c911ab08b0abff712aee3f22ae20329b0b2bb99d9b8468fcf31d53b221
Opcode Fuzzy Hash: bec7defb18d0b2eb46d73897a50bd94ad3336af9a863826c629c067206fd2af2
Instruction Fuzzy Hash: BBD1BD31A002199FEB16DBA8DC84BECBBB2BF95314F60815DD085AB2D4DB749A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01006138 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0100613F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01006396

Part of subcall function 01005D7F: __EH_prolog3_GS.LIBCMT ref: 01005D89

RegOpenKeyExW.ADVAPI32(?,00000007,00000000,00020219,?,?,00000054,01005244,DOTNET_ROOT,000000B8,01001C7F,?), ref: 010061E2
RegGetValueW.ADVAPI32(?,00000000,?,00000002,00000000,00000000,?), ref: 01006210
RegGetValueW.ADVAPI32(?,00000000,?,00000002,00000000,00000000,?), ref: 010062B5
RegCloseKey.ADVAPI32(?), ref: 010062CF

Part of subcall function 01005965: EnterCriticalSection.KERNEL32(01019A90,?,?,010030D5,Did not find [%s] directory [%s],?,?,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01005978
Part of subcall function 01005965: LeaveCriticalSection.KERNEL32(01019A90,?,?,?,010030D5,Did not find [%s] directory [%s],?,?,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 0100598B

Concurrency::cancel_current_task.LIBCPMT ref: 010063AD

Part of subcall function 010013B9: std::exception::exception.LIBCMT ref: 010013E9

Strings

_DOTNET_TEST_GLOBALLY_REGISTERED_PATH, xrefs: 01006178
Can't open the SDK installed location registry key, result: 0x%X, xrefs: 010061ED
Can't get the value of the SDK location registry value, result: 0x%X, xrefs: 010062C0
Can't get the size of the SDK location registry value or it's empty, result: 0x%X, xrefs: 01006313

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CriticalH_prolog3_SectionValue$CloseConcurrency::cancel_current_taskEnterLeaveOpen_invalid_parameter_noinfo_noreturnstd::exception::exception
String ID: Can't get the size of the SDK location registry value or it's empty, result: 0x%X$Can't get the value of the SDK location registry value, result: 0x%X$Can't open the SDK installed location registry key, result: 0x%X$_DOTNET_TEST_GLOBALLY_REGISTERED_PATH
API String ID: 3064789283-3444099095
Opcode ID: 2d41c59c9ac335404b43a70081f6a570bf3b490c3591976fb5774bf0dfa14758
Instruction ID: 8bb433421bf70ad4a355009734c685c98a55fc2d7c8c3ebb61145040483c80bf
Opcode Fuzzy Hash: 2d41c59c9ac335404b43a70081f6a570bf3b490c3591976fb5774bf0dfa14758
Instruction Fuzzy Hash: 0471DF71A002099FFF16CFE8DC85BEDBBB6EF44310F148129E185AA2C8DB769955CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010059C3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 010059CA
EnterCriticalSection.KERNEL32(01019A90,00000010,010065F2,Failed to read environment variable [%s], HRESULT: 0x%X,COREHOST_TRACE,?,?,?,01005749,00000034,01001B0D), ref: 010059D8
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00000000,?,?,?,?,01005749,00000034,01001B0D), ref: 010059FB

Part of subcall function 010056EC: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000001,?,00000000,?,?,01005A2D,?,?,00000001,01005749,00000034,01001B0D), ref: 01005707

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,00000001,01005749,00000034,01001B0D), ref: 01005A44
fputws.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 01005A4C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A54
fputwc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 01005A5D
OutputDebugStringW.KERNELBASE(?), ref: 01005A79
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A8A
LeaveCriticalSection.KERNEL32(01019A90), ref: 01005ABA

Strings

pqKu GTu, xrefs: 01005A44, 01005A54, 01005A8A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: __acrt_iob_func$CriticalSection__stdio_common_vswprintf$DebugEnterH_prolog3LeaveOutputStringfputwcfputws
String ID: pqKu GTu
API String ID: 805093976-4238289390
Opcode ID: d8c7c1da2b029bf584db6b2836c9af4b8dd0e3cf8d01a37cb75c19e9f91bc68a
Instruction ID: 6e84217cf635edd3e66f4aa79c7f5b6a2e2fcf11ad34c17f5fdb3aad092c791f
Opcode Fuzzy Hash: d8c7c1da2b029bf584db6b2836c9af4b8dd0e3cf8d01a37cb75c19e9f91bc68a
Instruction Fuzzy Hash: C5318F31940215AFEB229FA4CC48AEE7B78FF04350F004015F9D5A71D8DB3E9981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01001189 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 010011CA
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,010141F0), ref: 010011EC
GetTickCount64.KERNEL32 ref: 010011F5
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?,?,00000104,dd_NetCoreCheck_%I64u.log,00000000), ref: 0100121E
_wfopen_s.API-MS-WIN-CRT-STDIO-L1-1-0(01019A8C,?,01014228), ref: 01001239

Strings

dd_NetCoreCheck_%I64u.log, xrefs: 010011FD
============= NetCoreCheck Start ===============, xrefs: 0100123F
\, xrefs: 010011D4

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: wcscat_s$Count64PathTempTick_wfopen_s
String ID: ============= NetCoreCheck Start ===============$\$dd_NetCoreCheck_%I64u.log
API String ID: 3641373578-1403277044
Opcode ID: 182ded494a7bb02002dab5c5f71759fccaf98da6572473f6772dd8cab711a582
Instruction ID: 681edeb803b74d3a98065c7475ff05df6029ffe015b2c66c8179582a597b9aa4
Opcode Fuzzy Hash: 182ded494a7bb02002dab5c5f71759fccaf98da6572473f6772dd8cab711a582
Instruction Fuzzy Hash: 9F11E4B0901218ABDB26DB94DC08EEE7BBCAF05300F0041A9F984D3145DB3CDA898BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0100127F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
_wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
_fprintf.MSPDB140-MSVCRT ref: 010012D6

Part of subcall function 01001136: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?), ref: 0100114F

__stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
_fprintf.MSPDB140-MSVCRT ref: 01001300
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

Strings

[%s,%s] , xrefs: 010012CF
GTu, xrefs: 010012F3

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _fprintf$__stdio_common_vfwprintf__stdio_common_vfwprintf_p_wstrdate_s_wstrtime_sfflush
String ID: GTu$[%s,%s]
API String ID: 1797221872-377859784
Opcode ID: 4c8033e953c39908cb0881f39476575e1baa2051712662d322d9e51f92e68dc7
Instruction ID: 47b3ec0fe0642289bc471215e4612133765a8dafb9a991b1866239e677eb3284
Opcode Fuzzy Hash: 4c8033e953c39908cb0881f39476575e1baa2051712662d322d9e51f92e68dc7
Instruction Fuzzy Hash: 65114F31900509FFEB129FB8C805ADEFBB9EF08304F004425F691E6068D7769A94CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01001AD0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Found previously loaded library %s [%s]., xrefs: 01001B93
Using dotnet root parameter [%s] as runtime location., xrefs: 01001BC9
Invalid size for get_hostfxr_parameters. Expected at least %d, xrefs: 01001B38
hostfxr.dll, xrefs: 01001B5D, 01001B8E

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID:
String ID: Found previously loaded library %s [%s].$Invalid size for get_hostfxr_parameters. Expected at least %d$Using dotnet root parameter [%s] as runtime location.$hostfxr.dll
API String ID: 0-763581578
Opcode ID: 700fa8e73d202f599e522d640d03b7861b1dfc87be0f19f98fe051b2ea94e320
Instruction ID: 772ba0c4e61a9ea7925a1a80a685a13385cf53333805b00560cacaa243704aaa
Opcode Fuzzy Hash: 700fa8e73d202f599e522d640d03b7861b1dfc87be0f19f98fe051b2ea94e320
Instruction Fuzzy Hash: 22919C312083429FE716EF28D880AAEBBE6BFC9714F54491EF5D5872D4DB34E9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 01009955 Relevance: 4.5, APIs: 3, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 010013E9
_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,01001921,?,?,01001F8E,00000001,?,?,?,00000000,?,?,?,01001F24,?), ref: 0100995D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,01001921,?,?,01001F8E,00000001,?,?,?,00000000,?,?,?,01001F24,?), ref: 0100996A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _callnewhmallocstd::exception::exception
String ID:
API String ID: 1713455428-0
Opcode ID: 9d98d02a1763eff3562bd10b77fd2e1044cdb6b71fb9bd5858a5a0c940acb1cf
Instruction ID: 41c15f1370776c6781476651105b200c8642021c8a104115cbe9171e48bc7e99
Opcode Fuzzy Hash: 9d98d02a1763eff3562bd10b77fd2e1044cdb6b71fb9bd5858a5a0c940acb1cf
Instruction Fuzzy Hash: C3F0903150430FA6EB267AA9E80089ABB5C9F102A4F108265FADCA54D1EA31D594C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 0100125C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100127F: _wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
Part of subcall function 0100127F: _wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 010012D6
Part of subcall function 0100127F: __stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 01001300
Part of subcall function 0100127F: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 01001273

Strings

============= NetCoreCheck End ===============, xrefs: 0100125F

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _fprintf$__stdio_common_vfwprintf_p_wstrdate_s_wstrtime_sfclosefflush
String ID: ============= NetCoreCheck End ===============
API String ID: 1233219790-4038763337
Opcode ID: 391f097c74d48c9131a8c235f80c10a7987277bf8ad14df2f248af0dd994808a
Instruction ID: d19afbc1ab621884c4a1056b94725597e3cf1db124b32aa947b417385e13290a
Opcode Fuzzy Hash: 391f097c74d48c9131a8c235f80c10a7987277bf8ad14df2f248af0dd994808a
Instruction Fuzzy Hash: F6D0C93201D3219EFB361A14F406B9577E4AF11322F35055EE0C0940D8EBBA18D08648

Uniqueness

Uniqueness Score: -1.00%

Function 01005AC6 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LeaveCriticalSection.KERNEL32(?,00000001,00000000,?,?,01005A18,00000001,01005749,00000034,01001B0D), ref: 01005B29

Strings

COREHOST_TRACE, xrefs: 01005AE7

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: COREHOST_TRACE
API String ID: 3988221542-2084664928
Opcode ID: 6988713f5d56fb4b2d123bd96b42443e85428dc0e70d52adab3f5ad0d11be036
Instruction ID: 5dbe929d5341f7f33c52b4cc45f713592eeb61c96589edd26050bc87d5d9ce68
Opcode Fuzzy Hash: 6988713f5d56fb4b2d123bd96b42443e85428dc0e70d52adab3f5ad0d11be036
Instruction Fuzzy Hash: 5301D6719012119BDB22EF68CC80ACABBE8EF51324F14856AE945DB284E774DA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01009E2D Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A2F0: GetModuleHandleW.KERNEL32(00000000,01009DF6), ref: 0100A2F2

_c_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01009E3F
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,01017590,00000014), ref: 01009E6E

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: HandleModule_c_exit_exit
String ID:
API String ID: 750871209-0
Opcode ID: 49866ade549024bace0039494f8802d594f65c5d3f71d6239c9d08581676ce41
Instruction ID: 59b89c39e19c8f7d37cbcc3b5645262df5dd0c2324c42afe0ba95d1ce7c2da4e
Opcode Fuzzy Hash: 49866ade549024bace0039494f8802d594f65c5d3f71d6239c9d08581676ce41
Instruction Fuzzy Hash: C8E04632A0829A8FEF22EB98D8013DCBBB1BB54328F1005A5D991732E2E73618418A51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0100B050 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0100B056
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0100B064
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0100B075
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0100B086
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0100B097
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0100B0A8
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0100B0B9
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0100B0CA
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0100B0DB
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0100B0EC
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0100B0FD
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0100B10E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0100B11F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0100B130
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0100B141
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0100B152
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0100B163
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0100B174
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0100B185
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0100B196
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0100B1A7
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0100B1B8
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0100B1C9
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0100B1DA
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0100B1EB
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0100B1FC
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0100B20D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0100B21E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0100B22F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0100B240
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0100B251
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0100B262
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0100B273
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0100B284
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0100B295
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0100B2A6
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0100B2B7
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0100B2C8
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0100B2D9
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0100B2EA
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0100B2FB

Strings

WakeAllConditionVariable, xrefs: 0100B224
SleepConditionVariableCS, xrefs: 0100B235
WaitForThreadpoolTimerCallbacks, xrefs: 0100B114
kernel32.dll, xrefs: 0100B051
InitOnceExecuteOnce, xrefs: 0100B0AE
SetFileInformationByHandle, xrefs: 0100B1E0
FlsSetValue, xrefs: 0100B08C
CreateThreadpoolTimer, xrefs: 0100B0F2
GetSystemTimePreciseAsFileTime, xrefs: 0100B1F1
GetTickCount64, xrefs: 0100B1BE
CloseThreadpoolWait, xrefs: 0100B158
CloseThreadpoolTimer, xrefs: 0100B125
SleepConditionVariableSRW, xrefs: 0100B28A
GetFileInformationByHandleEx, xrefs: 0100B1CF
InitializeConditionVariable, xrefs: 0100B202
CompareStringEx, xrefs: 0100B2CE
AcquireSRWLockExclusive, xrefs: 0100B257
GetCurrentPackageId, xrefs: 0100B1AD
SubmitThreadpoolWork, xrefs: 0100B2AC
CreateEventExW, xrefs: 0100B0BF
SetThreadpoolTimer, xrefs: 0100B103
InitializeSRWLock, xrefs: 0100B246
FlsGetValue, xrefs: 0100B07B
CloseThreadpoolWork, xrefs: 0100B2BD
ReleaseSRWLockExclusive, xrefs: 0100B279
CreateThreadpoolWork, xrefs: 0100B29B
CreateSemaphoreW, xrefs: 0100B0D0
FlsAlloc, xrefs: 0100B05E
FlushProcessWriteBuffers, xrefs: 0100B169
GetLocaleInfoEx, xrefs: 0100B2DF
CreateThreadpoolWait, xrefs: 0100B136
TryAcquireSRWLockExclusive, xrefs: 0100B268
LCMapStringEx, xrefs: 0100B2F0
FlsFree, xrefs: 0100B06A
SetThreadpoolWait, xrefs: 0100B147
GetCurrentProcessorNumber, xrefs: 0100B18B
CreateSymbolicLinkW, xrefs: 0100B1A1
CreateSemaphoreExW, xrefs: 0100B0E1
WakeConditionVariable, xrefs: 0100B213
InitializeCriticalSectionEx, xrefs: 0100B09D
FreeLibraryWhenCallbackReturns, xrefs: 0100B17A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 5b6e79979e8f32654cbb0988456cea193474723799f50a1a51e217922d440e25
Instruction ID: 2ac6e015962b23e852e684eca8056cd5004a4c9490fb777363aff765213cd4f2
Opcode Fuzzy Hash: 5b6e79979e8f32654cbb0988456cea193474723799f50a1a51e217922d440e25
Instruction Fuzzy Hash: 52615971D92310EBC725AFBAA81DE953AE9FB0DA09B08451EF6C1D610DD7BE8080CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010063B3 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 010063BD
LoadLibraryA.KERNEL32(ntdll.dll), ref: 01006418
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0100642C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,win), ref: 01006532

Strings

win8, xrefs: 0100648E
win81, xrefs: 01006487
win7, xrefs: 01006495
win, xrefs: 010064AD
RtlGetVersion, xrefs: 01006426
ntdll.dll, xrefs: 01006413

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: AddressH_prolog3_LibraryLoadProc_invalid_parameter_noinfo_noreturn
String ID: RtlGetVersion$ntdll.dll$win$win7$win8$win81
API String ID: 3035776628-238241336
Opcode ID: 010880c7cfe7d58221fd3fa1a7052d711ec20f810c776cba749be34b8bd855eb
Instruction ID: 9fb1f3f4b40d377fbf1d715e2e7ef7878a7b409fb19538b4b9e90707212ade42
Opcode Fuzzy Hash: 010880c7cfe7d58221fd3fa1a7052d711ec20f810c776cba749be34b8bd855eb
Instruction Fuzzy Hash: 6641B470A002098BEB26DF68DC84AED76B7BF84704F400199E0C9DB2C4DF769AC08B11

Uniqueness

Uniqueness Score: -1.00%

Function 0100698F Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01006999
FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000C4,010054B2,?), ref: 01006B23
FindNextFileW.KERNEL32(00000000,00000010), ref: 01006BD6
FindClose.KERNEL32(00000000), ref: 01006BE5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01006C6D
__EH_prolog3_GS.LIBCMT ref: 01006C7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,01015C18,0000001C), ref: 01006CDE

Strings

\, xrefs: 01006A2A
/, xrefs: 01006A37

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: Find$FileH_prolog3__invalid_parameter_noinfo_noreturn$CloseFirstNext
String ID: /$\
API String ID: 1950242383-1600464054
Opcode ID: aa8df885dfcf2ce6e381408608e6cd77bce0d85e5732a98eb7dcd9b310b9d4df
Instruction ID: 4e0fdac74a9e7d14b73d9a900c7796c27b6866e751bb30bc4152baa66d5cacf2
Opcode Fuzzy Hash: aa8df885dfcf2ce6e381408608e6cd77bce0d85e5732a98eb7dcd9b310b9d4df
Instruction Fuzzy Hash: 1891F331A001099FEF16EFA4C884AEDBBB7FF45314F548159E581A72D4DB3A9AC5CB20

Uniqueness

Uniqueness Score: -1.00%

Function 01009FF1 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0100A007

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1a4fe83b8b677852c1e918f976c3016ce8f07270c95653ed241c0d0eb43e5661
Instruction ID: 28fb2662de910a18d6ac6064b961416474db233fadc627d54896ed7d127c113a
Opcode Fuzzy Hash: 1a4fe83b8b677852c1e918f976c3016ce8f07270c95653ed241c0d0eb43e5661
Instruction Fuzzy Hash: EC516BB1A10315CFEB26CF59D4917AABBF1FB48394F18846AE585EB284D3799900CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0100A333 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A340,01009CE5), ref: 0100A338

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3ece96549c1ebee52851058d5f646cc90d4415d04445781b0ab4a26e90606d4c
Instruction ID: 5a8451328b3fd2fa1a5d203e568d48c7360fd57c16d6990bd32243e90b62d255
Opcode Fuzzy Hash: 3ece96549c1ebee52851058d5f646cc90d4415d04445781b0ab4a26e90606d4c
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0100CAF0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c8e2e97fb528724aa8e6d3d88f74be1a407b517cb6688fae112cdd41539dd7f1
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1D11E6B720588243F69A8A3DDAB46BAEBD9EAC5230F2C43FAD2C14B6D4D522D145B500

Uniqueness

Uniqueness Score: -1.00%

Function 010057D6 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 010057DD
EnterCriticalSection.KERNEL32(01019A90,0000003C,01005769), ref: 0100580F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 0100581B

Part of subcall function 01006549: GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584

_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,010156D8), ref: 0100584C
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 0100585E
_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 010058A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 010058E3
LeaveCriticalSection.KERNEL32(01019A90), ref: 01005906

Strings

pqKu GTu, xrefs: 0100581B
COREHOST_TRACE_VERBOSITY, xrefs: 01005889
Unable to open COREHOST_TRACEFILE=%s for writing, xrefs: 0100591E
COREHOST_TRACEFILE, xrefs: 0100582A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterEnvironmentH_prolog3_LeaveVariable__acrt_iob_func_invalid_parameter_noinfo_noreturn_wfopen_wtoisetvbuf
String ID: COREHOST_TRACEFILE$COREHOST_TRACE_VERBOSITY$Unable to open COREHOST_TRACEFILE=%s for writing$pqKu GTu
API String ID: 2029814864-2536683520
Opcode ID: 4265adfc47f4c51a17754d2fbc8f1c799e3bdfd52fe387b8ca1902fdf0795d32
Instruction ID: cc19b550cd1a9a733817ac24d14d10942fab78ff99e85096cd3c6f061235d9d4
Opcode Fuzzy Hash: 4265adfc47f4c51a17754d2fbc8f1c799e3bdfd52fe387b8ca1902fdf0795d32
Instruction Fuzzy Hash: 7D41A131E04209DFEB12CFA8D8446DDBBB1BB49324F24445EE180F7288DA7A8A45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0100CF38 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0100D033
type_info::operator==.LIBVCRUNTIME ref: 0100D05A
___TypeMatch.LIBVCRUNTIME ref: 0100D166
IsInExceptionSpec.LIBVCRUNTIME ref: 0100D241
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(19930522,00000000,1FFFFFFF), ref: 0100D284
_UnwindNestedFrames.LIBCMT ref: 0100D2C8
CallUnexpected.LIBVCRUNTIME ref: 0100D2E3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(19930522,00000000,1FFFFFFF), ref: 0100D2E8

Strings

csm, xrefs: 0100D091
csm, xrefs: 0100CFE0
csm, xrefs: 0100CF73

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindabortterminatetype_info::operator==
String ID: csm$csm$csm
API String ID: 3797796283-393685449
Opcode ID: 1f18b9162ad71897135960bba53be790c3a925dc6e01931240c227e8bc161591
Instruction ID: 7e625793e9fe572f654cc0d3ccf1d940845e7a38f2df28eb2dbd25e6907cfeb9
Opcode Fuzzy Hash: 1f18b9162ad71897135960bba53be790c3a925dc6e01931240c227e8bc161591
Instruction Fuzzy Hash: 8BC1527180020AEFEF27DFD8C980AEEBBB5BF14310F04419AE9956B291D771D951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01004DA8 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 228COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01004DB2

Part of subcall function 01005994: EnterCriticalSection.KERNEL32(01019A90,?,?,0100578B,Tracing enabled @ %s,?), ref: 010059A7
Part of subcall function 01005994: LeaveCriticalSection.KERNEL32(01019A90,?,?,0100578B,Tracing enabled @ %s,?), ref: 010059BA

Part of subcall function 01006C74: __EH_prolog3_GS.LIBCMT ref: 01006C7B
Part of subcall function 01006C74: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,01015C18,0000001C), ref: 01006CDE

Part of subcall function 01007369: __EH_prolog3_GS.LIBCMT ref: 01007370
Part of subcall function 01007369: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF,000000FF,000000FF,00000008,?,010154F0,010154F0,0000003C,01004E06,000000C4,010054B2,?), ref: 01007440

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000C4,010054B2,?), ref: 01004FE1

Strings

Considering fxr version=[%s]..., xrefs: 01004E2C
A fatal error occurred, the required library %s could not be found in [%s], xrefs: 01005024
hostfxr.dll, xrefs: 01004F85, 0100501F
Resolved fxr [%s]..., xrefs: 01005003
Reading fx resolver directory=[%s], xrefs: 01004DCE
A fatal error occurred, the folder [%s] does not contain any version-numbered child folders, xrefs: 01004F28
Detected latest fxr version=[%s]..., xrefs: 01004F6A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3__invalid_parameter_noinfo_noreturn$CriticalSection$EnterLeave
String ID: A fatal error occurred, the folder [%s] does not contain any version-numbered child folders$A fatal error occurred, the required library %s could not be found in [%s]$Considering fxr version=[%s]...$Detected latest fxr version=[%s]...$Reading fx resolver directory=[%s]$Resolved fxr [%s]...$hostfxr.dll
API String ID: 1239437872-3818166005
Opcode ID: 69b7b7df30ff8b9f4a106eabc4594f976a2e54315e54284cc674b6756963e470
Instruction ID: b9bd2c410c0e6c14d8a9ffe71fc4f7e41bc96e6237a6c83a26b6c2c71c0e1124
Opcode Fuzzy Hash: 69b7b7df30ff8b9f4a106eabc4594f976a2e54315e54284cc674b6756963e470
Instruction Fuzzy Hash: 8C919132900209DFEB16DFA8CC94BDDB7B1AF14310F50859DD989A72C0DB74AA49CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01009C20 Relevance: 13.6, APIs: 9, Instructions: 61COMMON

Download Yara Rule

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 01009C23
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 01009C2E
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 01009C3A
__RTC_Initialize.LIBCMT ref: 01009C52
_configure_wide_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,0100A540), ref: 01009C67

Part of subcall function 0100A49B: InitializeSListHead.KERNEL32(01019728,01009C77), ref: 0100A4A0

__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_00003840), ref: 01009C85
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 01009CA0
_initialize_wide_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01009CAF
___scrt_fastfail.LIBCMT ref: 01009CC5

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: Initialize$HeadList___scrt_fastfail__p__commode__setusermatherr_configthreadlocale_configure_wide_argv_initialize_wide_environment_set_app_type_set_fmode
String ID:
API String ID: 2879864092-0
Opcode ID: 403ef3d7872d9d8ce46d34e3b87f09dbf8c66e43ac71a942b6d33b6d0110f026
Instruction ID: c9c8064d5908828d9fb4c876ce74a696630c57e1087ce02e9e25f12ae24135e3
Opcode Fuzzy Hash: 403ef3d7872d9d8ce46d34e3b87f09dbf8c66e43ac71a942b6d33b6d0110f026
Instruction Fuzzy Hash: 91013C94B40707A8F963B7F9990AECF1AC82F71698F154DA0FAC8AB5C3ED55C18141B3

Uniqueness

Uniqueness Score: -1.00%

Function 0100660F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01006619
GetFileAttributesExW.KERNEL32(?,00000000,?,00000274,0100309F,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01006649
GetFullPathNameW.KERNEL32(?,00000104,?,00000000,00000274,0100309F,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01006672
GetFullPathNameW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0100670D
GetFileAttributesExW.KERNEL32(?,00000000,?,?,00000000,?,010190AC,00000000,?,01019094,?,00000000,?,00000000,00000000,00000000), ref: 0100689C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,010190AC,00000000,?,01019094,?,00000000,?,00000000,00000000,00000000), ref: 01006900

Strings

Error resolving full path [%s], xrefs: 0100668F, 01006732

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: AttributesFileFullNamePath$H_prolog3__invalid_parameter_noinfo_noreturn
String ID: Error resolving full path [%s]
API String ID: 2812348236-1390578158
Opcode ID: d7b08f0d55ee853a439756d8565d8269cd84641df14ef38f359c93b94e85ef03
Instruction ID: 926b1998f771696ce5af179d0496308c0d2efb35267e0eac4e358c4e0a975278
Opcode Fuzzy Hash: d7b08f0d55ee853a439756d8565d8269cd84641df14ef38f359c93b94e85ef03
Instruction Fuzzy Hash: D881B171A102199FEF26DF64CC98ADDB7B6BF44314F100599E08997180DB3AAF94CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01005D7F Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 209COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01005D89

Part of subcall function 01006549: GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,x86,00000000,?,?,?,\Setup\InstalledVersions\,SOFTWARE\dotnet,000000D0,010061C6,?,00000054,01005244,DOTNET_ROOT,000000B8), ref: 01005EEE

Strings

_DOTNET_TEST_REGISTRY_PATH, xrefs: 01005DE5
x86, xrefs: 01005F43
\Setup\InstalledVersions\, xrefs: 01005F07
SOFTWARE\dotnet, xrefs: 01005DAD
HKEY_CURRENT_USER\, xrefs: 01005DFC

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLast$EnvironmentH_prolog3_Variable_invalid_parameter_noinfo_noreturn
String ID: HKEY_CURRENT_USER\$SOFTWARE\dotnet$\Setup\InstalledVersions\$_DOTNET_TEST_REGISTRY_PATH$x86
API String ID: 3516303167-2858202659
Opcode ID: 1672696a4adf4a3648d6967512db29d4ec4054677dff63fafb7b86070472212f
Instruction ID: 41a633086ec16e2e503eec6a9619177190550a326ee1dcaf52f9a76cccefaba1
Opcode Fuzzy Hash: 1672696a4adf4a3648d6967512db29d4ec4054677dff63fafb7b86070472212f
Instruction Fuzzy Hash: 9281AF31E0024A9FEF1ADBA8CD84BDDBBB6AF54314F20855DE185AB2D4DB359A44CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01006549 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584
GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,?,?,?,01005749,00000034,01001B0D), ref: 010065C8
GetLastError.KERNEL32(?,?,01005749,00000034,01001B0D), ref: 010065D2

Part of subcall function 010059C3: __EH_prolog3.LIBCMT ref: 010059CA
Part of subcall function 010059C3: EnterCriticalSection.KERNEL32(01019A90,00000010,010065F2,Failed to read environment variable [%s], HRESULT: 0x%X,COREHOST_TRACE,?,?,?,01005749,00000034,01001B0D), ref: 010059D8
Part of subcall function 010059C3: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00000000,?,?,?,?,01005749,00000034,01001B0D), ref: 010059FB
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,00000001,01005749,00000034,01001B0D), ref: 01005A44
Part of subcall function 010059C3: fputws.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 01005A4C
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A54
Part of subcall function 010059C3: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 01005A5D
Part of subcall function 010059C3: OutputDebugStringW.KERNELBASE(?), ref: 01005A79
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A8A
Part of subcall function 010059C3: LeaveCriticalSection.KERNEL32(01019A90), ref: 01005ABA

Strings

COREHOST_TRACE, xrefs: 0100654C, 01006566, 01006599, 010065C7, 010065E7
Failed to read environment variable [%s], HRESULT: 0x%X, xrefs: 0100659A, 010065E8

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLast__acrt_iob_func$CriticalEnvironmentSectionVariable$DebugEnterH_prolog3LeaveOutputString__stdio_common_vswprintffputwcfputws
String ID: COREHOST_TRACE$Failed to read environment variable [%s], HRESULT: 0x%X
API String ID: 2801205895-2897606757
Opcode ID: 4a32f05f710b292fa1f715f424b8209c003075f841e942dc39f771109e5a8453
Instruction ID: 022378c51f097602ac14387092d18c06d71b3c0b251983d8536b6c8b0b9b8784
Opcode Fuzzy Hash: 4a32f05f710b292fa1f715f424b8209c003075f841e942dc39f771109e5a8453
Instruction Fuzzy Hash: C411E6B1600300BBF72A6B7A9C4A97F76EDEFC5611F00452EF8C7C6194EA6A8D404670

Uniqueness

Uniqueness Score: -1.00%

Function 0100DCB3 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0100DD74,?,?,01019A08,00000000,?,0100DE9F,00000004,InitializeCriticalSectionEx,010141E8,010141F0,00000000), ref: 0100DD43

Strings

api-ms-, xrefs: 0100DD03
#v, xrefs: 0100DD43

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$#v
API String ID: 3664257935-2786943974
Opcode ID: 8b093f399520e117b551eb9ae8eb71eb61a3861a06bda9449156f5d7abc2de64
Instruction ID: 7405c5ea4b78aab2a1840cfe97e6e627b09c31ec70e4e30ebdf3eb635d442fa2
Opcode Fuzzy Hash: 8b093f399520e117b551eb9ae8eb71eb61a3861a06bda9449156f5d7abc2de64
Instruction Fuzzy Hash: 9E11A735A412259BEB735AECAC44B5937E49F01770F150251F9C1EB2C8D778EA008BE1

Uniqueness

Uniqueness Score: -1.00%

Function 01001999 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,00000000,00000000,?), ref: 010019B7
DeleteFileW.KERNEL32(?), ref: 010019C2

Part of subcall function 0100127F: _wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
Part of subcall function 0100127F: _wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 010012D6
Part of subcall function 0100127F: __stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 01001300
Part of subcall function 0100127F: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

Strings

Failed to delete existing file '%s'., xrefs: 010019CD
Failed to format file text., xrefs: 01001A05
{ "runtimeOptions": { "framework": { "name": "%s", "version": "%s" } } }, xrefs: 010019E8
p1#v0A$v, xrefs: 010019C2
Temp runtime config file text: '%s'., xrefs: 01001A1F

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: File_fprintf$DeleteExistsPath__stdio_common_vfwprintf_p_wstrdate_s_wstrtime_sfflush
String ID: Failed to delete existing file '%s'.$Failed to format file text.$Temp runtime config file text: '%s'.$p1#v0A$v${ "runtimeOptions": { "framework": { "name": "%s", "version": "%s" } } }
API String ID: 1473965541-103480171
Opcode ID: 73c2f658b3cc5381436361a7bbd8cfc22e9b4875f9c961b1f9e7ba3a01b6cb16
Instruction ID: b1ed967a73cb3e305a4231ec6748ec2af7aa935e2efd77563627a8614e1115ce
Opcode Fuzzy Hash: 73c2f658b3cc5381436361a7bbd8cfc22e9b4875f9c961b1f9e7ba3a01b6cb16
Instruction Fuzzy Hash: 91012FB2B0420877EB12E6A69C06DDE73EDDF61744F400069F4D5D61C5E678CE4446B5

Uniqueness

Uniqueness Score: -1.00%

Function 01001926 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000004,010015B0), ref: 01001931
PathRemoveFileSpecW.SHLWAPI(?), ref: 01001954
PathAppendW.SHLWAPI(?,Test.runtimeconfig.json), ref: 01001960

Part of subcall function 0100127F: _wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
Part of subcall function 0100127F: _wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 010012D6
Part of subcall function 0100127F: __stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 01001300
Part of subcall function 0100127F: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

Strings

Test.runtimeconfig.json, xrefs: 0100195A
Couldn't get module name., xrefs: 0100193B
Temporary runtime config file path: '%s'., xrefs: 01001983
Couldn't append file., xrefs: 0100196A

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: FilePath_fprintf$AppendModuleNameRemoveSpec__stdio_common_vfwprintf_p_wstrdate_s_wstrtime_sfflush
String ID: Couldn't append file.$Couldn't get module name.$Temporary runtime config file path: '%s'.$Test.runtimeconfig.json
API String ID: 3973820833-2882587904
Opcode ID: 50ce8476e9619a61d4ffb3717f7b2639c28ccebcded7be1b2dc60f0d3024a36f
Instruction ID: 584bc5f5105d56937f39b8d513fa773fad99fbcfd546260676f8a50a215e52e1
Opcode Fuzzy Hash: 50ce8476e9619a61d4ffb3717f7b2639c28ccebcded7be1b2dc60f0d3024a36f
Instruction Fuzzy Hash: DAF0A73278D3116AFB6322A67C0BECE1754DB61B66F01002DF4C8D90CCEBAD868087A1

Uniqueness

Uniqueness Score: -1.00%

Function 01002590 Relevance: 12.1, APIs: 8, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 010025B7

Part of subcall function 0100ABEF: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,?,010025BC,?,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794), ref: 0100AC00

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 010025C6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 010025DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 010025EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 010025FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 01002610
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,C9274AB8,?,?,00000000,0100E68B,000000FF,?,bad locale name,00000000,00000004,01002794,00000000,00000038,01004C05,?), ref: 01002622
std::_Lockit::~_Lockit.LIBCPMT ref: 0100262E

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: free$std::_$Locinfo::_Locinfo_dtorLockitLockit::~_setlocale
String ID:
API String ID: 1033100201-0
Opcode ID: da84104e18178ca8c43ec28b1570419008f4e6ffc961d2dcdf759a71e6824d85
Instruction ID: 68d9da46f5720464dcf93abf1091f7d14431d7b333a14ce5b0429975b74c1b1e
Opcode Fuzzy Hash: da84104e18178ca8c43ec28b1570419008f4e6ffc961d2dcdf759a71e6824d85
Instruction Fuzzy Hash: C0211831804B01DFE7378F19E905A56FBF4FB48A11F108A2EF0C682994DB3AA541DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0100CBCA Relevance: 12.1, APIs: 8, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0100CBC1,0100BB2C,0100A384), ref: 0100CBD8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0100CBE6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0100CBFF
SetLastError.KERNEL32(00000000,0100CBC1,0100BB2C,0100A384), ref: 0100CC51

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: acdd4601b6e80de4a624025f00513381471a5a1ba099cdfc90c9910c3cde9823
Instruction ID: 1b5070d2eb24ab30895158259aecb673af51dcdbb3bfb1adbe3af4251ac94de3
Opcode Fuzzy Hash: acdd4601b6e80de4a624025f00513381471a5a1ba099cdfc90c9910c3cde9823
Instruction Fuzzy Hash: DE01D8325097165EB67776FCBD58A5B2BA5EB15378F2003A9F1D0900D4EF5A4C409394

Uniqueness

Uniqueness Score: -1.00%

Function 0100BC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0100BCA7
___except_validate_context_record.LIBVCRUNTIME ref: 0100BCAF
_ValidateLocalCookies.LIBCMT ref: 0100BD38
__IsNonwritableInCurrentImage.LIBCMT ref: 0100BD63
_ValidateLocalCookies.LIBCMT ref: 0100BDB8

Strings

csm, xrefs: 0100BD4D

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e9717b39a97662cd0792ea47b9f936649c5d196cd820c28ce8add65abb88e68e
Instruction ID: a8f364b0b653e33f0da195d61420cacd5b9de4c2ad54743007dff72dab14fd1f
Opcode Fuzzy Hash: e9717b39a97662cd0792ea47b9f936649c5d196cd820c28ce8add65abb88e68e
Instruction Fuzzy Hash: 3E41B478A00209ABEF12EF5CC894ADEBFF5BF44314F148096E9945B3D1D7359A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01005CB6 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01005CBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(0000001C,010052FE,?,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01005D68

Part of subcall function 01006549: GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584

Strings

ProgramFiles(x86), xrefs: 01005D1B
ProgramFiles, xrefs: 01005D16
dotnet, xrefs: 01005D2E
_DOTNET_TEST_DEFAULT_INSTALL_PATH, xrefs: 01005CE5

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLast$EnvironmentH_prolog3_Variable_invalid_parameter_noinfo_noreturn
String ID: ProgramFiles$ProgramFiles(x86)$_DOTNET_TEST_DEFAULT_INSTALL_PATH$dotnet
API String ID: 3516303167-1903759158
Opcode ID: 39b332dcd3ceb4bdb53a21bae013ff6d87fc6278d336226dd56ce0a672af6258
Instruction ID: 6a4ce031d1608dded81350b7d6b704258092aa6d646b7a9eeb55b3d2ddbbe988
Opcode Fuzzy Hash: 39b332dcd3ceb4bdb53a21bae013ff6d87fc6278d336226dd56ce0a672af6258
Instruction Fuzzy Hash: FC11E630B001068BFF26EFA4CD586ED7BA3FB85214F64445AD1C0BB2C4DA398A86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0100316A Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01003171

Part of subcall function 01002EC2: __EH_prolog3_GS.LIBCMT ref: 01002EC9

Strings

https://aka.ms/dotnet-core-applaunch?, xrefs: 01003183
&rid=, xrefs: 010031C3
x86, xrefs: 010031AF
&arch=, xrefs: 010031A3
missing_runtime=true, xrefs: 01003196

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3_
String ID: &arch=$&rid=$https://aka.ms/dotnet-core-applaunch?$missing_runtime=true$x86
API String ID: 2427045233-935050095
Opcode ID: df140ff52e11adb158d3d9b60462089a35c9a55dd96b790bc010b1fe6a436da6
Instruction ID: 99af25e4f85b23bd41c4130b291d8ce45092e43dc7e2479f97091deaad0c7b89
Opcode Fuzzy Hash: df140ff52e11adb158d3d9b60462089a35c9a55dd96b790bc010b1fe6a436da6
Instruction Fuzzy Hash: 8A011A71F455199A9F16FBA6D8518EDBAB5AFB4B00F80400EE185BB290DF740A02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01001A4F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_wfopen_s.API-MS-WIN-CRT-STDIO-L1-1-0(01001A3E,?,01014228,?,?,?,?,01001A3E), ref: 01001A61
_fprintf.MSPDB140-MSVCRT ref: 01001A8B
_fprintf.MSPDB140-MSVCRT ref: 01001A98
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310,?,?), ref: 01001AA0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 01001AA9

Part of subcall function 0100127F: _wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
Part of subcall function 0100127F: _wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 010012D6
Part of subcall function 0100127F: __stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 01001300
Part of subcall function 0100127F: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

Strings

Open file failed : '%d'., xrefs: 01001A71

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _fprintf$fflush$__stdio_common_vfwprintf_p_wfopen_s_wstrdate_s_wstrtime_sfclose
String ID: Open file failed : '%d'.
API String ID: 1276396778-648588704
Opcode ID: def311bcee098fd5c9101d57c2e00f62424d2915faab2f51758b128bccf47355
Instruction ID: 35265d7adebd6a0403e29f48a339b46aa2878efdd0e096922d6a336ac21c6059
Opcode Fuzzy Hash: def311bcee098fd5c9101d57c2e00f62424d2915faab2f51758b128bccf47355
Instruction Fuzzy Hash: 87F0BE72A00154BBEB22A792DC0ACCEBAB8DB91B10F100164F8C1A2129D7BA8F50D690

Uniqueness

Uniqueness Score: -1.00%

Function 01008B60 Relevance: 9.3, APIs: 6, Instructions: 304stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01008B67
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000,01015C44,00000064,0100807C,?,?,?,?,?,?,?,00000000), ref: 01008BD2
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 01008BE2
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 01008BF4
ctype.LIBCPMT ref: 01008C63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01008EA4

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: strcspn$H_prolog3__invalid_parameter_noinfo_noreturnctypelocaleconv
String ID:
API String ID: 155702060-0
Opcode ID: c349bb234f3453e600f76e13508965296b2731c17a35400eef9e043e9d1abc55
Instruction ID: df15f5eee6a7e95876813fad63d57a4e6a88c9254575c55ec2431d85f01cd89e
Opcode Fuzzy Hash: c349bb234f3453e600f76e13508965296b2731c17a35400eef9e043e9d1abc55
Instruction Fuzzy Hash: A9C18B71D00209DFEF16DF98C884AEEBBB5FF58300F14815AE985AB294D734AA51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01004BB5 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 01004BBC
std::_Lockit::_Lockit.LIBCPMT ref: 01004BC6

Part of subcall function 0100A89F: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,01004BCB,00000000,00000008,?,?,?,?,?,00000000), ref: 0100A8AE

int.LIBCPMT ref: 01004BDD

Part of subcall function 01002647: std::_Lockit::_Lockit.LIBCPMT ref: 01002658
Part of subcall function 01002647: std::_Lockit::~_Lockit.LIBCPMT ref: 01002672

std::_Facet_Register.LIBCPMT ref: 01004C17
std::_Lockit::~_Lockit.LIBCPMT ref: 01004C37
Concurrency::cancel_current_task.LIBCPMT ref: 01004C44

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register_lock_locales
String ID:
API String ID: 1442585270-0
Opcode ID: 3fd786f8be2214a0eb18053581844869da10db5089e23977134811392f750cb1
Instruction ID: ae38b845011e783cb0a857f5d72813b3dde2fb21582ea304146b3a3abbdc31ca
Opcode Fuzzy Hash: 3fd786f8be2214a0eb18053581844869da10db5089e23977134811392f750cb1
Instruction Fuzzy Hash: 3201C03190021ACBEB07EB68C954BEEB7B1BFA4714F140409D584AB2D0CF789A058795

Uniqueness

Uniqueness Score: -1.00%

Function 01009274 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0100927B
std::_Lockit::_Lockit.LIBCPMT ref: 01009285

Part of subcall function 0100A89F: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,01004BCB,00000000,00000008,?,?,?,?,?,00000000), ref: 0100A8AE

int.LIBCPMT ref: 0100929C

Part of subcall function 01002647: std::_Lockit::_Lockit.LIBCPMT ref: 01002658
Part of subcall function 01002647: std::_Lockit::~_Lockit.LIBCPMT ref: 01002672

std::_Facet_Register.LIBCPMT ref: 010092D6
std::_Lockit::~_Lockit.LIBCPMT ref: 010092F6
Concurrency::cancel_current_task.LIBCPMT ref: 01009303

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register_lock_locales
String ID:
API String ID: 1442585270-0
Opcode ID: 083b1839ae23c3cbabf65961ce3b7ebb5d6f49c57ea9e5801fb4045b1f02a0c5
Instruction ID: 1bbef50ff7a84a0d1c4db1bd59e169eb6c9f16f259724477434b839b5d83ca1d
Opcode Fuzzy Hash: 083b1839ae23c3cbabf65961ce3b7ebb5d6f49c57ea9e5801fb4045b1f02a0c5
Instruction Fuzzy Hash: 0C01C032A002178BEB07EB64C8546EEB7B1BF94714F580448D484AB3D0CF789A058790

Uniqueness

Uniqueness Score: -1.00%

Function 01009309 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 01009310
std::_Lockit::_Lockit.LIBCPMT ref: 0100931A

Part of subcall function 0100A89F: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,01004BCB,00000000,00000008,?,?,?,?,?,00000000), ref: 0100A8AE

int.LIBCPMT ref: 01009331

Part of subcall function 01002647: std::_Lockit::_Lockit.LIBCPMT ref: 01002658
Part of subcall function 01002647: std::_Lockit::~_Lockit.LIBCPMT ref: 01002672

std::_Facet_Register.LIBCPMT ref: 01009368
std::_Lockit::~_Lockit.LIBCPMT ref: 01009388
Concurrency::cancel_current_task.LIBCPMT ref: 01009395

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register_lock_locales
String ID:
API String ID: 1442585270-0
Opcode ID: 220c25f3cf97c9345f279fb6379c428c7b5a0adfd221b4ea3cdf3b4199a84961
Instruction ID: dcb3b50d9ae4a62bf67aaa8031f0cb295a93ed14bc276de232d028b816d92fef
Opcode Fuzzy Hash: 220c25f3cf97c9345f279fb6379c428c7b5a0adfd221b4ea3cdf3b4199a84961
Instruction Fuzzy Hash: 7701DE31A002168BEF03EB68C8546FEB7B1BFA4314F184548E4D9AB2D0CF789E05CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01002EC2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01002EC9

Part of subcall function 01006549: GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000008,x86,01014CDC,0000003C,010031C3,x86,&arch=,missing_runtime=true,https://aka.ms/dotnet-core-applaunch?,00000028,010053EF,The .NET runtime can be found at:), ref: 01002FC7

Strings

x86, xrefs: 01002FED
win10, xrefs: 01002F75
DOTNET_RUNTIME_ID, xrefs: 01002EED

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ErrorLast$EnvironmentH_prolog3_Variable_invalid_parameter_noinfo_noreturn
String ID: DOTNET_RUNTIME_ID$win10$x86
API String ID: 3516303167-2602798933
Opcode ID: d9c71db1af62499131003f0e8493c4a61ea4dc530ce03bf8dfaf3d5081c2e972
Instruction ID: 3508725566d99e88f94b714b64438a24c233cc21eae179ee8f22aa0986963cc8
Opcode Fuzzy Hash: d9c71db1af62499131003f0e8493c4a61ea4dc530ce03bf8dfaf3d5081c2e972
Instruction Fuzzy Hash: 9D31B431E001098BEF16EBB8D985AEDBB75BF54350F60852DE180A72D4DB759A45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01005591 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01005598

Part of subcall function 01006917: __EH_prolog3_GS.LIBCMT ref: 0100691E

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 01005633

Part of subcall function 010059C3: __EH_prolog3.LIBCMT ref: 010059CA
Part of subcall function 010059C3: EnterCriticalSection.KERNEL32(01019A90,00000010,010065F2,Failed to read environment variable [%s], HRESULT: 0x%X,COREHOST_TRACE,?,?,?,01005749,00000034,01001B0D), ref: 010059D8
Part of subcall function 010059C3: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00000000,?,?,?,?,01005749,00000034,01001B0D), ref: 010059FB
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,00000001,01005749,00000034,01001B0D), ref: 01005A44
Part of subcall function 010059C3: fputws.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 01005A4C
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A54
Part of subcall function 010059C3: fputwc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 01005A5D
Part of subcall function 010059C3: OutputDebugStringW.KERNELBASE(?), ref: 01005A79
Part of subcall function 010059C3: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 01005A8A
Part of subcall function 010059C3: LeaveCriticalSection.KERNEL32(01019A90), ref: 01005ABA

Strings

A fatal error occurred. The folder [%s] does not exist, xrefs: 010055E5
fxr, xrefs: 010055C0
host, xrefs: 010055B0

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: __acrt_iob_func$CriticalH_prolog3_Section$DebugEnterH_prolog3LeaveOutputString__stdio_common_vswprintf_invalid_parameter_noinfo_noreturnfputwcfputws
String ID: A fatal error occurred. The folder [%s] does not exist$fxr$host
API String ID: 655774365-4223426913
Opcode ID: 7a1dcf5af4c35e7bfeda7452486edd7d365d1ba68c71680d5447c7c5338844a5
Instruction ID: 60f1618739eeae4f2e252f13aa5abbf888ea824c48eafba2c7a1da3bf95b257c
Opcode Fuzzy Hash: 7a1dcf5af4c35e7bfeda7452486edd7d365d1ba68c71680d5447c7c5338844a5
Instruction Fuzzy Hash: A5119432E001068BEB06FFB8EC949DD7771AB99210F60C51DD1D16B2C5DE355A448F54

Uniqueness

Uniqueness Score: -1.00%

Function 0100571C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01005723

Part of subcall function 01006549: GetEnvironmentVariableW.KERNEL32(COREHOST_TRACE,00000000,00000000,?,?,COREHOST_TRACE,?,01005749,00000034,01001B0D), ref: 0100656A
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006577
Part of subcall function 01006549: GetLastError.KERNEL32(?,01005749,00000034,01001B0D), ref: 01006584

_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000034,01001B0D), ref: 01005759

Part of subcall function 010057D6: __EH_prolog3_GS.LIBCMT ref: 010057DD
Part of subcall function 010057D6: EnterCriticalSection.KERNEL32(01019A90,0000003C,01005769), ref: 0100580F
Part of subcall function 010057D6: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 0100581B
Part of subcall function 010057D6: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,010156D8), ref: 0100584C
Part of subcall function 010057D6: setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 0100585E
Part of subcall function 010057D6: _wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 010058A3
Part of subcall function 010057D6: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 010058E3
Part of subcall function 010057D6: LeaveCriticalSection.KERNEL32(01019A90), ref: 01005906

Part of subcall function 01005C3E: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?), ref: 01005C62
Part of subcall function 01005C3E: _gmtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 01005C7B
Part of subcall function 01005C3E: wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000064,%c GMT,00000000), ref: 01005C90

Part of subcall function 01005994: EnterCriticalSection.KERNEL32(01019A90,?,?,0100578B,Tracing enabled @ %s,?), ref: 010059A7
Part of subcall function 01005994: LeaveCriticalSection.KERNEL32(01019A90,?,?,0100578B,Tracing enabled @ %s,?), ref: 010059BA

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000034,01001B0D), ref: 010057C1

Strings

COREHOST_TRACE, xrefs: 0100573F
Tracing enabled @ %s, xrefs: 01005781

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CriticalSection$EnterErrorH_prolog3_LastLeave_invalid_parameter_noinfo_noreturn_wtoi$EnvironmentVariable__acrt_iob_func_gmtime64_time64_wfopensetvbufwcsftime
String ID: COREHOST_TRACE$Tracing enabled @ %s
API String ID: 2615740193-2113631315
Opcode ID: 5cb80530c3d919414218513cb77a5b4d7094639b77a7599ab55e39891bbf484b
Instruction ID: a8faee5e7722e6cd7c8f87ec34d5d72eeed8fd0ae56bd984474fe2a41e138e13
Opcode Fuzzy Hash: 5cb80530c3d919414218513cb77a5b4d7094639b77a7599ab55e39891bbf484b
Instruction Fuzzy Hash: CD11D031A0020ACBEB06EBA4DC44AED7BB1BF58225F60440DD180AB1C4DB399945CF20

Uniqueness

Uniqueness Score: -1.00%

Function 010016BC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 010016C3
GetProcAddress.KERNEL32(?,00000010), ref: 010016D1
GetLastError.KERNEL32(?,00000010,01001515), ref: 010016DD
mbstowcs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,00000010,01001515), ref: 01001712

Strings

Failed to load library '%s', error = '%d', xrefs: 0100171C

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: AddressErrorH_prolog3LastProcmbstowcs
String ID: Failed to load library '%s', error = '%d'
API String ID: 1254853531-1515727213
Opcode ID: d3e70cb91e374e54dffe95d12e4978aaf7ff85c3215ca3ed3ac045a85e23f0c0
Instruction ID: da4414c0e017b2771f525ff77cfcb45510235957af304415e362cded5a89d60a
Opcode Fuzzy Hash: d3e70cb91e374e54dffe95d12e4978aaf7ff85c3215ca3ed3ac045a85e23f0c0
Instruction Fuzzy Hash: 0F01D676D012169BDB22AFB4CC049EF7AF5AF49301F104555F8D5A3288EB398A418BE0

Uniqueness

Uniqueness Score: -1.00%

Function 01002081 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000002,?,?,?,0100315E,?,?,?,?,010076DC,?,?,00000044,01004EFC,000000C4,010054B2), ref: 01002089
wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,0100315E,?,?,?,?,010076DC,?,?,00000044,01004EFC,000000C4,010054B2), ref: 010020A3
std::_Xinvalid_argument.LIBCPMT ref: 010020C1

Part of subcall function 0100A669: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0100A675

Part of subcall function 0100A6A9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0100A6B5

Strings

stoul argument out of range, xrefs: 010020C6
invalid stoul argument, xrefs: 010020BC

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument$Xinvalid_argument_errnostd::_wcstoul
String ID: invalid stoul argument$stoul argument out of range
API String ID: 527014703-1365241121
Opcode ID: 063a4cef869ef8e42c086b4d758599e934dcce7eb9772d9846b7ef5a95fbc31d
Instruction ID: d7d3b8a6fa9e08297b600e2fc5659f5386a2782ef507cdbd7d0afdb5881e3a65
Opcode Fuzzy Hash: 063a4cef869ef8e42c086b4d758599e934dcce7eb9772d9846b7ef5a95fbc31d
Instruction Fuzzy Hash: 57F0A732600306EBE331D7559849A9DB7B9EB51711F140066F5C1A7044D7796994C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0100CCE1 Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0100CDA8
___AdjustPointer.LIBCMT ref: 0100CDCB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(010177A8,00000010,0100CE53,00000001,?,?,?,010177C8,00000008,0100CED7,00000001,?,?,00000000,?,?), ref: 0100CE19
___AdjustPointer.LIBCMT ref: 0100CE67

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: AdjustPointer$abort
String ID:
API String ID: 4118245873-0
Opcode ID: d1f23f8485b3fa4a9b2f9e2e5c37ebd2f36ad0cdbe4e81a38e2cad19534a9ef8
Instruction ID: db74bc59c24bfadf6346b86191400ab2ba12a1bedd8c2d1025a74f3fb14af363
Opcode Fuzzy Hash: d1f23f8485b3fa4a9b2f9e2e5c37ebd2f36ad0cdbe4e81a38e2cad19534a9ef8
Instruction Fuzzy Hash: D251B1716002469FFB2B9F58DA40BAA7BA4FF54310F1442AED981572E1E731AC91C790

Uniqueness

Uniqueness Score: -1.00%

Function 0100D2EE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0100D313
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,1FFFFFFF), ref: 0100D41E

Strings

RCC, xrefs: 0100D32D
MOC, xrefs: 0100D325

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: EncodePointerabort
String ID: MOC$RCC
API String ID: 1188231555-2084237596
Opcode ID: 85583f176e11ae2e40d38be8d57b859a94cd517eed324607d149f176c1fc6698
Instruction ID: 7da50cd203bc7ee7eb50f0fe317e77e658980cfbaee4a8b178363ed5ee94920d
Opcode Fuzzy Hash: 85583f176e11ae2e40d38be8d57b859a94cd517eed324607d149f176c1fc6698
Instruction Fuzzy Hash: 83414C71900209AFEF16CFD8DD80AEEBBB5BF48304F198199FA4467291D735A950DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0100961D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01009627
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000009C,010095B3,00000000,00000001,00000000,0000003C,01009358,00000000,00000000,00000008,00000000,00000000,00000008,01007E19,?,?), ref: 0100962E

Part of subcall function 0100AEDC: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AEF2
Part of subcall function 0100AEDC: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AEF9
Part of subcall function 0100AEDC: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AF01
Part of subcall function 0100AEDC: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AF18

Strings

false, xrefs: 01009692
true, xrefs: 010096A7

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3____lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funclocaleconv
String ID: false$true
API String ID: 3742325865-2658103896
Opcode ID: 64a53223655fc4d322b2a6f100005d3ecf96ff454a9bb0cbf05ce9ca124dc344
Instruction ID: 2ae1a0b1b928d5150edf598e135b0e70666fdaabbf20c7441c284aea87908294
Opcode Fuzzy Hash: 64a53223655fc4d322b2a6f100005d3ecf96ff454a9bb0cbf05ce9ca124dc344
Instruction Fuzzy Hash: 9421A671D00744EFEB12EFB0D8409DB77B4BF98700F00846AE9959F292E634D504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01006050 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01006057

Part of subcall function 01005D7F: __EH_prolog3_GS.LIBCMT ref: 01005D89

Part of subcall function 0100564A: __EH_prolog3.LIBCMT ref: 01005651

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,00000000,010141F0,?,?,0000006C,01005323,?,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01006121

Strings

HKLM\, xrefs: 0100608C
HKCU\, xrefs: 01006094

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3_$H_prolog3_invalid_parameter_noinfo_noreturn
String ID: HKCU\$HKLM\
API String ID: 1686885614-2581276437
Opcode ID: 2a5671375e6cec20252ba13b5f4afb5acf0c632324be1fa6327b1df24287cee1
Instruction ID: 6c6516fac55ebcf0ec3ecad7c50acd031b5b86f2ed040d454118872dee0e3996
Opcode Fuzzy Hash: 2a5671375e6cec20252ba13b5f4afb5acf0c632324be1fa6327b1df24287cee1
Instruction Fuzzy Hash: 5121AC31A1014A8BEB16EBF0CC94ADDBB75BF64310F60451AD081AB1D5EF399A46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01002AEF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

std::system_error::system_error.LIBCPMT ref: 01002B69

Strings

ios_base::badbit set, xrefs: 01002B11, 01002B31
ios_base::failbit set, xrefs: 01002B1B, 01002B63
ios_base::eofbit set, xrefs: 01002B20

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: std::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2416138045-1866435925
Opcode ID: c6dc96d1d65b4c0112d3d1ae04774f010cc1bb47e97a7ccd9fd0113f207cfbd9
Instruction ID: 70571f3befb1855d1c298dd1125cb502e3ae15d7196dfc664d9e08279739fc23
Opcode Fuzzy Hash: c6dc96d1d65b4c0112d3d1ae04774f010cc1bb47e97a7ccd9fd0113f207cfbd9
Instruction Fuzzy Hash: 2F012B7290060D6BEB56BE98CC05BEEBBD89B20350F048059EED5AB1D2E6749904C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01002523 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0100252A
std::_Lockit::_Lockit.LIBCPMT ref: 01002537

Part of subcall function 0100A89F: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,01004BCB,00000000,00000008,?,?,?,?,?,00000000), ref: 0100A8AE

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 01002574

Part of subcall function 0100ABA4: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,?,01002579,?,?,00000000,00000004,01002794,00000000,00000038,01004C05,?,?,00000000,00000000), ref: 0100ABAB
Part of subcall function 0100ABA4: _Yarn.LIBCPMT ref: 0100ABC3
Part of subcall function 0100ABA4: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,00000000,?,?,01002579,?,?,00000000,00000004,01002794,00000000,00000038,01004C05,?,?), ref: 0100ABD3
Part of subcall function 0100ABA4: _Yarn.LIBCPMT ref: 0100ABE7

Strings

bad locale name, xrefs: 01002585

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: Yarnsetlocalestd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::__lock_locales
String ID: bad locale name
API String ID: 3905881377-1405518554
Opcode ID: 657a53a95b19e9b27da0290452c3f6a900456dca5a09bb392a09431b60191086
Instruction ID: 753a93befb1960e58f086139255b3599ea34cb1e968912930e0ffcbba9555c08
Opcode Fuzzy Hash: 657a53a95b19e9b27da0290452c3f6a900456dca5a09bb392a09431b60191086
Instruction Fuzzy Hash: C9014F71905B45DED7229F7A848058AFEE0BF28200F54896ED1CED3A90D770A604CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 01005C3E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?), ref: 01005C62
_gmtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 01005C7B
wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000064,%c GMT,00000000), ref: 01005C90

Strings

%c GMT, xrefs: 01005C82

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _gmtime64_time64wcsftime
String ID: %c GMT
API String ID: 960427835-3288836197
Opcode ID: abac818568a22aa36cea6b58833532006355c82d98c9db705aef0fcbe0e33f1f
Instruction ID: f425c6bd377353b89d8da0a78d8ab22359a8d8ab704683e85a4b1086956df9c4
Opcode Fuzzy Hash: abac818568a22aa36cea6b58833532006355c82d98c9db705aef0fcbe0e33f1f
Instruction Fuzzy Hash: 15F0EC70A002289BDB21DFA4DC45BDDBBB8BB04704F40059AF549A7284DB799A448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0100BAD1 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0100BB21

Strings

csm, xrefs: 0100BAEB
RCC, xrefs: 0100BADB
MOC, xrefs: 0100BAE3

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: 277890cacb699b4757dd6afe3fe8e9447060792f558f9ab535975da919029fea
Instruction ID: efcb35eca9778719bef1e246d7e5c8342c5be76eef31003ebb679ffdba22d308
Opcode Fuzzy Hash: 277890cacb699b4757dd6afe3fe8e9447060792f558f9ab535975da919029fea
Instruction Fuzzy Hash: A5F05E39400506CFF726AF5DC5005A9BBA4EF64211F1504EB8594476A1C7F8EA40DAC2

Uniqueness

Uniqueness Score: -1.00%

Function 010080C0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 010080C7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 0100813E
swprintf.LIBCMT ref: 010081A4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 010081F5

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3__invalid_parameter_noinfo_noreturnfrexpswprintf
String ID:
API String ID: 2423745673-0
Opcode ID: b698167b73485d56af7a08bf930927818a35223bd46d0b8eb4e0287698017ccd
Instruction ID: 2d02c133d9eb8ab9e206dbc1d68f74aa973f5b5bcd262859c46b6478f7e4c13f
Opcode Fuzzy Hash: b698167b73485d56af7a08bf930927818a35223bd46d0b8eb4e0287698017ccd
Instruction Fuzzy Hash: 4241A471D00509AFEF1ADFA8DC419EEB7BAFF98310F14811AF584A7290D7359951CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01007F70 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01007F77
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 01007FEE
swprintf.LIBCMT ref: 01008054
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 010080A5

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: H_prolog3__invalid_parameter_noinfo_noreturnfrexpswprintf
String ID:
API String ID: 2423745673-0
Opcode ID: 9d1b334aa1dd106faadd3975103d9ed816df3003f042eab1a9906bc110e57603
Instruction ID: 5f7bfa04b82b04f4a8fa824171c64b068c641496bb97571406a9ab53d478a262
Opcode Fuzzy Hash: 9d1b334aa1dd106faadd3975103d9ed816df3003f042eab1a9906bc110e57603
Instruction Fuzzy Hash: D041B371D00509EBEB1ADF68DC409EEBBB6FF98310F148119F584A7291D7399951CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0100AEDC Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AEF2
___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AEF9
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AF01
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,00000000,?,?,?,010027A6,00000000,00000000,00000038,01004C05,?,?,00000000,00000000,00000008), ref: 0100AF18

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_func
String ID:
API String ID: 3203701943-0
Opcode ID: a1fd83fd83fd5ba2fe5a78a50a4d922700be5a7f468722b321b270f1b2da2c52
Instruction ID: 1cb017ae898ca8f7578b1f2225e55e95fed2752f99aae8fd86437d8b2e067fbf
Opcode Fuzzy Hash: a1fd83fd83fd5ba2fe5a78a50a4d922700be5a7f468722b321b270f1b2da2c52
Instruction Fuzzy Hash: FEF044B270122362EB16ABBACC408EAFBC5DF55120B008979D689CB581E630C84083D0

Uniqueness

Uniqueness Score: -1.00%

Function 01003050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01003057
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01003104

Part of subcall function 01005965: EnterCriticalSection.KERNEL32(01019A90,?,?,010030D5,Did not find [%s] directory [%s],?,?,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 01005978
Part of subcall function 01005965: LeaveCriticalSection.KERNEL32(01019A90,?,?,?,010030D5,Did not find [%s] directory [%s],?,?,0000001C,01005212,DOTNET_ROOT,000000B8,01001C7F,?), ref: 0100598B

Strings

Did not find [%s] directory [%s], xrefs: 010030CB

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: CriticalSection$EnterH_prolog3_Leave_invalid_parameter_noinfo_noreturn
String ID: Did not find [%s] directory [%s]
API String ID: 1770634828-2138449732
Opcode ID: cf5efc45c6d1262b2e89a6307d7d6018c78885f070b998418096a8c0d62d0f45
Instruction ID: 7bd2013a4a2f88a44a06160fb2443055714f32efea3c937d65479d090e9b149f
Opcode Fuzzy Hash: cf5efc45c6d1262b2e89a6307d7d6018c78885f070b998418096a8c0d62d0f45
Instruction Fuzzy Hash: B721C631A01205DFEB16DFA8C8945DDBBF2BF49310F14451DD180BB2D0DB359988CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01001749 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,010016AD), ref: 01001756

Part of subcall function 0100127F: _wstrdate_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012B5
Part of subcall function 0100127F: _wstrtime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000009,?,01019A8C,?,?,?,?,?,?,?,0100124A,01019A8C,============= NetCoreCheck Start ===============), ref: 010012C1
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 010012D6
Part of subcall function 0100127F: __stdio_common_vfwprintf_p.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,01019A8C,00000000,0100124A), ref: 010012F3
Part of subcall function 0100127F: _fprintf.MSPDB140-MSVCRT ref: 01001300
Part of subcall function 0100127F: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,01014310), ref: 01001307

Strings

#v, xrefs: 01001756
FreeLibrary failed., xrefs: 01001760

Memory Dump Source

Source File: 00000003.00000002.2135693854.0000000001001000.00000020.00000001.01000000.00000008.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.2135679372.0000000001000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135710507.0000000001010000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135729764.0000000001019000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2135743128.000000000101A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_netcorecheck.jbxd

Similarity

API ID: _fprintf$FreeLibrary__stdio_common_vfwprintf_p_wstrdate_s_wstrtime_sfflush
String ID: FreeLibrary failed.$#v
API String ID: 2591961364-799205084
Opcode ID: 497956b16060ea7c1a4fb9bfd75f27c6e0dfc19ffeebd761b5d58b8fc9215c72
Instruction ID: 4ffb81f302b63e61e2943083e4c6c122f71e5015b6db614c7fdacc26ab17f25f
Opcode Fuzzy Hash: 497956b16060ea7c1a4fb9bfd75f27c6e0dfc19ffeebd761b5d58b8fc9215c72
Instruction Fuzzy Hash: A5D0123770C312167F6625BD7CA598617EC5B54B66BA1006AF9C8D70C8DE7DC8444790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dotnet60desktop.exePID: 5024, Parent PID: 6320COMMON

Executed Functions

Function 00DB3D89 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DB3DE8
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB3DFB
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00DB3E47
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB3E51
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00DB3E98
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB3EA2
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00DB3EF0
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB3F01
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00DB3FD3
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00DB3FE7
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00DB4010
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00DB4033
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00DB404C
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00DB405C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB4071
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB40A0
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB40C2
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB40E4
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DB40EE
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB40F8
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00DB411C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB4137
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00DB416D

Strings

DEL, xrefs: 00DB4004
*.*, xrefs: 00DB3ECE
c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp, xrefs: 00DB3E1E, 00DB4091
4#v, xrefs: 00DB3E98

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: 4#v$*.*$DEL$c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-2147551039
Opcode ID: 426f62e6aee2d828c428fff9939d46c5c5c4de6aea11672f13e965e0716090a0
Instruction ID: f03b94715aab37f820637ef6f35779f28d2a0a0e7aa5db0350edc5918cd6f37c
Opcode Fuzzy Hash: 426f62e6aee2d828c428fff9939d46c5c5c4de6aea11672f13e965e0716090a0
Instruction Fuzzy Hash: B4A1F872D01339EADB3196698C05BFAB6689F50760F054292FE46FB182D771CE80DAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB520D Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DB528F

Part of subcall function 00DF0912: InitializeCriticalSection.KERNEL32(00E1C6EC,?,00DB529B,00000000,?,?,?,?,?,?), ref: 00DF0929

Part of subcall function 00DB1206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00DB52B7,00000000,?), ref: 00DB1244
Part of subcall function 00DB1206: GetLastError.KERNEL32(?,?,?,00DB52B7,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DB124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DB52FD

Part of subcall function 00DF12D3: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00DF12F4

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00DB538F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DB5399
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB5606

Strings

Failed to run untrusted mode., xrefs: 00DB552E
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB53BD
Failed to get OS info., xrefs: 00DB53C7
Failed to initialize COM., xrefs: 00DB5309
Failed to run per-machine mode., xrefs: 00DB54E4
Failed to initialize Wiutil., xrefs: 00DB5359
Failed to initialize XML util., xrefs: 00DB5371
Failed to run per-user mode., xrefs: 00DB550C
Failed to parse command line., xrefs: 00DB52BD
Failed to initialize Cryputil., xrefs: 00DB531E
3.14.0.5722, xrefs: 00DB53FC
Failed to run RunOnce mode., xrefs: 00DB5494
Failed to initialize user state., xrefs: 00DB52E4
Failed to initialize core., xrefs: 00DB543B
Failed to initialize Regutil., xrefs: 00DB5341
Failed to run embedded mode., xrefs: 00DB54BC
Invalid run mode., xrefs: 00DB5471

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.14.0.5722$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 3262001429-872186229
Opcode ID: 814ef2f0d826dda177ca56b3038a0ca9fd6f6cac5796e900f3646afbc226bd21
Instruction ID: 9eebd726437f64e3edd9b8886e2a366d4dcf1d6d8cdcea60c1a4fbdd417b287d
Opcode Fuzzy Hash: 814ef2f0d826dda177ca56b3038a0ca9fd6f6cac5796e900f3646afbc226bd21
Instruction Fuzzy Hash: C2B1B272D41A29DBDB32AF64EC46BFD76A4EF04311F054196F90AA7345DB708E848EB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF34D0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00DF3A7E,00000000,?,00000000), ref: 00DF34EA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00DDBE27,?,00DB547D,?,00000000,?), ref: 00DF34F6
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00DF3536
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00DF3542
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00DF354D
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00DF3557
CoCreateInstance.OLE32(00E1C7A0,00000000,00000001,00DFB878,?,?,?,?,?,?,?,?,?,?,?,00DDBE27), ref: 00DF3592
ExitProcess.KERNEL32 ref: 00DF3641

Strings

kernel32.dll, xrefs: 00DF34DA
IsWow64Process, xrefs: 00DF3530
Wow64DisableWow64FsRedirection, xrefs: 00DF353C
Wow64EnableWow64FsRedirection, xrefs: 00DF3544
Wow64RevertWow64FsRedirection, xrefs: 00DF354F
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF351A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-566418578
Opcode ID: 92651dce73fc07701d360348cc9a99067577bd44677b2102fa4affc989ff1757
Instruction ID: 337fbf8713da1da6029b9ccc3e4a24fd2d901cafe510389d00b57f376cec1ea0
Opcode Fuzzy Hash: 92651dce73fc07701d360348cc9a99067577bd44677b2102fa4affc989ff1757
Instruction Fuzzy Hash: 90419431E41319ABCB259BA8C855FBE77A4EF84750F178569EA01EB380D771DE408B70

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB34EF: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DB10DD,?,00000000), ref: 00DB3510

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00DB10F6

Part of subcall function 00DB1173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB1184
Part of subcall function 00DB1173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB118F
Part of subcall function 00DB1173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DB119D
Part of subcall function 00DB1173: GetLastError.KERNEL32(?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB11B8
Part of subcall function 00DB1173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DB11C0
Part of subcall function 00DB1173: GetLastError.KERNEL32(?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB11D5

FindCloseChangeNotification.KERNELBASE(?,?,?,?,00DFB4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00DB1131

Strings

feclient.dll, xrefs: 00DB10D1
msasn1.dll, xrefs: 00DB10C3
version.dll, xrefs: 00DB10A7
comres.dll, xrefs: 00DB10B5
cabinet.dll, xrefs: 00DB1099
clbcatq.dll, xrefs: 00DB10BC
crypt32.dll, xrefs: 00DB10CA
msi.dll, xrefs: 00DB10A0
wininet.dll, xrefs: 00DB10AE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorFileLastModuleProc$ChangeCloseCreateFindHandleHeapInformationNameNotification
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 2670336470-3151496603
Opcode ID: 00438f85d8f0886fe773a7f0465d6482464d3e16ca2e6583e22bd05a6894688b
Instruction ID: 41392915affd0d1a4bef0abbbda24ec7417215421ea94444e27eac5040e7a0b7
Opcode Fuzzy Hash: 00438f85d8f0886fe773a7f0465d6482464d3e16ca2e6583e22bd05a6894688b
Instruction Fuzzy Hash: DD21807190031CEBCB009FA9DD05BEEBBB8EF09768F558116EA12B7381D77099048B74

Uniqueness

Uniqueness Score: -1.00%

Function 00DCA096 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 00DCA0B3
Failed create working folder., xrefs: 00DCA0C9
Failed to copy working folder., xrefs: 00DCA0F1

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: c9244a8e6f886b2ef8c4e637c16f2edb949462347b2f08c41d6a3e2bc429eb30
Instruction ID: 4c4d89219634576a11a2b6c94ecdfd8aead622e706cc6c1f2a2b72f1bcd0bcbb
Opcode Fuzzy Hash: c9244a8e6f886b2ef8c4e637c16f2edb949462347b2f08c41d6a3e2bc429eb30
Instruction Fuzzy Hash: 7F019E3290026AF78B326B599D06EAE7A75DE807A0720411AF801B7154DE318E90B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3ADF Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00DF06D5,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00DF0669,000001C7), ref: 00DB3AE9
RtlFreeHeap.NTDLL(00000000,?,00DF06D5,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00DF0669,000001C7,?,?), ref: 00DB3AF0
GetLastError.KERNEL32(?,00DF06D5,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00DF0669,000001C7,?,?), ref: 00DB3AFA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 3e27817a3969ff7bbe33ad6d9b8607df090b4d31f40e88ae30b7352668559f05
Instruction ID: b55dbd506af2f4d9bd34195d36f953864c200c3a6faaf4c02193c427e783704c
Opcode Fuzzy Hash: 3e27817a3969ff7bbe33ad6d9b8607df090b4d31f40e88ae30b7352668559f05
Instruction Fuzzy Hash: 56D01273A0133597862117E5DC0CDAB7E58DF056F17058126FD19D6310D725CD00D6F8

Uniqueness

Uniqueness Score: -1.00%

Function 00DE4503 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00DE4502,00000000,80004004,?,00000000,?,00DE1731), ref: 00DE4525
TerminateProcess.KERNEL32(00000000,?,00DE4502,00000000,80004004,?,00000000,?,00DE1731), ref: 00DE452C
ExitProcess.KERNEL32 ref: 00DE453E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3a0ef3b61df8cb925e4255856b0a1e7399e29ad047eff98c4d71124572f79924
Instruction ID: 605cabeba20852a323a1891f6544fafd95f472186c9e6c41ab0a34d23170d123
Opcode Fuzzy Hash: 3a0ef3b61df8cb925e4255856b0a1e7399e29ad047eff98c4d71124572f79924
Instruction Fuzzy Hash: ACE0B631441688AFCB127F5AEC199683B69EB44351B448815FA0ACA631CB35ED82DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DBFA6E Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ParentDisplayName, xrefs: 00DBFD0C
DisplayVersion, xrefs: 00DBFC2E
Tag, xrefs: 00DBFAE2
Failed to get @Department., xrefs: 00DBFF19
Registration, xrefs: 00DBFA88
Failed to get @ExecutableName., xrefs: 00DBFB92
DisplayName, xrefs: 00DBFC09
AboutUrl, xrefs: 00DBFCC2
Failed to parse software tag., xrefs: 00DBFE9B
Failed to get @DisableModify., xrefs: 00DBFE43
Contact, xrefs: 00DBFD5C
Failed to get @UpdateUrl., xrefs: 00DBFCFE
Failed to get @Classification., xrefs: 00DBFF80
Failed to get @HelpTelephone., xrefs: 00DBFCB4
Failed to set registration paths., xrefs: 00DBFF93
ExecutableName, xrefs: 00DBFB7F
ProviderKey, xrefs: 00DBFB5E
Publisher, xrefs: 00DBFC53
Arp, xrefs: 00DBFBBE
Failed to get @AboutUrl., xrefs: 00DBFCD9
Failed to get @DisplayName., xrefs: 00DBFC20
Failed to get @ProductFamily., xrefs: 00DBFF3E
Update, xrefs: 00DBFEA9
UpdateUrl, xrefs: 00DBFCE7
Register, xrefs: 00DBFBE8
Classification, xrefs: 00DBFF6D
Failed to get @DisableRemove., xrefs: 00DBFE6B
Failed to get @ParentDisplayName., xrefs: 00DBFD23
Failed to parse related bundles, xrefs: 00DBFB0E
yes, xrefs: 00DBFDC1
Comments, xrefs: 00DBFD34
Failed to get @Comments., xrefs: 00DBFD4B
button, xrefs: 00DBFDA0
Manufacturer, xrefs: 00DBFEDE
DisableRemove, xrefs: 00DBFE54
Failed to get @Manufacturer., xrefs: 00DBFEF1
Failed to parse @Version: %ls, xrefs: 00DBFB50
Failed to get @HelpLink., xrefs: 00DBFC8F
Failed to get @Version., xrefs: 00DBFB2F
Failed to get @Tag., xrefs: 00DBFAF5
Failed to get @Name., xrefs: 00DBFF5F
HelpTelephone, xrefs: 00DBFC9D
Name, xrefs: 00DBFF4C
Failed to get @Register., xrefs: 00DBFBFB
Failed to select Update node., xrefs: 00DBFEC7
Failed to select registration node., xrefs: 00DBFAA7
Failed to select ARP node., xrefs: 00DBFBDA
Failed to get @Id., xrefs: 00DBFAD4
c:\agent\_work\138\s\src\burn\user\registration.cpp, xrefs: 00DBFE12
DisableModify, xrefs: 00DBFD81
PerMachine, xrefs: 00DBFB9D
Failed to get @Publisher., xrefs: 00DBFC6A
Failed to get @ProviderKey., xrefs: 00DBFB71
Failed to get @PerMachine., xrefs: 00DBFBB0
Failed to get @Contact., xrefs: 00DBFD73
ProductFamily, xrefs: 00DBFF27
Invalid modify disabled type: %ls, xrefs: 00DBFE1F
Version, xrefs: 00DBFB1C
HelpLink, xrefs: 00DBFC78
Failed to get @DisplayVersion., xrefs: 00DBFC45
Department, xrefs: 00DBFF02

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\138\s\src\burn\user\registration.cpp$yes
API String ID: 760788290-4190031805
Opcode ID: c8b477fe3c69a336a691e234819797342be1c966be40d6f9b295698a25cfacb7
Instruction ID: 642bcf5d41852e803574a98804173f2003a715945aa43ebb5770de94c0aa15ae
Opcode Fuzzy Hash: c8b477fe3c69a336a691e234819797342be1c966be40d6f9b295698a25cfacb7
Instruction Fuzzy Hash: 92E1D372A40729FACB216B60CC42EFEB664AF04750F1642B1F952BB1E1D761ED8497F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB54B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DBB5C2
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB610
GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DBB616
ReadFile.KERNELBASE(00000000,00DB44EB,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB65E
GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DBB664
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB6C1
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB6C7
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB710
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB716
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB787
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB78D
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB7D6
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB7DC
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB825
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB82B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB877
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB87D

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB8D0
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB932
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB9BC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB9C6

Strings

Failed to read DOS header., xrefs: 00DBB68F
Failed to seek to start of file., xrefs: 00DBB641
Failed to open handle to user process path., xrefs: 00DBB5ED
(, xrefs: 00DBB8DD
Failed to read complete image section header, index: %u, xrefs: 00DBBC35
Failed to allocate memory for container sizes., xrefs: 00DBBB93
Failed to read signature offset., xrefs: 00DBB807
Failed to seek to section info., xrefs: 00DBB7B8, 00DBB9F4
.wix, xrefs: 00DBB8F0
c:\agent\_work\138\s\src\burn\user\section.cpp, xrefs: 00DBB5E3, 00DBB637, 00DBB685, 00DBB6E8, 00DBB737, 00DBB7AE, 00DBB7FD, 00DBB84C, 00DBB8A1, 00DBB958, 00DBB998, 00DBB9EA, 00DBBA4F, 00DBBA79, 00DBBAA0, 00DBBB87, 00DBBBC7, 00DBBBE6, 00DBBC23, 00DBBC61, 00DBBC84, 00DBBC9F
Failed to find valid DOS image header in buffer., xrefs: 00DBBCAB
Failed to find valid NT image header in buffer., xrefs: 00DBBC90
Failed to read image section header, index: %u, xrefs: 00DBBC6C
4, xrefs: 00DBB944
Failed to get total size of bundle., xrefs: 00DBBAE3
PE, xrefs: 00DBB758
Failed to read section info., xrefs: 00DBBA59
burn, xrefs: 00DBB8F8
Failed to read NT header., xrefs: 00DBB741
Failed to read complete section info., xrefs: 00DBBA85
Failed to allocate buffer for section info., xrefs: 00DBB9A4
Failed to seek to NT header., xrefs: 00DBB6F2
Failed to read section info, unsupported version: %08x, xrefs: 00DBBAB5
Failed to find Burn section., xrefs: 00DBBBF2
Failed to read section info, data to short: %u, xrefs: 00DBB96A
Failed to seek past optional headers., xrefs: 00DBB8AB
Failed to read signature size., xrefs: 00DBB856
PE Header from file didn't match PE Header in memory., xrefs: 00DBBBD1

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\138\s\src\burn\user\section.cpp
API String ID: 3411815225-3112695413
Opcode ID: 474ab64ab710fbccf7ac2de0bdb818482b664114c61da884af26bc301d1bb8e1
Instruction ID: 39b55c87b00ac995b655c9601113c081c7f7f1ba81726f14eb2e48ca9e6cb65c
Opcode Fuzzy Hash: 474ab64ab710fbccf7ac2de0bdb818482b664114c61da884af26bc301d1bb8e1
Instruction Fuzzy Hash: 1F12D676D40329EBD7309B158C46FFA7A64AF44B20F018166FA06AF281DBB0DD44CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0BCF Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,00DD077F,?,?), ref: 00DD0BDE
GetLastError.KERNEL32(?,?,?,?,00DD077F,?,?), ref: 00DD0BE8
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00DD077F,?,?), ref: 00DD0C2D
GetLastError.KERNEL32(?,?,?,?,00DD077F,?,?), ref: 00DD0C38
ResetEvent.KERNEL32(?,?,?,?,?,00DD077F,?,?), ref: 00DD0C70
GetLastError.KERNEL32(?,?,?,?,00DD077F,?,?), ref: 00DD0C7A

Strings

Failed to set operation complete event., xrefs: 00DD0C16, 00DD0D57
Failed to set file pointer to beginning of file., xrefs: 00DD0F91
Invalid operation for this state., xrefs: 00DD0CD6
Failed to copy stream name: %ls, xrefs: 00DD0D09
Failed to create file: %ls, xrefs: 00DD0EBA
Failed to wait for begin operation event., xrefs: 00DD0C66, 00DD0D9F
Failed to set end of file., xrefs: 00DD0F4D
Failed to set file pointer to end of file., xrefs: 00DD0F08
Failed to allocate buffer for stream., xrefs: 00DD0E4C
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0C0C, 00DD0C5C, 00DD0C9E, 00DD0CCA, 00DD0D4D, 00DD0D95, 00DD0DDA, 00DD0E42, 00DD0EAD, 00DD0EFE, 00DD0F43, 00DD0F87
Failed to reset begin operation event., xrefs: 00DD0CA8, 00DD0DE4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 1865021742-4216264097
Opcode ID: 8db9f313d4922c55b7d06843e5ae18a2e8a0ed0cd06f29110eb3b25efda89b6d
Instruction ID: 6bcb3e808fab715ab0c1f964402b0509292480ad81f144f858bbb2f299e91ffa
Opcode Fuzzy Hash: 8db9f313d4922c55b7d06843e5ae18a2e8a0ed0cd06f29110eb3b25efda89b6d
Instruction Fuzzy Hash: E791EF37A91732EBD23017A48D0AB6B2D14AF40B60F1A8227FE55BA7D0EB50DC4092F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4DB5 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB34EF: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DB10DD,?,00000000), ref: 00DB3510

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DB4FBC
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DB4FCB
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DB4FDA
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DB4FE5

Strings

"%ls" %ls, xrefs: 00DB4EF6
-%ls="%ls", xrefs: 00DB4E62
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB4F66
%ls %ls, xrefs: 00DB4ED1
Failed to cache to clean room., xrefs: 00DB4E3E
Failed to append original command line., xrefs: 00DB4EE5
D, xrefs: 00DB4F25
burn.clean.room, xrefs: 00DB4E5A
Failed to launch clean room process: %ls, xrefs: 00DB4F73
burn.filehandle.attached, xrefs: 00DB4E93
Failed to append %ls, xrefs: 00DB4E98
Failed to wait for clean room process: %ls, xrefs: 00DB4F9F
Failed to allocate parameters for unelevated process., xrefs: 00DB4E76
Failed to allocate full command-line., xrefs: 00DB4F0A
Failed to get path for current process., xrefs: 00DB4DFF
burn.filehandle.self, xrefs: 00DB4EC1

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 3884789274-535173987
Opcode ID: 5cc071afac8e71cee506d31fcea893648f098bbdd74328b20d39503337ce8662
Instruction ID: 11f53732a8915e593c1ffd1ccb0c9f763de89bdf5855abb82324cee917280b47
Opcode Fuzzy Hash: 5cc071afac8e71cee506d31fcea893648f098bbdd74328b20d39503337ce8662
Instruction Fuzzy Hash: 22714132D40229EBCB11DBA4CC45EFFBA78EF08720F158116FA15B7192D7709A058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC7523 Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get manifest stream from container., xrefs: 00DC75C5
WixBundleSourceProcessFolder, xrefs: 00DC772D
WixBundleElevated, xrefs: 00DC769E, 00DC76AF
Failed to load manifest., xrefs: 00DC75E1
Failed to initialize internal cache functionality., xrefs: 00DC7798
Failed to set source process path variable., xrefs: 00DC7702
Failed to initialize variables., xrefs: 00DC756A
WixBundleUILevel, xrefs: 00DC76CF, 00DC76E0
Failed to open manifest stream., xrefs: 00DC75A4
Failed to open attached UX container., xrefs: 00DC7587
Failed to set source process folder variable., xrefs: 00DC773E
Failed to load catalog files., xrefs: 00DC7808
Failed to get source process folder from path., xrefs: 00DC771E
Failed to overwrite the %ls built-in variable., xrefs: 00DC76B4
Failed to get unique temporary folder for bootstrapper application., xrefs: 00DC77C7
WixBundleSourceProcessPath, xrefs: 00DC76F1
Failed to parse command line., xrefs: 00DC7660
Failed to extract bootstrapper application payloads., xrefs: 00DC77E8
Failed to set original source variable., xrefs: 00DC7763
WixBundleOriginalSource, xrefs: 00DC7752

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 83f19142fd2d53ced52cd3d89ee59eed059670cac618a89023b2e5459dcba8c1
Instruction ID: 8a3abd67843c3289b599d2866adfa4453e3224861de37ee9c2e186052754445c
Opcode Fuzzy Hash: 83f19142fd2d53ced52cd3d89ee59eed059670cac618a89023b2e5459dcba8c1
Instruction Fuzzy Hash: FFA14072A4461ABADB129AA4CC45FEEB6ACBF04700F15522AB605F7181D770E954CFF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC86B8 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00DB4E38,?,?,00000000,00DB4E38,00000000), ref: 00DC86FB
GetLastError.KERNEL32 ref: 00DC8708

Part of subcall function 00DF4322: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00DF43B8

SetFilePointerEx.KERNELBASE(00000000,00DFB4A8,00000000,00000000,00000000,?,00000000,00DFB4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC87B5
GetLastError.KERNEL32 ref: 00DC87BF
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00DFB4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC88EA

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC872C, 00DC87E3, 00DC884A, 00DC88B9
Failed to seek to original data in exe burn section header., xrefs: 00DC88C3
Failed to copy user from: %ls to: %ls, xrefs: 00DC8790
cabinet.dll, xrefs: 00DC8863
Failed to create user file at path: %ls, xrefs: 00DC8739
Failed to zero out original data offset., xrefs: 00DC88DC
Failed to seek to beginning of user file: %ls, xrefs: 00DC8761
msi.dll, xrefs: 00DC87FC
Failed to seek to signature table in exe header., xrefs: 00DC8854
Failed to update signature offset., xrefs: 00DC8809
Failed to seek to checksum in exe header., xrefs: 00DC87ED

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy user from: %ls to: %ls$Failed to create user file at path: %ls$Failed to seek to beginning of user file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\138\s\src\burn\user\cache.cpp$cabinet.dll$msi.dll
API String ID: 3608016165-3615985753
Opcode ID: a8398382490782caa583ede563e0611e1e20427ba51fd5ec460f9610587517d5
Instruction ID: b577d28578fbe60e30425dffcb3239868cd0a7b1c9f3bae54f94ee049701720c
Opcode Fuzzy Hash: a8398382490782caa583ede563e0611e1e20427ba51fd5ec460f9610587517d5
Instruction Fuzzy Hash: 9251E576E41726ABE7115BA49C46F7F6668EF04B60F164129FE00FB281EA60DC00A7F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB76D4 Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00DC7564,00DB5435,00000000,00DB54BD), ref: 00DB76F4

Strings

$, xrefs: 00DB7E31
WixBundleSourceProcessFolder, xrefs: 00DB7F8E
#, xrefs: 00DB7773
WixBundleElevated, xrefs: 00DB7F36
InstallerVersion, xrefs: 00DB78DB
WixBundleAction, xrefs: 00DB7E5E
WixBundleExecutePackageAction, xrefs: 00DB7EE8
WixBundleTag, xrefs: 00DB7F9E
Date, xrefs: 00DB7818
WixBundleForcedRestartPackage, xrefs: 00DB7F04
WixBundleUILevel, xrefs: 00DB7FAE
LogonUser, xrefs: 00DB792A
WixBundleVersion, xrefs: 00DB7FBE
WixBundleSourceProcessPath, xrefs: 00DB7F7E
Failed to add built-in variable: %ls., xrefs: 00DB8009
WixBundleInstalled, xrefs: 00DB7F1A
WixBundleProviderKey, xrefs: 00DB7F6E
InstallerName, xrefs: 00DB78BA
0, xrefs: 00DB770B
WixBundleExecutePackageCacheFolder, xrefs: 00DB7ECC
', xrefs: 00DB795D
WixBundleActiveParent, xrefs: 00DB7F52

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 48c0d4d3de50cb112cc266405b925c832cf7fea216e808e665b823b3a6bf872a
Instruction ID: 0d320011cc640e0ba8035b14147e5d1e5c259b9e999109f04c65c756a74f1b64
Opcode Fuzzy Hash: 48c0d4d3de50cb112cc266405b925c832cf7fea216e808e665b823b3a6bf872a
Instruction Fuzzy Hash: EA4266B0C1162D9FDB61CF5AC9887D9FAB4BB48304F5191EED20DAA310C7B05B988F65

Uniqueness

Uniqueness Score: -1.00%

Function 00DC82A6 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00DB5501), ref: 00DC82FC

Part of subcall function 00DF0C8F: OpenProcessToken.ADVAPI32(?,00000008,?,00DB5435,00000000,?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0CAD
Part of subcall function 00DF0C8F: GetLastError.KERNEL32(?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0CB7
Part of subcall function 00DF0C8F: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0D41

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00DC8322
GetLastError.KERNEL32 ref: 00DC832C
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00DC83A9
GetLastError.KERNEL32 ref: 00DC83B3
UuidCreate.RPCRT4(?), ref: 00DC83F2

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC8350, 00DC83D7, 00DC8428
Failed to append bundle id on to temp path for working folder., xrefs: 00DC845C
Failed to create working folder guid., xrefs: 00DC83FF
Failed to concat Temp directory on windows path for working folder., xrefs: 00DC8399
Failed to ensure windows path for working folder ended in backslash., xrefs: 00DC8377
Failed to get windows path for working folder., xrefs: 00DC835A
Failed to get temp path for working folder., xrefs: 00DC83E1
Failed to copy working folder path., xrefs: 00DC8477
%ls%ls\, xrefs: 00DC8444
4#v, xrefs: 00DC83A9
Failed to convert working folder guid into string., xrefs: 00DC8432
Temp\, xrefs: 00DC8381

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 2898636500-1839125748
Opcode ID: 858d497eafe68402a3ba979f363ee2fb1ff7b0fb7d11ef8020282b7ec6e75f94
Instruction ID: bce3262a8d919c064cea7bb217bed7e55d788577d4e668005dd3cfd501370521
Opcode Fuzzy Hash: 858d497eafe68402a3ba979f363ee2fb1ff7b0fb7d11ef8020282b7ec6e75f94
Instruction Fuzzy Hash: 8341F972E49326E7C720A6E4CC4AFAB76689B04B10F018166BA45F71C0EF74DD4496F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0FB4 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00DD0FD6
CoUninitialize.OLE32 ref: 00DD1251

Strings

Failed to set operation complete event., xrefs: 00DD117D
Invalid operation for this state., xrefs: 00DD1235
<the>.cab, xrefs: 00DD1076
Failed to wait for begin operation event., xrefs: 00DD11CA
Failed to initialize COM., xrefs: 00DD0FE2
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00DD1132
Failed to initialize cabinet.dll., xrefs: 00DD1058
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD104C, 00DD1173, 00DD11C0, 00DD11FF, 00DD122B
Failed to reset begin operation event., xrefs: 00DD1209

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 3442037557-3038769977
Opcode ID: 1d98e68bdff3936b438ce5b1a7e71244bb23261ab46acef943b5df519e959e5f
Instruction ID: 21a23a10cf3b08976b013b1e8c317e9cda2c4471a9fba554e0dac76aa9eb80f2
Opcode Fuzzy Hash: 1d98e68bdff3936b438ce5b1a7e71244bb23261ab46acef943b5df519e959e5f
Instruction Fuzzy Hash: 3351147FE91336FBDB2057949C06E7A3A14DB41B60B2A8227FE11BB380D625DC4096F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4361 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB438D
InitializeCriticalSection.KERNEL32(000000D0,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB4396
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB43DC
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB43E6
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB43FA
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB440A
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB445A
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB4464
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB4478
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00DB52DE,?,?,00000000,?,?), ref: 00DB4488

Strings

c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB451D, 00DB4549
Failed to initialize user section., xrefs: 00DB44F1
Failed to parse file handle: '%ls', xrefs: 00DB450A
burn.filehandle.attached, xrefs: 00DB43D7, 00DB43DF, 00DB43E4, 00DB43E5, 00DB4405, 00DB4527
Missing required parameter for switch: %ls, xrefs: 00DB452C
burn.filehandle.self, xrefs: 00DB4455, 00DB445D, 00DB4462, 00DB4463, 00DB4483, 00DB4553

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 3039292287-4238739692
Opcode ID: 3ec940583e788467cac6af6c5feab491363cc3ab3f51f0041ec3c0040bbba38b
Instruction ID: 693f1954af93804c93fc1b362bd93891714188db48bc55aff5f88e6ba49eb7f4
Opcode Fuzzy Hash: 3ec940583e788467cac6af6c5feab491363cc3ab3f51f0041ec3c0040bbba38b
Instruction Fuzzy Hash: 65519071A40619FFC724EB68DC86FAA77A8EF04730F158116F716D7291DBB0A950CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBC343 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00DBC533,00DB547D,?,?,00DB54BD), ref: 00DBC38A
GetLastError.KERNEL32(?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC39B
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?), ref: 00DBC3EA
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC3F0
DuplicateHandle.KERNELBASE(00000000,?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC3F3
GetLastError.KERNEL32(?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC3FD
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC44F
GetLastError.KERNEL32(?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DBC459

Strings

feclient.dll, xrefs: 00DBC44C
Failed to duplicate handle to container: %ls, xrefs: 00DBC42E
Failed to open container., xrefs: 00DBC4A5
crypt32.dll, xrefs: 00DBC44B
Failed to open file: %ls, xrefs: 00DBC3CC
Failed to move file pointer to container offset., xrefs: 00DBC487
c:\agent\_work\138\s\src\burn\user\container.cpp, xrefs: 00DBC3BF, 00DBC421, 00DBC47D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\138\s\src\burn\user\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-2236165814
Opcode ID: 693fbae305b9a0df7414ded0158cf65eb6d00be62cebf0a4222eb54a405b369d
Instruction ID: 333e6747fb1007293b75cb0f1039a16cc55d8a630d93e3de280281e83db5a864
Opcode Fuzzy Hash: 693fbae305b9a0df7414ded0158cf65eb6d00be62cebf0a4222eb54a405b369d
Instruction Fuzzy Hash: 9941B336150305EBC7209F199C49EA77AA9FFC5760B26802AF959DB381EB31D901DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF2F7B Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB390C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DB394B
Part of subcall function 00DB390C: GetLastError.KERNEL32 ref: 00DB3955

Part of subcall function 00DF4EA2: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00DF4ED3

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00DF2FC5
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00DF2FE5
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00DF3005
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00DF3025
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00DF3045
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00DF3065
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00DF3085

Strings

MsiSetExternalUIRecord, xrefs: 00DF305A
MsiDeterminePatchSequenceW, xrefs: 00DF2FBA
MsiSourceListAddSourceExW, xrefs: 00DF307A
MsiEnumProductsExW, xrefs: 00DF2FFA
MsiGetProductInfoExW, xrefs: 00DF303A
MsiDetermineApplicablePatchesW, xrefs: 00DF2FDA
Msi.dll, xrefs: 00DF2F8D
MsiGetPatchInfoExW, xrefs: 00DF301A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 545776612aee6588eae56f65a7f9712202bfe4659b668547bc44a0651e5a50dd
Instruction ID: 977e345dfd15022a181842e14a3c89a4598ffebf2a89ad22fdfcf5c2e90eab7e
Opcode Fuzzy Hash: 545776612aee6588eae56f65a7f9712202bfe4659b668547bc44a0651e5a50dd
Instruction Fuzzy Hash: DF31C374980318AEEB129F32ED0ABE63AA1E701705F21D22BE110F61F0D7F10A89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00DD15F7 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00DBC49F,?,00000000,?,00DBC533), ref: 00DD162E
GetLastError.KERNEL32(?,00DBC49F,?,00000000,?,00DBC533,00DB547D,?,?,00DB54BD,00DB54BD,00000000,?,00000000), ref: 00DD1637

Strings

Failed to create extraction thread., xrefs: 00DD16F7
Failed to create operation complete event., xrefs: 00DD16AB
Failed to copy file name., xrefs: 00DD1619
wininet.dll, xrefs: 00DD160D
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD165B, 00DD16A1, 00DD16ED
Failed to create begin operation event., xrefs: 00DD1665
Failed to wait for operation complete., xrefs: 00DD170A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp$wininet.dll
API String ID: 545576003-9491624
Opcode ID: 42c03e765f988ecc7cbe7515b6807dd95ab15991f31e802413e006e3afaa9c5f
Instruction ID: df1dd9fa921c52e79d6f1378774234e78b74bb99de47e6643b5a70794515b028
Opcode Fuzzy Hash: 42c03e765f988ecc7cbe7515b6807dd95ab15991f31e802413e006e3afaa9c5f
Instruction Fuzzy Hash: 2221957B98173AB7E22116A48C46E77795CEF00BB4B094223FD45FB781EA64DC4086F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DF00C9 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00DF00F1
GetProcAddress.KERNEL32(SystemFunction041), ref: 00DF0103
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00DF0146
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DF015A
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00DF0192
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DF01A6

Strings

CryptProtectMemory, xrefs: 00DF013B
c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp, xrefs: 00DF017B
Crypt32.dll, xrefs: 00DF0127
SystemFunction041, xrefs: 00DF00F3
AdvApi32.dll, xrefs: 00DF00D0
SystemFunction040, xrefs: 00DF00E6
CryptUnprotectMemory, xrefs: 00DF0187

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-403682633
Opcode ID: 218f344ed190ab264649961441248e7202ffa1a7cd5311f2338759eace0b07bb
Instruction ID: 472407bc804b39a36c6b3fb36ce73068e11b14a7b9f8e8fe316f1439d626dbf8
Opcode Fuzzy Hash: 218f344ed190ab264649961441248e7202ffa1a7cd5311f2338759eace0b07bb
Instruction Fuzzy Hash: 2721833A9C2325ABC3215F16AC09BF66D90EB11F94F17D121EE40F72A1D7609C448BF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0785 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00DD07B5
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00DD07CD
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00DD07D2
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00DD07D5
GetLastError.KERNEL32(?,?), ref: 00DD07DF
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00DD084E
GetLastError.KERNEL32(?,?), ref: 00DD085B

Strings

Failed to add virtual file pointer for cab container., xrefs: 00DD0834
<the>.cab, xrefs: 00DD07AE
Failed to open cabinet file: %hs, xrefs: 00DD088C
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0803, 00DD087F
Failed to duplicate handle to cab container., xrefs: 00DD080D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 3030546534-4070612573
Opcode ID: 6fdb7ccef2ded6627cb98a005d49c40e373ec1bb45d8833ce2237ea6c0f086ee
Instruction ID: 19fca6bc50bc1129657547d44173869fc08b2a217b30a5dd1a99b0e29ea80788
Opcode Fuzzy Hash: 6fdb7ccef2ded6627cb98a005d49c40e373ec1bb45d8833ce2237ea6c0f086ee
Instruction Fuzzy Hash: DF31CF76941739BBD7216B54DC09F9B7E68EF447B0F054122F905BB390D7209D00A6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6A45 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00DB4E8D,?,?), ref: 00DC6A65
GetCurrentProcess.KERNEL32(?,00000000,?,?,00DB4E8D,?,?), ref: 00DC6A6B
DuplicateHandle.KERNELBASE(00000000,?,?,00DB4E8D,?,?), ref: 00DC6A6E
GetLastError.KERNEL32(?,?,00DB4E8D,?,?), ref: 00DC6A78
CloseHandle.KERNEL32(000000FF,?,00DB4E8D,?,?), ref: 00DC6AF1

Strings

Failed to append the file handle to the command line., xrefs: 00DC6AD9
c:\agent\_work\138\s\src\burn\user\core.cpp, xrefs: 00DC6A9C
burn.filehandle.attached, xrefs: 00DC6ABE
Failed to duplicate file handle for attached container., xrefs: 00DC6AA6
%ls -%ls=%u, xrefs: 00DC6AC5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$c:\agent\_work\138\s\src\burn\user\core.cpp
API String ID: 4224961946-4194950708
Opcode ID: 7584e6b360a996a231dbd7f4340673d6d9ee632de1affe2901468d246170c055
Instruction ID: 7bd8af88246a0e079c8cf252c78c383a68be6549c3627903732e21ba817e6db4
Opcode Fuzzy Hash: 7584e6b360a996a231dbd7f4340673d6d9ee632de1affe2901468d246170c055
Instruction Fuzzy Hash: 5A117232A40726BBCB109BA48D09F9FBA689F05770F218216F921F72D0D770DE009AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0C8F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,00DB5435,00000000,?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0CAD
GetLastError.KERNEL32(?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0CB7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0CE9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0D02
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00DC7696,00000000), ref: 00DF0D41

Strings

c:\agent\_work\138\s\src\libs\dutil\procutil.cpp, xrefs: 00DF0D2F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\138\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-1241729511
Opcode ID: c23f4c35f55c719c3505f196e9613cd5929cdce50926a96b1aa4d90ad9012402
Instruction ID: 10800851588fa400a9b52a86ca952725bf59b78243ec33d7f99f47dd369618ba
Opcode Fuzzy Hash: c23f4c35f55c719c3505f196e9613cd5929cdce50926a96b1aa4d90ad9012402
Instruction Fuzzy Hash: DA218376D01229EBC7218B958C05ABEFEA8AF00760F16C156AE55FB251D7309E40D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6AFF Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00DC6B33
CloseHandle.KERNEL32(00000000), ref: 00DC6BA3

Strings

Failed to append the file handle to the obfuscated command line., xrefs: 00DC6B91
Failed to append the file handle to the command line., xrefs: 00DC6B5F
%ls -%ls=%u, xrefs: 00DC6B4B, 00DC6B7D
burn.filehandle.self, xrefs: 00DC6B44, 00DC6B76

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 6220d6997ec7f3a13204b5266f1f7edc4570669076448e82f524a73603634bc9
Instruction ID: 2ffdb31a2c6cb25a1343860716f64796c5b32ea6d34f4a1e6c44ff5d96ff855c
Opcode Fuzzy Hash: 6220d6997ec7f3a13204b5266f1f7edc4570669076448e82f524a73603634bc9
Instruction Fuzzy Hash: 3511E632640715BBDB216B58CC45F6F7A799B41B30F118206F921F72D1D770C9118BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4EA2 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00DF4ED3
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00DF4F00
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00DF4F2C
GetLastError.KERNEL32(00000000,00DFB7FC,?,00000000,?,00000000,?,00000000), ref: 00DF4F6A
GlobalFree.KERNEL32(00000000), ref: 00DF4F9B

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF4EEE, 00DF4F47

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-3168567549
Opcode ID: 784ea44bbfae14eb10cb06c235dc0f068f58a1a5f3ef5ddadbfd42f3cc541641
Instruction ID: ec741ae34f235899d98e4f9857ee21f0bee582170737bc25f3ce7655f1585d25
Opcode Fuzzy Hash: 784ea44bbfae14eb10cb06c235dc0f068f58a1a5f3ef5ddadbfd42f3cc541641
Instruction Fuzzy Hash: AE316F3694022DABC7119A998C41EBFBAB9AF44760F12C156BE59EB241E630DD0096F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0940 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00DD09E6
GetLastError.KERNEL32(?,?,?), ref: 00DD09F0

Strings

Failed to move file pointer 0x%x bytes., xrefs: 00DD0A21
Invalid seek type., xrefs: 00DD097C
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0A14

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2976181284-4208998094
Opcode ID: ea3b09eb0be5f1c9d7d6c56ec6dc6baa52e90a2958ae742f64cedf918f5d8e8f
Instruction ID: e3016d0e1c8b7ec8f413f0e7e9703a71cba850fd5c5af7933aa58bf9b84d2e0d
Opcode Fuzzy Hash: ea3b09eb0be5f1c9d7d6c56ec6dc6baa52e90a2958ae742f64cedf918f5d8e8f
Instruction Fuzzy Hash: 63316E75A4021AEFDB10CFA8D885EADBBA8FF44764B088216F914A7751D770ED10CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB419A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?), ref: 00DB41A8
GetLastError.KERNEL32(?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?,00000000,00000000), ref: 00DB41B6
CreateDirectoryW.KERNEL32(?,840F01E8,00DB5501,?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?,00000000), ref: 00DB4226
GetLastError.KERNEL32(?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?,00000000,00000000), ref: 00DB4230

Strings

c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp, xrefs: 00DB4260

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-215211224
Opcode ID: ca316059c58ef7606e762670488e2af9b1e2a7a62c4a3932e98ed30c747c3f28
Instruction ID: e409167fd669f743f883262223a849f4f1bbd163cbf2fe93c4d3368c30c6b00b
Opcode Fuzzy Hash: ca316059c58ef7606e762670488e2af9b1e2a7a62c4a3932e98ed30c747c3f28
Instruction Fuzzy Hash: 2421D736A44331D7DB219AA98C44BBBB654EFA5BB0F198121FD46EB142D6608C41A2F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0EA4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00DB4F98,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00DF0EB0
GetLastError.KERNEL32(?,00DB4F98,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DF0EBE
GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 00DF0F03
GetLastError.KERNEL32(?,00DB4F98,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DF0F0D

Strings

c:\agent\_work\138\s\src\libs\dutil\procutil.cpp, xrefs: 00DF0EE2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: c:\agent\_work\138\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-1241729511
Opcode ID: f64492a861e16f7107a7b5981204e80b39293a7dce221e488b200d7f5f7fa913
Instruction ID: 361e4d74363fc02b1a147e77d20c89b8676e031074697559bc6f972ae39752b0
Opcode Fuzzy Hash: f64492a861e16f7107a7b5981204e80b39293a7dce221e488b200d7f5f7fa913
Instruction Fuzzy Hash: B4017C3694123DABD7304B549808ABABE54AF04770B13C522FF99EB242D6308C40C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF39DA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DF39E9
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00E1C7A0,00000001,00000000,00DB536B,?,?,?,?,?,?), ref: 00DF3A21
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00E1C7A0,?,?,?,?,?,?), ref: 00DF3A2D

Strings

MSXML.DOMDocument, xrefs: 00DF3A28
Msxml2.DOMDocument, xrefs: 00DF3A1C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FromProg$Initialize
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 4047641309-2356320334
Opcode ID: 9adc72ebf3e6b2ac2c96f5a9b8cbe7b56750222011d5fe696e2f55af9b53112b
Instruction ID: 22ee1a247abd44bde967ebdbca9010f651b069d0549878dc2ddeb9d771fb3bfc
Opcode Fuzzy Hash: 9adc72ebf3e6b2ac2c96f5a9b8cbe7b56750222011d5fe696e2f55af9b53112b
Instruction Fuzzy Hash: 3DF0A7317883755FD3104B77EC04B7639A4D741B60B2B9027E785E1194D390D9C28AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD08AB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD12C5: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00DD08DA,?,?,?), ref: 00DD12ED
Part of subcall function 00DD12C5: GetLastError.KERNEL32(?,00DD08DA,?,?,?), ref: 00DD12F7

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00DD08E8
GetLastError.KERNEL32 ref: 00DD08F2

Strings

c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0916
Failed to read during cabinet extraction., xrefs: 00DD0920

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2170121939-2593745101
Opcode ID: 8640ba8a0ae486f7b999966b6a740d2b474969944292baf83d2e5702ef218b02
Instruction ID: 92b4262e6673268b8589ccdbf8fcc4df7b961b8ac08a6c30e3c550f5d06a9258
Opcode Fuzzy Hash: 8640ba8a0ae486f7b999966b6a740d2b474969944292baf83d2e5702ef218b02
Instruction Fuzzy Hash: 2B01CE76A0122AEBCB209FA5DC05E9A7FA8EF44764F054116FE04E7281D730D900CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD12C5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00DD08DA,?,?,?), ref: 00DD12ED
GetLastError.KERNEL32(?,00DD08DA,?,?,?), ref: 00DD12F7

Strings

Failed to move to virtual file pointer., xrefs: 00DD1325
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD131B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2976181284-2495663704
Opcode ID: 2de1fbf5069e8a10a7faa39ada70aae12e657cc1acf316ae76ff08fc66aeaa0b
Instruction ID: 8400ecaf567fb8190a7be76a003026da6c65bcd8119db3ff811aa3aedfd45aba
Opcode Fuzzy Hash: 2de1fbf5069e8a10a7faa39ada70aae12e657cc1acf316ae76ff08fc66aeaa0b
Instruction Fuzzy Hash: 73018F3A54173AB7C7211B969C05A9BBF14EF417B1705C127FD28AA650DB22DC2086F8

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00DF43B8
GetLastError.KERNEL32 ref: 00DF441B

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF443F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-3168567549
Opcode ID: 73feed502c08fa9e9dcbb81b9defc4261f10af7a383ec0503d722df5e65ff640
Instruction ID: 4f4a66bb0d38ebb89e6d3be8648e7f5f32db40b7ebca4d7988b99d37a0428df8
Opcode Fuzzy Hash: 73feed502c08fa9e9dcbb81b9defc4261f10af7a383ec0503d722df5e65ff640
Instruction Fuzzy Hash: 5D319D31A0026D9BDB21CF59D8407FB77B4BB44751F06C0A6AA89E7240D7B09EC49AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB519B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00DB1104,?,?,00000000), ref: 00DB51BA
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00DB1104,?,?,00000000), ref: 00DB51EA

Strings

burn.clean.room, xrefs: 00DB51A7, 00DB51B4, 00DB51E1

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: ae1970389471113542bc49586dd1684be7e68053d0bbf4baf51c4a527276eedc
Instruction ID: 2288c5d4ad36ff9f14e1ae209d86cea963883a58b35fdc21e0ecf317a4051ac8
Opcode Fuzzy Hash: ae1970389471113542bc49586dd1684be7e68053d0bbf4baf51c4a527276eedc
Instruction Fuzzy Hash: E9018672505724AA87204F5DFC85FF3BBBCEB197A0758811BF916D7618D360AC50C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF5269 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00DF43DF,?,?,?), ref: 00DF528D
GetLastError.KERNEL32(?,?,00DF43DF,?,?,?), ref: 00DF5297

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF52C0

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-3168567549
Opcode ID: ed82d12a1e71dfbee2e3ef16e55d4a28b820ebf19b2020c738064fd461f7224b
Instruction ID: 6eb4c32c20ae529002d6577b1eaa401f43becfa1bf8a656308d8bb2919d14f38
Opcode Fuzzy Hash: ed82d12a1e71dfbee2e3ef16e55d4a28b820ebf19b2020c738064fd461f7224b
Instruction Fuzzy Hash: 72F08133A01629FBC7118E99EC45EAFBB6DFB45761B028212FA05E7144D770ED0086F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB34EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DB10DD,?,00000000), ref: 00DB3510
GetLastError.KERNEL32(?,?,?,?,00DB10DD,?,00000000), ref: 00DB3527

Strings

c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp, xrefs: 00DB354B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-537661423
Opcode ID: 5e9d3104c7c4c6ca3cef623c5f238180422b1442408ed092396e7258d541198e
Instruction ID: d4f7168636796b73beec7282f2a17fcee0affac01180435e09cf6cbed1ecdca5
Opcode Fuzzy Hash: 5e9d3104c7c4c6ca3cef623c5f238180422b1442408ed092396e7258d541198e
Instruction Fuzzy Hash: 7DF0C273900734E7C73156599C48EDBAADC9F41B70B1A4522FE47EB210DA20DD00A6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4D47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00DC8758,00000000,00000000,00000000,00000000,00000000), ref: 00DF4D5F
GetLastError.KERNEL32(?,?,?,00DC8758,00000000,00000000,00000000,00000000,00000000), ref: 00DF4D69

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF4D8D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-3168567549
Opcode ID: 843cb92f4ccca94bc4cc7e12245662e8a4c0e602d8f8085872d0494d1934a711
Instruction ID: fe6701c3b626b9cafe7cc974ac5d77e3ceb609dd32a39c2391a5522da94bf6bb
Opcode Fuzzy Hash: 843cb92f4ccca94bc4cc7e12245662e8a4c0e602d8f8085872d0494d1934a711
Instruction Fuzzy Hash: 17F08176A0122DAB9B218F44CC05DBB7E78EF047A0B06C055BE05AB251D630DD10D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB390C Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DB394B
GetLastError.KERNEL32 ref: 00DB3955
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00DB39BE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 66c214509417135f039d1b839497d822869bfb7103df868420924d6f37fe86c9
Instruction ID: d89fcf27065b4c50606d1cdb6ff081ec0b3b2fb0c154f48643dafbba681cd613
Opcode Fuzzy Hash: 66c214509417135f039d1b839497d822869bfb7103df868420924d6f37fe86c9
Instruction Fuzzy Hash: A221F5B6D01339EBCF20AB649C45FEA7768AB04720F154162BD56E7241DA70DF449BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF1436 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF1487

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3069916640
Opcode ID: 12e4e997a7912d9951160990d54ee42fa355279150557b80979dd9f3b8081413
Instruction ID: 6f447d854b5ec791b8cc34e882e3e946c1133182133884bda7cda435978f4b6b
Opcode Fuzzy Hash: 12e4e997a7912d9951160990d54ee42fa355279150557b80979dd9f3b8081413
Instruction Fuzzy Hash: 0FF0543AB40239E78B3119569C05BBB6E95DBC5BB0F1AC126BF49EB250D561CC109BF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3A1A Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 39c792e0bde9983dbac501e5201c45822e976df916cd5cd5a549ce4c107310d7
Instruction ID: 4ad692b836b9b8e5cfa7ff973b0fd7a00e28fb694fa84673fa089c41afbee1ac
Opcode Fuzzy Hash: 39c792e0bde9983dbac501e5201c45822e976df916cd5cd5a549ce4c107310d7
Instruction Fuzzy Hash: 09C0027259430DA78B005FF4DC0DC5A779CA758612704C511B515C6250D739E554D774

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3A38 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DF3A6D

Part of subcall function 00DF34D0: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00DF3A7E,00000000,?,00000000), ref: 00DF34EA
Part of subcall function 00DF34D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00DDBE27,?,00DB547D,?,00000000,?), ref: 00DF34F6

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 0c151dbaadd548d4dba040cfc954bd6ed94c390165cc06e7b8113145a7f7194e
Instruction ID: f2303d625ae81bf4f0d4ad8ccfad8eaa74d36538d5e78e29034860a009b73d92
Opcode Fuzzy Hash: 0c151dbaadd548d4dba040cfc954bd6ed94c390165cc06e7b8113145a7f7194e
Instruction Fuzzy Hash: 9F310175E006199FCB11DFA9C884AEEB7F4EF08710F06856AED15FB311D6749D048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF5C84 Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,00E1BB7C,00000000,80070490,?,?,00DC8AFB,WiX\Burn,PackageCache,00000000,00E1BB7C,00000000,00000000,80070490), ref: 00DF5CDE

Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00DF15E7
Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00DF161F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: cc80a0fe27e7c145bff75c323847a4401fca42ade1802c4f54745dfaf65900d3
Instruction ID: be48fe6959fb31c8c3be705fd0a98eea2df74b77948a65c63bfb3bc86d1298c4
Opcode Fuzzy Hash: cc80a0fe27e7c145bff75c323847a4401fca42ade1802c4f54745dfaf65900d3
Instruction Fuzzy Hash: 4611A336C00A2EEBCB216F95ED459BEBB64EB40760B2B8129EF52A7114D2314D50D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB35D3 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00DC8BB5,0000001C,80070490,00000000,00000000,80070490), ref: 00DB35F3

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: dcf17e8f90c88eb0bba23d45aeec198eccb82aee0044dcfb60a4aa66bdb243d2
Instruction ID: e7f97878b17e94acffb46bacd7608f5e362998c182320e1c979ae4072615f738
Opcode Fuzzy Hash: dcf17e8f90c88eb0bba23d45aeec198eccb82aee0044dcfb60a4aa66bdb243d2
Instruction Fuzzy Hash: E2E01272201228FBE7012A61AC01DFB7F9CDF053617104415FE42D6100D661DA1097B8

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3381 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,00DB55E6,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF338E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 525ab5fc4aa2690ca338de65fff2e659738f5b69a91069394dbba8f1a3c56331
Instruction ID: 32d7b69d9472b45e9245e7d3f13138c1be037fb428790b381f6e01e77227f84c
Opcode Fuzzy Hash: 525ab5fc4aa2690ca338de65fff2e659738f5b69a91069394dbba8f1a3c56331
Instruction Fuzzy Hash: ADE0F6B19A13289E96019F7AFD484917BE8F70DA50321D10BF601E22A0C7F044889FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DEF899 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DEF890

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b076ca83539f8376d9e530bc902cf70943ede4f0013c39d3ebf10796a473bde3
Instruction ID: e39cc9afd42bfb74c4a910c61e3e66f5cd205e037d63f64a2b5f5033fdb3ff7c
Opcode Fuzzy Hash: b076ca83539f8376d9e530bc902cf70943ede4f0013c39d3ebf10796a473bde3
Instruction Fuzzy Hash: B2B012F12581906C320862455F03D77014CC5C4F10330D42FF000D4181DE404D830031

Uniqueness

Uniqueness Score: -1.00%

Function 00DEF8A9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DEF890

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 21f784753f83f17c1f44d05b2b65f792f406a416d0c4715aa40af6451a436b60
Instruction ID: 933b917d6403437187407513ddb75a1c63cb334b144da5c9176df161455a8427
Opcode Fuzzy Hash: 21f784753f83f17c1f44d05b2b65f792f406a416d0c4715aa40af6451a436b60
Instruction Fuzzy Hash: B6B012F12582906C320862456E03D76014CC5C4F20330D52FF000D4181DA404DC24131

Uniqueness

Uniqueness Score: -1.00%

Function 00DEF878 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DEF890

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e64386917808b18534f4c9771cab228bbe42de5537c14d7da835412c8270b93
Instruction ID: a5cf2f7ee1a288b927534c0d60b96f9689658512caf93f3fda13625db5216cde
Opcode Fuzzy Hash: 5e64386917808b18534f4c9771cab228bbe42de5537c14d7da835412c8270b93
Instruction Fuzzy Hash: 69B012F12A81907C320822415E03C76014CC5D0F11330D53FF400E4081EA404D820031

Uniqueness

Uniqueness Score: -1.00%

Function 00DF99E5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DF99FD

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f9d0b9b4d13683fd2958bc57dd980a79ad2c62946bd3b9617168a52e2f662e8
Instruction ID: 49dda46782e45d56c256418de2914e49221e58813d33fc1fd8900478884bfbf1
Opcode Fuzzy Hash: 6f9d0b9b4d13683fd2958bc57dd980a79ad2c62946bd3b9617168a52e2f662e8
Instruction Fuzzy Hash: 5FB012E269824D7C320811401E97D76812CC5C0F10372E61FF105E0045ED804CC21432

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9A16 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DF99FD

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73d68537854c5b001bde0670a3bb5a423fb080696e0955d7a0ebbd219bf721d7
Instruction ID: 59bd157e8f0980122734f49f5d8b51db9b039c532c16f35cfd7e3a73a162d990
Opcode Fuzzy Hash: 73d68537854c5b001bde0670a3bb5a423fb080696e0955d7a0ebbd219bf721d7
Instruction Fuzzy Hash: 23B012E16583446C320851442F53E77815DC5C0F10372E61FF108D0145DD814C831432

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9A06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DF99FD

Part of subcall function 00DF9CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DF9D3E
Part of subcall function 00DF9CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DF9D4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55c2db9356aa213a5fd1e044a61c270b4e809524846f24c946874995c00f16be
Instruction ID: c89b7bbd6c01c33b1b14f29ae5f612044f0cadc05567a557c37672ec2fa18c01
Opcode Fuzzy Hash: 55c2db9356aa213a5fd1e044a61c270b4e809524846f24c946874995c00f16be
Instruction Fuzzy Hash: 8DB012E16681446C320851441E13E77815CC5C0F10372F71FF504D0149E9804C861432

Uniqueness

Uniqueness Score: -1.00%

Function 00DB14AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00DB22DC,?,00000000,?,00000000,?,00DB39E0,00000000,?,00000104), ref: 00DB14DC

Part of subcall function 00DB3C9A: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA2
Part of subcall function 00DB3C9A: HeapSize.KERNEL32(00000000,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 78f92df80ef4c0ef66f2ab6bdd079dcfa59931f9be6541e0cc5fc746d7d372f4
Instruction ID: 81067310bb1e76c97ea53e17d4cd7bfe6971463f720b83484cf6b7878bacbfec
Opcode Fuzzy Hash: 78f92df80ef4c0ef66f2ab6bdd079dcfa59931f9be6541e0cc5fc746d7d372f4
Instruction Fuzzy Hash: 2F01B13B100228FBCF225E65DC94FDA7BA9EF457A0F958121FE16AB191C670ED1096B0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DF1BB9 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00DF1C51
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1C5B
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00DF1CA8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1CAE
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00DF1CE8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1CEE
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00DF1D2E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1D34
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00DF1D74
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1D7A
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00DF1DBA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1DC0
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00DF1EB1
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00DF1EEB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1EF5
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00DF1F2D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1F37
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DF1F70
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF1F7A
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00DF1FB8
LocalFree.KERNEL32(?), ref: 00DF1FCE

Strings

c:\agent\_work\138\s\src\libs\dutil\srputil.cpp, xrefs: 00DF1C7C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\138\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-2057723657
Opcode ID: 421faaa734ac1ca7f9f002c152374bce0c5b31b52d962f2dddc8556df247e648
Instruction ID: ccbf457687d66cfe565858cf2a5f16fb3196681fa463db680db479018e6c3350
Opcode Fuzzy Hash: 421faaa734ac1ca7f9f002c152374bce0c5b31b52d962f2dddc8556df247e648
Instruction Fuzzy Hash: 7FC1247AD4123DEBD7208B959C48BEBFAB8AF45750F0145ABAA09F7240D7709D44CEB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDC132 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to copy local source path for pseudo bundle., xrefs: 00DDC23A
Failed to copy version for pseudo bundle., xrefs: 00DDC52C
Failed to copy repair arguments for related bundle package, xrefs: 00DDC3CF
Failed to append relation type to repair arguments for related bundle package, xrefs: 00DDC3F0
Failed to copy uninstall arguments for related bundle package, xrefs: 00DDC422
c:\agent\_work\138\s\src\burn\user\pseudobundle.cpp, xrefs: 00DDC178, 00DDC1B1, 00DDC2A0, 00DDC4D1
Failed to copy cache id for pseudo bundle., xrefs: 00DDC35E
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00DDC443
Failed to append relation type to install arguments for related bundle package, xrefs: 00DDC3A7
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00DDC184
Failed to copy filename for pseudo bundle., xrefs: 00DDC216
Failed to copy key for pseudo bundle., xrefs: 00DDC33F
Failed to allocate memory for dependency providers., xrefs: 00DDC4DD
-%ls, xrefs: 00DDC14F
Failed to copy display name for pseudo bundle., xrefs: 00DDC54E
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00DDC1BD
Failed to copy download source for pseudo bundle., xrefs: 00DDC268
Failed to copy install arguments for related bundle package, xrefs: 00DDC386
Failed to copy key for pseudo bundle payload., xrefs: 00DDC1F2
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00DDC2AC

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\138\s\src\burn\user\pseudobundle.cpp
API String ID: 1357844191-3972778097
Opcode ID: 1b6609dddcd43372dfd96e6d23bbaf17626ed89e4cb6fc8cd6e0241635351f18
Instruction ID: fd94c787b5fbc7512e931611a65ac39d042af08ec172ee0d4868fdabff71f608
Opcode Fuzzy Hash: 1b6609dddcd43372dfd96e6d23bbaf17626ed89e4cb6fc8cd6e0241635351f18
Instruction Fuzzy Hash: BFC1BF71A60716EBDB159F68C846AB676A8FF08710F04951AF816EB351DBB0EC40DBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4674 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00DB469D
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DB46A4
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DB46AE
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00DB46FE
GetLastError.KERNEL32 ref: 00DB4708
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00DB474C
GetLastError.KERNEL32 ref: 00DB4756
Sleep.KERNEL32(000003E8), ref: 00DB4792
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00DB47A3
GetLastError.KERNEL32 ref: 00DB47AD
CloseHandle.KERNEL32(?), ref: 00DB4803

Strings

c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB46D2, 00DB472C, 00DB477A, 00DB47E4
Failed to get shutdown privilege LUID., xrefs: 00DB4736
Failed to get process token., xrefs: 00DB46DC
Failed to adjust token to add shutdown privileges., xrefs: 00DB4784
SeShutdownPrivilege, xrefs: 00DB46F1
Failed to schedule restart., xrefs: 00DB47EE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 2241679041-3611283357
Opcode ID: 82725c839aad4cd0eb6a757ca5b714e3dfc52b47d7d93c0d2c8dcd14987df1fc
Instruction ID: 5a511c14cbad7d0f4de64e3144b942a8beab40b7be5a2bfaaa84b56f717d7615
Opcode Fuzzy Hash: 82725c839aad4cd0eb6a757ca5b714e3dfc52b47d7d93c0d2c8dcd14987df1fc
Instruction Fuzzy Hash: 3841EB76D50329EBD7209BA48C4ABFF7A58AF01760F068126BE02F7252DF608D04C5F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4F5A Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00DC4F88
GetLastError.KERNEL32(?,00000000,?,?,00DB45B7,?), ref: 00DC4F91
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,00DB45B7,?), ref: 00DC5033
GetLastError.KERNEL32(?,00DB45B7,?), ref: 00DC5040
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,00DB45B7), ref: 00DC50BB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00DB45B7,?), ref: 00DC50C6
CloseHandle.KERNEL32(00000000,c:\agent\_work\138\s\src\burn\user\pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,00DB45B7,?), ref: 00DC5106
LocalFree.KERNEL32(00000000,?,00DB45B7,?), ref: 00DC5134

Strings

Failed to allocate full name of pipe: %ls, xrefs: 00DC4FFF
\\.\pipe\%ls.Cache, xrefs: 00DC5087
Failed to create pipe: %ls, xrefs: 00DC5071, 00DC50F7
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC4FB5, 00DC5064, 00DC50EA
Failed to create the security descriptor for the connection event and pipe., xrefs: 00DC4FBF
\\.\pipe\%ls, xrefs: 00DC4FE9
Failed to allocate full name of cache pipe: %ls, xrefs: 00DC509D
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00DC4F83

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 1214480349-3091705230
Opcode ID: a6e78592350330e94a04dc9e999a01e5dc131a76915c35a18c77d9d204362e5c
Instruction ID: 862bee8229dacad17679ad4f28b0ce02931fc5371b44571ab1b1b3e99834a677
Opcode Fuzzy Hash: a6e78592350330e94a04dc9e999a01e5dc131a76915c35a18c77d9d204362e5c
Instruction Fuzzy Hash: 6251F5B2D40726FBDB219BA4DD46FAE7A64AF00760F114119FA10FB2C0E3755E80DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DEFE7F Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00DC9EE1,00000003,000007D0,00000003,?,000007D0,?,000007D0), ref: 00DEFEE4
GetLastError.KERNEL32 ref: 00DEFEEE
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 00DEFF2B
GetLastError.KERNEL32 ref: 00DEFF35
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00DEFF7C
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 00DEFFA0
GetLastError.KERNEL32 ref: 00DEFFAA
CryptDestroyHash.ADVAPI32(00000000), ref: 00DEFFE7
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00DEFFFE
GetLastError.KERNEL32 ref: 00DF0017
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00DF004F
GetLastError.KERNEL32 ref: 00DF0059
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 00DF0092
GetLastError.KERNEL32 ref: 00DF00A0

Strings

c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp, xrefs: 00DEFFCE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-2390292976
Opcode ID: a0245180427c37201f02ad270dcf0e01a67ed3f6c04f657e3350f92a412bb515
Instruction ID: e69043dde945ca167ba9596b705c4b56f5dc8fbca12bf6c33d77a7b14f8ac394
Opcode Fuzzy Hash: a0245180427c37201f02ad270dcf0e01a67ed3f6c04f657e3350f92a412bb515
Instruction Fuzzy Hash: 6051E936D40379ABD7319B55CC04BEB7A68AF05761F0680A6BE48FB280D7748D84DAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DC9E7B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

Failed to create unverified path., xrefs: 00DC9F4B
Failed to move verified file to complete payload path: %ls, xrefs: 00DCA049
Failed to get cached path for package with cache id: %ls, xrefs: 00DC9EA5
Failed to concat complete cached path., xrefs: 00DC9ED1
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00DC9FA8
moving, xrefs: 00DCA006
Failed to reset permissions on unverified cached payload: %ls, xrefs: 00DC9FCE
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00DC9F81
copying, xrefs: 00DCA00D, 00DCA015

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 993904d57e9e24aa66995e4b8e4b61f7ca0bf23d1271c05fbeee4266581b8d1c
Instruction ID: 0dc8a7e661ff1a4aa9516c43ed258237cd1e75893f36170c3fe3428a3a3ccb13
Opcode Fuzzy Hash: 993904d57e9e24aa66995e4b8e4b61f7ca0bf23d1271c05fbeee4266581b8d1c
Instruction Fuzzy Hash: 76516D3294021AFBDF226B94CC06FADBB75EF04744F154059FA00B61A1D7728AA0BBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB635B Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 00DB63A9
GetLastError.KERNEL32 ref: 00DB63B3

Strings

Failed to get OS info., xrefs: 00DB63E1
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB63D7
Failed to set variant value., xrefs: 00DB64D4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 305913169-505467846
Opcode ID: 848d5ee9800e46a15ad6c6bdbdbee94450fc891278bd16e6bdc3a496c0e58046
Instruction ID: e48604835a58fb07f33f6f106a476f5d9d93c2b83b56de146e29a047fc8b58dd
Opcode Fuzzy Hash: 848d5ee9800e46a15ad6c6bdbdbee94450fc891278bd16e6bdc3a496c0e58046
Instruction Fuzzy Hash: 6541E571A14228EBDB208F99DC45EEE7FB8DB85710F10409AF64AE7240DA34DE40CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF02DD Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00E1C6EC,00000000,?,?,?,?,00DD1188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00DF030B
GetCurrentProcessId.KERNEL32(00000000,?,00DD1188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00DF031B
GetCurrentThreadId.KERNEL32 ref: 00DF0324
GetLocalTime.KERNEL32(8007139F,?,00DD1188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00DF033A
LeaveCriticalSection.KERNEL32(00E1C6EC,00DD1188,?,00000000,0000FDE9,?,00DD1188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00DF0431

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00DF03D7
Xl, xrefs: 00DF036A
\l, xrefs: 00DF0387
Pl, xrefs: 00DF0378
Tl, xrefs: 00DF0371

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$Pl$Tl$Xl$\l
API String ID: 296830338-3034113958
Opcode ID: 535aa88120201e49c18e85ff6afea4b808e97021d50f8f9b3c8ce6087655843f
Instruction ID: 626a28c29220c5e036916f9f2fdc878e8ebb133ad560bc3bd97abdfdb46f4aa3
Opcode Fuzzy Hash: 535aa88120201e49c18e85ff6afea4b808e97021d50f8f9b3c8ce6087655843f
Instruction Fuzzy Hash: 36417B72A00219ABDB218FA5DC45AFEBBB8EB08711F15C126FA41F7291D7348D40CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC9B24 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00DC9BD3
lstrlenW.KERNEL32(?), ref: 00DC9BFA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DC9C5A
FindClose.KERNEL32(00000000), ref: 00DC9C65

Part of subcall function 00DB3D89: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DB3DE8
Part of subcall function 00DB3D89: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DB3DFB

Strings

.unverified, xrefs: 00DC9B67
*.*, xrefs: 00DC9BAD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: de6592aaf7a34b19b18b3bb25b26b44e66e75511c926f4067845a47cb70b2dfb
Instruction ID: 9e779e082af59ff227b57515abeccc1f54a13b8d1487a68f15e32d741b9652d8
Opcode Fuzzy Hash: de6592aaf7a34b19b18b3bb25b26b44e66e75511c926f4067845a47cb70b2dfb
Instruction Fuzzy Hash: 8741713180066DAACB21AB60DD5DFEAB7B8EF44315F1441A6E509E60A0EB709EC4DF34

Uniqueness

Uniqueness Score: -1.00%

Function 00DF8C56 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00DF8CAB
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00DF8CBD

Strings

feclient.dll, xrefs: 00DF8C85
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00DF8D08
crypt32.dll, xrefs: 00DF8C7B
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00DF8C94

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 35ca6e9568281cfc1fe20126f86518e0cdcbf1901e6f0d0e54a1988e42d72635
Instruction ID: d3ddbbabc67b3ee6019ba11f8e51beb180deecded5cb4d61ad3a5559d49cb13d
Opcode Fuzzy Hash: 35ca6e9568281cfc1fe20126f86518e0cdcbf1901e6f0d0e54a1988e42d72635
Instruction Fuzzy Hash: B9210CA2900128EEDB64DB99DC05EBFB3FDEB4CB11F008556B995E2180E7389A80D770

Uniqueness

Uniqueness Score: -1.00%

Function 00DB623E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00DB626E
GetLastError.KERNEL32 ref: 00DB6278

Strings

Failed to get the user name., xrefs: 00DB62A1
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6297
Failed to set variant value., xrefs: 00DB62BD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 2054405381-589247725
Opcode ID: fd73a45126b8083215eba2b5158a4a55e2e1e7c17454142e32beefb54271c30c
Instruction ID: cd4859d0d28a6d2bde856c8450d891191747bfd35a4cf14bcc067303cb9dcfb6
Opcode Fuzzy Hash: fd73a45126b8083215eba2b5158a4a55e2e1e7c17454142e32beefb54271c30c
Instruction Fuzzy Hash: 4501F932A40328ABD7109B549C05EFF77A8AF00721F018156F915F7281DF78DE4886F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB20A3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00DB4307,00DB5506,?,00000000,00000000,00000000,?,80070656,?,?,?,00DCE6CA,00000000,00DB5506,00000000,80070656), ref: 00DB20D4
GetLastError.KERNEL32(?,?,?,00DCE6CA,00000000,00DB5506,00000000,80070656,?,?,00DC412F,00DB5506,?,80070656,00000001,crypt32.dll), ref: 00DB20E1
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00DCE6CA,00000000,00DB5506,00000000,80070656,?,?,00DC412F,00DB5506), ref: 00DB2128

Strings

c:\agent\_work\138\s\src\libs\dutil\strutil.cpp, xrefs: 00DB2105

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\138\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-1498286024
Opcode ID: be00c0e5a86414bbe41c8243901fd519446b51fce65bb7c85a883b68722c8014
Instruction ID: 58d9eadfb695a8049bef060678baa8eac66e2090dde4ca2c2d30339b262d9bb3
Opcode Fuzzy Hash: be00c0e5a86414bbe41c8243901fd519446b51fce65bb7c85a883b68722c8014
Instruction Fuzzy Hash: DC0165B7940229FBDB109B94DC0AEEE7A6CEB04750F014165BD06E6240E6349E00D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD6A02 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00DD69AE,00000000,00000003), ref: 00DD6A19
GetLastError.KERNEL32(?,00DD69AE,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00DD6D9D,?), ref: 00DD6A23

Strings

Failed to set service start type., xrefs: 00DD6A51
c:\agent\_work\138\s\src\burn\user\msuuser.cpp, xrefs: 00DD6A47

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\138\s\src\burn\user\msuuser.cpp
API String ID: 1456623077-3939833892
Opcode ID: 717279d8977eb6d8a272647e2523b715eae6b6191e8cdb239ae9e3fe16c4e6f9
Instruction ID: 6b3f6a866dba6a071a0d126dd065d1a8d6a0a9de0f9b452cde4eea306c9817f0
Opcode Fuzzy Hash: 717279d8977eb6d8a272647e2523b715eae6b6191e8cdb239ae9e3fe16c4e6f9
Instruction Fuzzy Hash: 85F0A73764933573862126D59C05A9B7E08DF01BB07118312BE68F62D1DE118D0082F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3ED2 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF4061: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00DF3F01,?), ref: 00DF40D2

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00DF3F25
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00DF3F36

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 8f00d19301045622e277753cbfc529657ab104d6f8236eabb19708643457d563
Instruction ID: c70ee8ca8e78523002f32d2ea9d6faad956ab7ce57a300493d63335844d96782
Opcode Fuzzy Hash: 8f00d19301045622e277753cbfc529657ab104d6f8236eabb19708643457d563
Instruction Fuzzy Hash: 5011FA7190031EAFDB10DFA5CC85ABFB7B8FF08304F55846AA651E6151D7709A44CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00DE8581 Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc6b2dd824b08b2f17b87951fe2886d4bc0a590ba30c1ec50195a6cc8cb7c91
Instruction ID: 4b0fb9abcc88e90e4b8d41fa145f18896a45a892a41942782dfc2a734a1db930
Opcode Fuzzy Hash: 9cc6b2dd824b08b2f17b87951fe2886d4bc0a590ba30c1ec50195a6cc8cb7c91
Instruction Fuzzy Hash: D2E04632912268EBC725EA89898499AF3ACEB49B10B55459AF908D3201CA709E00D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC0022 Relevance: 86.2, APIs: 1, Strings: 48, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 00DC0618

Strings

Comments, xrefs: 00DC03C0, 00DC03D3
ParentDisplayName, xrefs: 00DC0378, 00DC038B
UninstallString, xrefs: 00DC050F, 00DC0525
DisplayVersion, xrefs: 00DC0287, 00DC029A
VersionMinor, xrefs: 00DC01BE, 00DC01C4
Failed to register the bundle dependency key., xrefs: 00DC05D9
Failed to update resume mode., xrefs: 00DC05F3
Failed to write software tags., xrefs: 00DC054B
Failed to write update registration., xrefs: 00DC056B
ModifyPath, xrefs: 00DC043B, 00DC0451
NoRemove, xrefs: 00DC0489, 00DC049C
BundleUpgradeCode, xrefs: 00DC00E0, 00DC00E8
NoModify, xrefs: 00DC0411, 00DC0424
/modify, xrefs: 00DC04FA
HelpTelephone, xrefs: 00DC0306, 00DC0319
BundleProviderKey, xrefs: 00DC01E0, 00DC01E5
Contact, xrefs: 00DC03E8, 00DC03FB
BundleCachePath, xrefs: 00DC00C5, 00DC00CA
%s,0, xrefs: 00DC0246
SystemComponent, xrefs: 00DC04AE, 00DC04C1
%hu.%hu.%hu.%hu, xrefs: 00DC0176
Failed to cache bundle from path: %ls, xrefs: 00DC0078
"%ls" %ls, xrefs: 00DC050A
ParentKeyName, xrefs: 00DC0398, 00DC03AB
VersionMajor, xrefs: 00DC0195, 00DC019B
BundleDetectCode, xrefs: 00DC011C, 00DC0124
NoElevateOnModify, xrefs: 00DC045D, 00DC0470
Failed to write %ls value., xrefs: 00DC05B7
EngineVersion, xrefs: 00DC0223, 00DC0228
URLInfoAbout, xrefs: 00DC032C, 00DC033F
/uninstall, xrefs: 00DC0501, 00DC0506
"%ls" /uninstall /quiet, xrefs: 00DC04CE
Publisher, xrefs: 00DC02BA, 00DC02CD
crypt32.dll, xrefs: 00DC0267, 00DC02A8, 00DC053F, 00DC055E
Failed to update name and publisher., xrefs: 00DC0274
EstimatedSize, xrefs: 00DC05A2, 00DC05A7, 00DC05B6
URLUpdateInfo, xrefs: 00DC0352, 00DC0365
%hs, xrefs: 00DC021E
HelpLink, xrefs: 00DC02E0, 00DC02F3
BundleTag, xrefs: 00DC0201, 00DC0206
BundlePatchCode, xrefs: 00DC013A, 00DC0142
BundleVersion, xrefs: 00DC0158, 00DC017B
3.14.0.5722, xrefs: 00DC0219
QuietUninstallString, xrefs: 00DC04D3, 00DC04E9
BundleAddonCode, xrefs: 00DC00FE, 00DC0106
DisplayIcon, xrefs: 00DC0241, 00DC024B
"%ls" /modify, xrefs: 00DC0436
Failed to create registration key., xrefs: 00DC00A5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.14.0.5722$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$userVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$crypt32.dll
API String ID: 3535843008-2557340968
Opcode ID: fb9cd441f531c50c23f28fd8f5625d35728a887f808e870737529a09e3dd8087
Instruction ID: bfc114e9f668aed722c601ecc5215c6ea031d88d0114225b0f5159c9111645f4
Opcode Fuzzy Hash: fb9cd441f531c50c23f28fd8f5625d35728a887f808e870737529a09e3dd8087
Instruction Fuzzy Hash: AFF1C031A4172BFBCB225A50CD02F7A7E64EB04750F155158FE40BB2A1D771EEA0AAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBCE67 Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00DB54D5,00000000,00DFCBA8,00DB54BD,00000000), ref: 00DBCF9D

Strings

Failed to get @LayoutOnly., xrefs: 00DBD23F
Invalid value for @Packaging: %ls, xrefs: 00DBD2A8
Failed to parse @FileSize., xrefs: 00DBD249
Failed to hex decode @CertificateRootThumbprint., xrefs: 00DBD268
Hash, xrefs: 00DBD161
c:\agent\_work\138\s\src\burn\user\payload.cpp, xrefs: 00DBCEE9
Catalog, xrefs: 00DBD196
Failed to get payload node count., xrefs: 00DBCEBA
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00DBD25A
Failed to select payload nodes., xrefs: 00DBCE95
Failed to get @Catalog., xrefs: 00DBD27D
CertificateRootPublicKeyIdentifier, xrefs: 00DBD0E7
FilePath, xrefs: 00DBCF55
FileSize, xrefs: 00DBD0AC
Failed to get @Packaging., xrefs: 00DBD2BB
Failed to get @SourcePath., xrefs: 00DBD299
Failed to get @Hash., xrefs: 00DBD28B
download, xrefs: 00DBCF8F
Container, xrefs: 00DBCFF5
Failed to get @DownloadUrl., xrefs: 00DBD292
Failed to get @FilePath., xrefs: 00DBD2C2
Payload, xrefs: 00DBCE82
Failed to hex decode the Payload/@Hash., xrefs: 00DBD284
Failed to get @Id., xrefs: 00DBD2C9
CertificateRootThumbprint, xrefs: 00DBD124
Failed to get @CertificateRootThumbprint., xrefs: 00DBD26F
Failed to allocate memory for payload structs., xrefs: 00DBCEF3
Failed to get @FileSize., xrefs: 00DBD253
embedded, xrefs: 00DBCFAF
SourcePath, xrefs: 00DBD05A
Failed to to find container: %ls, xrefs: 00DBD22E
Failed to find catalog., xrefs: 00DBD276
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00DBD261
Failed to get next node., xrefs: 00DBD2D0
DownloadUrl, xrefs: 00DBD083
Failed to get @Container., xrefs: 00DBD235
external, xrefs: 00DBCFCB
LayoutOnly, xrefs: 00DBD037
Packaging, xrefs: 00DBCF70

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\138\s\src\burn\user\payload.cpp$download$embedded$external
API String ID: 1171520630-1769029782
Opcode ID: c657f4179a5d10d087448c8211d37433086de2ce607e9c9b7c34b9e1c630fd9e
Instruction ID: 9b6a6beee5af477eff9366977be885bb2600772d358ec9a47939f4387bcf6221
Opcode Fuzzy Hash: c657f4179a5d10d087448c8211d37433086de2ce607e9c9b7c34b9e1c630fd9e
Instruction Fuzzy Hash: D3C1C472941629FFCB119B54CC45EFEBA66AF04760F168261FA02B7190E770EE0497B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8552 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DB54BD,?,00000000,80070490,?,?,?,?,?,?,?,?,00DDBFC1,?,00DB54BD,?), ref: 00DB8583
LeaveCriticalSection.KERNEL32(00DB54BD,?,?,?,?,?,?,?,?,00DDBFC1,?,00DB54BD,?,00DB54BD,00DB54BD,Chain), ref: 00DB88E6

Strings

Failed to get @Hidden., xrefs: 00DB88CA
string, xrefs: 00DB86D3
Failed to find variable value '%ls'., xrefs: 00DB88B4
numeric, xrefs: 00DB8698
Failed to set variant value., xrefs: 00DB8867
Failed to set variant encryption, xrefs: 00DB887F
Failed to change variant type., xrefs: 00DB88BC
version, xrefs: 00DB8708
Initializing numeric variable '%ls' to value '%ls', xrefs: 00DB86BE
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB889B
Persisted, xrefs: 00DB8626
Failed to get @Persisted., xrefs: 00DB88C3
Failed to insert variable '%ls'., xrefs: 00DB8878
Failed to get @Type., xrefs: 00DB8860
Initializing hidden variable '%ls', xrefs: 00DB874D
Type, xrefs: 00DB867F
Initializing version variable '%ls' to value '%ls', xrefs: 00DB872F
Failed to get @Id., xrefs: 00DB88D1
Initializing string variable '%ls' to value '%ls', xrefs: 00DB86F6
Hidden, xrefs: 00DB860B
Variable, xrefs: 00DB858D
Failed to get @Value., xrefs: 00DB886E
Value, xrefs: 00DB8641
Failed to select variable nodes., xrefs: 00DB85A0
Invalid value for @Type: %ls, xrefs: 00DB884D
Attempt to set built-in variable value: %ls, xrefs: 00DB88AA
Failed to set value of variable: %ls, xrefs: 00DB8889
Failed to get next node., xrefs: 00DB88D8
Failed to get variable node count., xrefs: 00DB85BD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\138\s\src\burn\user\variable.cpp$numeric$string$version
API String ID: 3168844106-1391453742
Opcode ID: d521a904717ff2fef9462efb98414bf10d095d3e9497b361f142118ac992089b
Instruction ID: 17e09427c2a16da4b53222852a36f17d6472cf2026d4b2100df68580344d1813
Opcode Fuzzy Hash: d521a904717ff2fef9462efb98414bf10d095d3e9497b361f142118ac992089b
Instruction Fuzzy Hash: B4B1C076D0021DFBCB119B94DD05EFEBA79EF44710F268265F612B6290CB709A50EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD6B41 Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00DCBDA0,00000007,?,?,?), ref: 00DD6B95

Part of subcall function 00DF0F42: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00DB5F1B,00000000), ref: 00DF0F57
Part of subcall function 00DF0F42: GetProcAddress.KERNEL32(00000000), ref: 00DF0F5E
Part of subcall function 00DF0F42: GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0F79

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00DD6F84
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00DD6F98

Strings

2, xrefs: 00DD6E28
Failed to determine WOW64 status., xrefs: 00DD6BA7
Failed to get action arguments for MSU package., xrefs: 00DD6C4B
Bootstrapper application aborted during MSU progress., xrefs: 00DD6EC9
Failed to find System32 directory., xrefs: 00DD6C0A
Failed to wait for executable to complete: %ls, xrefs: 00DD6F13
D, xrefs: 00DD6DB0
Failed to format MSU uninstall command., xrefs: 00DD6CFE
/log:, xrefs: 00DD6D17
Failed to ensure WU service was enabled to install MSU package., xrefs: 00DD6DA3
Failed to get cached path for package: %ls, xrefs: 00DD6C71
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00DD6CEA
Failed to format MSU install command., xrefs: 00DD6CD1
wusa.exe, xrefs: 00DD6C15
Failed to append log switch to MSU command-line., xrefs: 00DD6D2B
Failed to build MSU path., xrefs: 00DD6CAA
Failed to append SysNative directory., xrefs: 00DD6BF2
Failed to find Windows directory., xrefs: 00DD6BD4
Failed to append log path to MSU command-line., xrefs: 00DD6D49
Failed to get process exit code., xrefs: 00DD6EA1
SysNative\, xrefs: 00DD6BDF
Failed to allocate WUSA.exe path., xrefs: 00DD6C28
c:\agent\_work\138\s\src\burn\user\msuuser.cpp, xrefs: 00DD6E02, 00DD6E97, 00DD6EBF
Failed to CreateProcess on path: %ls, xrefs: 00DD6E0F
WixBundleExecutePackageCacheFolder, xrefs: 00DD6C80, 00DD6FB0
"%ls" "%ls" /quiet /norestart, xrefs: 00DD6CBD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\138\s\src\burn\user\msuuser.cpp$wusa.exe
API String ID: 1400713077-2496767321
Opcode ID: 018c7369f101cc3b6aca8d278bc105cad61b1c6a4717fff69e7417c661c9630e
Instruction ID: 1b0f727d4e03bbbd3442f58aad890dc4bcdce7b127609b5556deda2a7b63b21c
Opcode Fuzzy Hash: 018c7369f101cc3b6aca8d278bc105cad61b1c6a4717fff69e7417c661c9630e
Instruction Fuzzy Hash: 64D14D71A4431AEADF11AFE4DC85FAEBBB9EF08700F144026B601F6291D7B5D9449BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF7836 Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00DF7949
SysFreeString.OLEAUT32(00000000), ref: 00DF7B12
SysFreeString.OLEAUT32(00000000), ref: 00DF7BAF

Strings

title, xrefs: 00DF79D4
author, xrefs: 00DF7887, 00DF7A18
(, xrefs: 00DF7AED
updated, xrefs: 00DF79F0
entry, xrefs: 00DF78C1, 00DF7A8A
generator, xrefs: 00DF793C
link, xrefs: 00DF78DE, 00DF7AC0
@, xrefs: 00DF7AB8
icon, xrefs: 00DF7960
`Dv, xrefs: 00DF7B12, 00DF7BAF
logo, xrefs: 00DF799C
category, xrefs: 00DF78A4, 00DF7A51
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF7863, 00DF7B99
subtitle, xrefs: 00DF79B8

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`Dv$author$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-4073331146
Opcode ID: 449a3e50cae421b812d77734deec99fe2e05819a3a041386a9782a7456a72cb5
Instruction ID: ac6593df0446e562914069058753276ec08cefe1c27bcee6f534058c1145e4e1
Opcode Fuzzy Hash: 449a3e50cae421b812d77734deec99fe2e05819a3a041386a9782a7456a72cb5
Instruction Fuzzy Hash: CCB18D3190821ABBDB119BA4CC41FFD7674AF02720F268354F661BA1D1DB70EA50CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF74FB Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00E1750C,000000FF,?,?,?), ref: 00DF75C2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 00DF75E7
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00DF7607
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00DF7623
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00DF764B
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00DF7667
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 00DF76A0
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00DF76D9

Part of subcall function 00DF7144: SysFreeString.OLEAUT32(00000000), ref: 00DF727D
Part of subcall function 00DF7144: SysFreeString.OLEAUT32(00000000), ref: 00DF72BC

SysFreeString.OLEAUT32(00000000), ref: 00DF775D
SysFreeString.OLEAUT32(00000000), ref: 00DF780D

Strings

feclient.dll, xrefs: 00DF75F4
title, xrefs: 00DF75F9
author, xrefs: 00DF7526, 00DF7659
updated, xrefs: 00DF763D
cabinet.dll, xrefs: 00DF753E
content, xrefs: 00DF76CB
link, xrefs: 00DF7560, 00DF770B
published, xrefs: 00DF7615
`Dv, xrefs: 00DF775D, 00DF780D
(, xrefs: 00DF7738
category, xrefs: 00DF7543, 00DF7692
version.dll, xrefs: 00DF7521
clbcatq.dll, xrefs: 00DF7630
msi.dll, xrefs: 00DF7525
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF77FA
summary, xrefs: 00DF75D9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`Dv$author$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-1823527758
Opcode ID: 8b266f1da3148113abd552bba7250033895cf0115e3245ac79cc339dce3816b7
Instruction ID: e166c7746f0aae0436ab747b4ef27326536cab6fb79be32d290c8df9ddb1d84e
Opcode Fuzzy Hash: 8b266f1da3148113abd552bba7250033895cf0115e3245ac79cc339dce3816b7
Instruction Fuzzy Hash: BDA18C3194821ABBDB219BA4CC41FFDB674AF05720F268355F625AB2D0D770EA50DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD221 Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00DDD296
StringFromGUID2.OLE32(?,?,00000027), ref: 00DDD2BF
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 00DDD3A8
GetLastError.KERNEL32(?,?,?,?), ref: 00DDD3B2
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 00DDD44B
WaitForSingleObject.KERNEL32(00DFB4F0,000000FF,?,?,?,?), ref: 00DDD456
ReleaseMutex.KERNEL32(00DFB4F0,?,?,?,?), ref: 00DDD480
GetExitCodeProcess.KERNEL32(?,?), ref: 00DDD4A1
GetLastError.KERNEL32(?,?,?,?), ref: 00DDD4AF
GetLastError.KERNEL32(?,?,?,?), ref: 00DDD4E7

Part of subcall function 00DDD129: WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,00DDD425,?), ref: 00DDD148
Part of subcall function 00DDD129: ReleaseMutex.KERNEL32(?,?,?,00DDD425,?), ref: 00DDD15C
Part of subcall function 00DDD129: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DDD1A1
Part of subcall function 00DDD129: ReleaseMutex.KERNEL32(?), ref: 00DDD1B4
Part of subcall function 00DDD129: SetEvent.KERNEL32(?), ref: 00DDD1BD

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DDD590
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DDD5A8

Strings

Failed to process netfx chainer message., xrefs: 00DDD42B
NetFxSection.%ls, xrefs: 00DDD2EC
D, xrefs: 00DDD38D
Failed to allocate section name., xrefs: 00DDD300
%ls /pipe %ls, xrefs: 00DDD362
Failed to wait for netfx chainer process to complete, xrefs: 00DDD515
Failed to allocate event name., xrefs: 00DDD322
Failed to CreateProcess on path: %ls, xrefs: 00DDD3E1
Failed to allocate netfx chainer arguments., xrefs: 00DDD376
Failed to create netfx chainer guid., xrefs: 00DDD2A3
Failed to get netfx return code., xrefs: 00DDD4DD
c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp, xrefs: 00DDD2D4, 00DDD3D6, 00DDD4D3, 00DDD50B
Failed to convert netfx chainer guid into string., xrefs: 00DDD2DE
NetFxEvent.%ls, xrefs: 00DDD30E
Failed to create netfx chainer., xrefs: 00DDD341

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp
API String ID: 1533322865-2112840804
Opcode ID: 14d858b1a3bfbf4824fb41910a5c80fe08a4ca7b8652f3dd1fb14c8b78be975c
Instruction ID: cecd431605df6e223f6b8a721df965589a2c82e9ed192cf8f8c827f44114878a
Opcode Fuzzy Hash: 14d858b1a3bfbf4824fb41910a5c80fe08a4ca7b8652f3dd1fb14c8b78be975c
Instruction Fuzzy Hash: C6A18972940328ABDF219BA4CC45BAEBBB9AF04720F154166E909FB251D7709D80CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC554D Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,7694B390,?,00DB45B7,?,00DFB4F0), ref: 00DC556E
GetCurrentProcessId.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC5579
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC55B0
ConnectNamedPipe.KERNEL32(?,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC55C5
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC55CF
Sleep.KERNEL32(00000064,?,00DB45B7,?,00DFB4F0), ref: 00DC5604
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5627
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5642
WriteFile.KERNEL32(?,00DB45B7,00DFB4F0,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC565D
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5678
ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5693
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC56EE
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC5722
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC5756
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC578A
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC57BB
GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC57EC

Strings

Failed to write secret length to pipe., xrefs: 00DC57B4
Failed to read ACK from pipe., xrefs: 00DC5718
Failed to wait for child to connect to pipe., xrefs: 00DC56E4
Failed to write secret to pipe., xrefs: 00DC5780
crypt32.dll, xrefs: 00DC5640
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC56DA, 00DC570E, 00DC5742, 00DC5776, 00DC57AA, 00DC57DB, 00DC580C
Failed to write our process id to pipe., xrefs: 00DC574C
Failed to reset pipe to blocking., xrefs: 00DC57E5
Failed to set pipe to non-blocking., xrefs: 00DC5816

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\138\s\src\burn\user\pipe.cpp$crypt32.dll
API String ID: 2944378912-629510435
Opcode ID: 077e0fdf0c92df632d03470ee00c92709fde94a92eaec517a315b4227fecb7dd
Instruction ID: a446b183f987ae3b0db4d9c620286d48bb82368a2b3affd6106dc9cdc73cd37d
Opcode Fuzzy Hash: 077e0fdf0c92df632d03470ee00c92709fde94a92eaec517a315b4227fecb7dd
Instruction Fuzzy Hash: CD6108B7D80736E7D7209AA49D49FAE66A89F00B60F164529FE01FB1C0D774ED8086F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA4C5 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBA509
_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBA531
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 00DBA830

Strings

Failed to set variable., xrefs: 00DBA7F2
Failed to allocate string buffer., xrefs: 00DBA724
Failed to format key string., xrefs: 00DBA516
Failed to open registry key., xrefs: 00DBA5A4
Failed to allocate memory registry value., xrefs: 00DBA640
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00DBA5D3
Registry key not found. Key = '%ls', xrefs: 00DBA569
Failed to clear variable., xrefs: 00DBA58F
Failed to format value string., xrefs: 00DBA53E
Failed to query registry key value size., xrefs: 00DBA60D
c:\agent\_work\138\s\src\burn\user\search.cpp, xrefs: 00DBA601, 00DBA636, 00DBA689, 00DBA792
Failed to read registry value., xrefs: 00DBA7B9
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00DBA808
Failed to get expand environment string., xrefs: 00DBA79E
Failed to change value type., xrefs: 00DBA7D4, 00DBA7F7
Unsupported registry key value type. Type = '%u', xrefs: 00DBA6C3
Failed to query registry key value., xrefs: 00DBA695

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\138\s\src\burn\user\search.cpp
API String ID: 2348241696-920797553
Opcode ID: aa9caa784eb5ab7cb05a4bdb77b655d0fdc59956212eb18251b0c36fbb864a3c
Instruction ID: 502d8bc96114c4e73cf1304663ba7d12aee68d4bc5e6f9bac0f9a6f17514a914
Opcode Fuzzy Hash: aa9caa784eb5ab7cb05a4bdb77b655d0fdc59956212eb18251b0c36fbb864a3c
Instruction Fuzzy Hash: 94A19576D04229FBCF219A98C845AFE7BB9EB04710F158125FA06BB250DA31DE4097B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB57E2 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,00DBA97A,00000100,000002C0,000002C0,00000100), ref: 00DB5807
lstrlenW.KERNEL32(000002C0,?,00DBA97A,00000100,000002C0,000002C0,00000100), ref: 00DB5811
_wcschr.LIBVCRUNTIME ref: 00DB5A16
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,00DBA97A,00000100,000002C0,000002C0,00000100), ref: 00DB5CB9

Strings

Failed to allocate string., xrefs: 00DB5C30
Failed to allocate buffer for format string., xrefs: 00DB582F
Failed to determine variable visibility: '%ls'., xrefs: 00DB5AA9
Failed to append string., xrefs: 00DB588D
Failed to set variable value., xrefs: 00DB5AD0
[%d], xrefs: 00DB59D1
Failed to format record., xrefs: 00DB5C7D
Failed to copy string., xrefs: 00DB5C9D
Failed to append placeholder., xrefs: 00DB5ABC
Failed to reallocate variable array., xrefs: 00DB5A9B
Failed to get variable name., xrefs: 00DB5AFB
Failed to set record format string., xrefs: 00DB5B43
Failed to allocate record., xrefs: 00DB5A7A
Failed to format placeholder string., xrefs: 00DB5AC6
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB5A6D, 00DB5A8E, 00DB5AE7, 00DB5B39, 00DB5BC5, 00DB5BF7, 00DB5C73
Failed to allocate variable array., xrefs: 00DB5AF4
Failed to set record string., xrefs: 00DB5BCF
*****, xrefs: 00DB5988
Failed to get formatted length., xrefs: 00DB5C01

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 1026845265-2015882285
Opcode ID: ca78793c54138e81da127060b60d89ce686d091594aa352b47791777e7458475
Instruction ID: f4363e87add2396206ebb0528ab3f4915a1759e541f004815a8048d383e95ee4
Opcode Fuzzy Hash: ca78793c54138e81da127060b60d89ce686d091594aa352b47791777e7458475
Instruction Fuzzy Hash: 46F19276D00629EFDB109F649841FFF7BA9EB04B10F198129F906AB244DB749A019BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDCC70 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,00DDD33B,?,?,?), ref: 00DDCCB6
GetLastError.KERNEL32(?,?,00DDD33B,?,?,?), ref: 00DDCCC3
ReleaseMutex.KERNEL32(?), ref: 00DDCF2B

Strings

failed to copy event name to shared memory structure., xrefs: 00DDCE89
Failed to create mutex: %ls, xrefs: 00DDCDC5
%ls_mutex, xrefs: 00DDCD64
Failed to MapViewOfFile for %ls., xrefs: 00DDCE5F
%ls_send, xrefs: 00DDCCF5
Failed to allocate memory for NetFxChainer struct., xrefs: 00DDCC9C
Failed to memory map cabinet file: %ls, xrefs: 00DDCE17
c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp, xrefs: 00DDCC92, 00DDCCE4, 00DDCD49, 00DDCDB8, 00DDCE0A, 00DDCE52
Failed to create event: %ls, xrefs: 00DDCD56
failed to allocate memory for mutex name, xrefs: 00DDCD78
failed to allocate memory for event name, xrefs: 00DDCD09

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-3103995003
Opcode ID: 287dae9fce60d02e009f2ab740036e9491135d190e56ca5c60c6421cc83fdeea
Instruction ID: 661aa333b22aa8ea8ba6f544ec8a52c82c978b618274fcc65b0857b693310acf
Opcode Fuzzy Hash: 287dae9fce60d02e009f2ab740036e9491135d190e56ca5c60c6421cc83fdeea
Instruction Fuzzy Hash: 6981F1B6A91722BBC3218B648C09F9ABEA4AF05760F058162FD09FB351D770DD80D6F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DBEAE9 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00DF3770: VariantInit.OLEAUT32(?), ref: 00DF3786
Part of subcall function 00DF3770: SysAllocString.OLEAUT32(?), ref: 00DF37A2
Part of subcall function 00DF3770: VariantClear.OLEAUT32(?), ref: 00DF3829
Part of subcall function 00DF3770: SysFreeString.OLEAUT32(00000000), ref: 00DF3834

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,00DFCBA8,?,?,Action,?,?,?,00000000,00DB54BD), ref: 00DBEBBA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 00DBEC04

Strings

Failed to get @Action., xrefs: 00DBED10
Failed to resize Detect code array in registration, xrefs: 00DBECD5
Failed to get @Id., xrefs: 00DBED09
Failed to resize Addon code array in registration, xrefs: 00DBECE3
cabinet.dll, xrefs: 00DBEC61
Failed to get RelatedBundle element count., xrefs: 00DBEB3E
Addon, xrefs: 00DBEC41
Invalid value for @Action: %ls, xrefs: 00DBECF9
Patch, xrefs: 00DBEC84
Failed to resize Upgrade code array in registration, xrefs: 00DBECDC
Action, xrefs: 00DBEB77
RelatedBundle, xrefs: 00DBEAF7
Failed to resize Patch code array in registration, xrefs: 00DBECEA
version.dll, xrefs: 00DBEC17
comres.dll, xrefs: 00DBEBCD
Failed to get next RelatedBundle element., xrefs: 00DBED17
Failed to get RelatedBundle nodes, xrefs: 00DBEB19
Upgrade, xrefs: 00DBEBF7
Detect, xrefs: 00DBEBAB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: f06392de4f5a648ed3e26cbad46a772f6f2eb9260ff3164d8f231300d50700d5
Instruction ID: 6e9e6faa6033275345984be67a04bb4c200914aae4f054dbcc7fd3639296fbe6
Opcode Fuzzy Hash: f06392de4f5a648ed3e26cbad46a772f6f2eb9260ff3164d8f231300d50700d5
Instruction Fuzzy Hash: 58718C71A4562AFBCB149A54C845EEABBB4FF04720F214258EA12B72C1C770EE51DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4755 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00DC4C68,00DFB4D8,?,feclient.dll,00000000,?,?), ref: 00DC476C
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00DC4C68,00DFB4D8,?,feclient.dll,00000000,?,?), ref: 00DC478D
GetLastError.KERNEL32(?,00DC4C68,00DFB4D8,?,feclient.dll,00000000,?,?), ref: 00DC4793
ReadFile.KERNEL32(feclient.dll,00000000,00DFB508,?,00000000,00000000,00DFB509,?,00DC4C68,00DFB4D8,?,feclient.dll,00000000,?,?), ref: 00DC4821
GetLastError.KERNEL32(?,00DC4C68,00DFB4D8,?,feclient.dll,00000000,?,?), ref: 00DC4827

Strings

Failed to read verification secret from parent pipe., xrefs: 00DC4855
feclient.dll, xrefs: 00DC475B, 00DC478B, 00DC478C, 00DC4820, 00DC48A5, 00DC48FB
Failed to read size of verification secret from parent pipe., xrefs: 00DC47C1
msasn1.dll, xrefs: 00DC48A4
Verification secret from parent is too big., xrefs: 00DC47EE
Failed to inform parent process that child is running., xrefs: 00DC4934
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC47B7, 00DC47E2, 00DC484B, 00DC4883, 00DC48D0, 00DC492A, 00DC4968
Verification secret from parent does not match., xrefs: 00DC488F
Failed to read verification process id from parent pipe., xrefs: 00DC48DA
Verification process id from parent does not match., xrefs: 00DC4974
Failed to allocate buffer for verification secret., xrefs: 00DC480A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\138\s\src\burn\user\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-1453137465
Opcode ID: dccc81b9ea59f6951517e7968b94694883ef549d5a75b05f69483f6a7ac8e726
Instruction ID: 4de1d9a4e91846da397d6445f5f410ddba93655b1d4a009519525865b9cbd95f
Opcode Fuzzy Hash: dccc81b9ea59f6951517e7968b94694883ef549d5a75b05f69483f6a7ac8e726
Instruction Fuzzy Hash: 8E51A3B6D40326F7D7219A948D96FBF7668AF01B20F15411AFA11FB2C0DB709D009AF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD26AA Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Failed to parse exit codes., xrefs: 00DD27BA
UninstallArguments, xrefs: 00DD2706
netfx4, xrefs: 00DD27C3
Failed to get @Repairable., xrefs: 00DD2763
DetectCondition, xrefs: 00DD26C2
Failed to parse command lines., xrefs: 00DD2836
burn, xrefs: 00DD278E
InstallArguments, xrefs: 00DD26E4
Protocol, xrefs: 00DD2771
Repairable, xrefs: 00DD274A
Failed to get @Protocol., xrefs: 00DD2822
Failed to get @InstallArguments., xrefs: 00DD26F5
Invalid protocol type: %ls, xrefs: 00DD280A
RepairArguments, xrefs: 00DD2728
Failed to get @DetectCondition., xrefs: 00DD26D3
none, xrefs: 00DD27E4
Failed to get @RepairArguments., xrefs: 00DD2739
Failed to get @UninstallArguments., xrefs: 00DD2717

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: 32cbbe9c798a78d0b3098707345a97714e29fb10ec0f22b874b588786051204e
Instruction ID: 52ac5353cc2269386fb30db079c93589c33d277991fad88ae80c59bd51dc6911
Opcode Fuzzy Hash: 32cbbe9c798a78d0b3098707345a97714e29fb10ec0f22b874b588786051204e
Instruction Fuzzy Hash: EA41C672A84726B6D72162648C42F7A6658EB24B30F315323F924F73D2D7A4EE4096F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9030 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,5600DFDC,00000001,?,00DB99FC,?,00000000,00000000,?,?,00DB99E4,?,?,00000000,?), ref: 00DB906E

Strings

AND, xrefs: 00DB937A
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00DB9300
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00DB94C6
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00DB943E
-, xrefs: 00DB91D6
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00DB9482
Failed to set symbol value., xrefs: 00DB911E
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00DB9220
NOT, xrefs: 00DB9399
c:\agent\_work\138\s\src\burn\user\condition.cpp, xrefs: 00DB9142, 00DB920C, 00DB9288, 00DB92EC, 00DB942A, 00DB946E, 00DB94B2
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00DB9156
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00DB929C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\138\s\src\burn\user\condition.cpp
API String ID: 4177115715-1912921257
Opcode ID: 64f92956e6df3f72534ff93f963a763fd7dc073b2d0efeebc02da6dd50e8643f
Instruction ID: 720e0990ad5a51be0d9a133ca95d31b45dd7700d9c2a3e46cfc52b88bf672837
Opcode Fuzzy Hash: 64f92956e6df3f72534ff93f963a763fd7dc073b2d0efeebc02da6dd50e8643f
Instruction Fuzzy Hash: 66F1E071640345EBDB258F64C8A9BFABBA4FB04300F148506FB479A285C3B5DA91DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1A65 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00DD1B6C
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00DD1B8A

Strings

Type, xrefs: 00DD1B44
Invalid exit code type: %ls, xrefs: 00DD1C5B
scheduleReboot, xrefs: 00DD1B99
Code, xrefs: 00DD1BD9
forceReboot, xrefs: 00DD1BB7
Failed to get exit code node count., xrefs: 00DD1AB7
ExitCode, xrefs: 00DD1A73
Failed to allocate memory for exit code structs., xrefs: 00DD1AF7
success, xrefs: 00DD1B5D
error, xrefs: 00DD1B7D
c:\agent\_work\138\s\src\burn\user\exeuser.cpp, xrefs: 00DD1AED
Failed to get next node., xrefs: 00DD1C72
Failed to get @Code., xrefs: 00DD1C4C
Failed to select exit code nodes., xrefs: 00DD1A92
Failed to parse @Code value: %ls, xrefs: 00DD1C45
Failed to get @Type., xrefs: 00DD1C6B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\138\s\src\burn\user\exeuser.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-823451179
Opcode ID: 2655ba0aa9937b32af600b9371698f802639542d56ba461db15c5ad0813037eb
Instruction ID: 63002538e298f305a075cb48406cf96584614b3824efbfc12f0dd049c2dfaeb6
Opcode Fuzzy Hash: 2655ba0aa9937b32af600b9371698f802639542d56ba461db15c5ad0813037eb
Instruction Fuzzy Hash: 9161B079A4421ABBCB109B58CC45EAEBBB4EF41720F214256E925BB3D1DB70DA40DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6BB2 Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00DBD552: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00DC7027,000000B8,00000000,?,00000000,7694B390), ref: 00DBD561
Part of subcall function 00DBD552: LeaveCriticalSection.KERNEL32(000000D0,?,00DC7027,000000B8,00000000,?,00000000,7694B390), ref: 00DBD584

ReleaseMutex.KERNEL32(00000000,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00DC6F76
CloseHandle.KERNEL32(00000000), ref: 00DC6F7F
CloseHandle.KERNEL32(?,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00DC6F9F

Part of subcall function 00DDBB0B: SetThreadExecutionState.KERNEL32(80000001), ref: 00DDBB10

Strings

Failed to cache user to working directory., xrefs: 00DC6D58
user cannot start apply because it is busy with another action., xrefs: 00DC6C13
Another per-user setup is already executing., xrefs: 00DC6CC4
UX aborted apply begin., xrefs: 00DC6C84
c:\agent\_work\138\s\src\burn\user\core.cpp, xrefs: 00DC6C7A, 00DC6E4B
Another per-machine setup is already executing., xrefs: 00DC6DB8
crypt32.dll, xrefs: 00DC6CB6
Failed to set initial apply variables., xrefs: 00DC6CEE
Failed while caching, aborting execution., xrefs: 00DC6E7D
Failed to elevate., xrefs: 00DC6D7E
Failed to register bundle., xrefs: 00DC6DDB
comres.dll, xrefs: 00DC6FC5
Failed to create cache thread., xrefs: 00DC6E55

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterExecutionLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$user cannot start apply because it is busy with another action.$Failed to cache user to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\138\s\src\burn\user\core.cpp$comres.dll$crypt32.dll
API String ID: 303827279-252372456
Opcode ID: 0efb117e41244a6afc82e6ee4830da64418aee204e919b87f9b27275ecd67a61
Instruction ID: 893821ee9e70b67bd5bacc29bbbee16ace136e2be1aed98aab45f2abf83365a7
Opcode Fuzzy Hash: 0efb117e41244a6afc82e6ee4830da64418aee204e919b87f9b27275ecd67a61
Instruction Fuzzy Hash: A7C15D72901216EADF159F64D885FEE7AA8EF04315F08417EFD0AAB245DB30D944CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF7BE1 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00DF7C41
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00DF7C66
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00DF7C86
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00DF7CB9
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00DF7CD5
SysFreeString.OLEAUT32(00000000), ref: 00DF7D00
SysFreeString.OLEAUT32(00000000), ref: 00DF7D77
SysFreeString.OLEAUT32(00000000), ref: 00DF7DC3

Strings

feclient.dll, xrefs: 00DF7C73
title, xrefs: 00DF7CAB
length, xrefs: 00DF7C78
msasn1.dll, xrefs: 00DF7DB1
`Dv, xrefs: 00DF7D00, 00DF7D77, 00DF7DC3
href, xrefs: 00DF7C58
version.dll, xrefs: 00DF7CE4
comres.dll, xrefs: 00DF7C90
msi.dll, xrefs: 00DF7D5F
rel, xrefs: 00DF7C34
type, xrefs: 00DF7CC7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$Compare$Free
String ID: `Dv$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-1313079583
Opcode ID: 29e879f2820f2fabcbdd7085b1d7a2c80648056cc6f0ed949c93251b5fad8270
Instruction ID: 098c6ccbd3d26ca5915d378374b3584a8ff245cc1a036394528b71a5d55284b6
Opcode Fuzzy Hash: 29e879f2820f2fabcbdd7085b1d7a2c80648056cc6f0ed949c93251b5fad8270
Instruction Fuzzy Hash: 3561413590821DFBDB15DBA4CC45EFDB7B9AF04720F668265E621B71A0D730AE40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF8514 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00DF8541
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00DF855C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 00DF85FF
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,00DFB508,00000000), ref: 00DF863E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00DF8691
CompareStringW.KERNEL32(0000007F,00000000,00DFB508,000000FF,true,000000FF), ref: 00DF86AF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00DF86E7
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00DF882B

Strings

version, xrefs: 00DF8630, 00DF86D9
upgrade, xrefs: 00DF85F1
application, xrefs: 00DF854E
enclosure, xrefs: 00DF8819
http://appsyndication.org/2006/appsyn, xrefs: 00DF8534
true, xrefs: 00DF86A1
c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp, xrefs: 00DF874E
type, xrefs: 00DF8587
exclusive, xrefs: 00DF8683

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-2703766385
Opcode ID: 4bad509010f43b19a30c561aa068f6f172cf409565477d5cd563db5ee233ec8c
Instruction ID: fca2f7f37fa6bbcb61e1ed4357d081cc067f093c5c26f75a15c2412a8b048e70
Opcode Fuzzy Hash: 4bad509010f43b19a30c561aa068f6f172cf409565477d5cd563db5ee233ec8c
Instruction Fuzzy Hash: DEB19D3194470AABCB109F58CC85F6A7BB5AF44730F2AC615FA25EB2D5DB70E840DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE33A Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DCE223: LoadBitmapW.USER32(?,00000001), ref: 00DCE259
Part of subcall function 00DCE223: GetLastError.KERNEL32 ref: 00DCE265

LoadCursorW.USER32(00000000,00007F00), ref: 00DCE39B
RegisterClassW.USER32(?), ref: 00DCE3AF
GetLastError.KERNEL32 ref: 00DCE3BA
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00DCE4BF
DeleteObject.GDI32(00000000), ref: 00DCE4CE

Strings

Failed to create window., xrefs: 00DCE451
Unexpected return value from message pump., xrefs: 00DCE4A9
c:\agent\_work\138\s\src\burn\user\splashscreen.cpp, xrefs: 00DCE3DE, 00DCE447
Failed to load splash screen., xrefs: 00DCE373
Failed to register window., xrefs: 00DCE3E8
WixBurnSplashScreen, xrefs: 00DCE3A8, 00DCE4BA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\138\s\src\burn\user\splashscreen.cpp
API String ID: 164797020-989680284
Opcode ID: 4f4c9c0bc8199334d4e670f2cdf2dc6f44c227b163562dc620c663ea18b39d74
Instruction ID: e1fd81ab473723e2300ef52358e3006323bcb9f22e461a0c6a0c9f32ad403419
Opcode Fuzzy Hash: 4f4c9c0bc8199334d4e670f2cdf2dc6f44c227b163562dc620c663ea18b39d74
Instruction Fuzzy Hash: 034160B694431ABBDB119BD4DC49EAEBBB8EB04720F15412AFA05E7290DB309D10C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD9C22 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,00DDBA8B,00000000,000000FF,00000001,00000000,00000000,00DDBA8B,00000001,?), ref: 00DD9C87
GetLastError.KERNEL32 ref: 00DD9DF7
GetExitCodeThread.KERNEL32(?,00000001), ref: 00DD9E37
GetLastError.KERNEL32 ref: 00DD9E41

Strings

Failed to execute package provider registration action., xrefs: 00DD9D58
Failed to get cache thread exit code., xrefs: 00DD9E72
Failed to execute dependency action., xrefs: 00DD9D77
Failed to execute MSP package., xrefs: 00DD9D0C
Failed to load compatible package on per-machine package., xrefs: 00DD9D9D
Failed to execute compatible package action., xrefs: 00DD9DB4
Invalid execute action., xrefs: 00DD9E97
Failed to execute EXE package., xrefs: 00DD9CBE
Cache thread exited unexpectedly., xrefs: 00DD9E88
Failed to wait for cache check-point., xrefs: 00DD9E28
Failed to execute MSI package., xrefs: 00DD9CE7
c:\agent\_work\138\s\src\burn\user\apply.cpp, xrefs: 00DD9E1E, 00DD9E68
Failed to execute MSU package., xrefs: 00DD9D3C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\138\s\src\burn\user\apply.cpp
API String ID: 3703294532-3690680958
Opcode ID: 4c9393ac8b7eae552d1fa2a13fc1c8eac1b37851d3a50cdbdc7146b6e69ca016
Instruction ID: ff28c35619ab66fbf3bc20dcdd91e3f012a89fbbdab7fdf2f8cdee5c054a012b
Opcode Fuzzy Hash: 4c9393ac8b7eae552d1fa2a13fc1c8eac1b37851d3a50cdbdc7146b6e69ca016
Instruction Fuzzy Hash: 06711971A41229EBDB10DF64CD51EAEBBB8EB44710B20856BF905E7380D632DE419BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBF2A7 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF3F62: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00DF3FB1

RegCloseKey.ADVAPI32(00000000,?,00E00FB8,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 00DBF4D7

Part of subcall function 00DF194C: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00DBF324,00E00FB8,Resume,00000005,?,00000000,00000000,00000000), ref: 00DF1961

Strings

Failed to format resume command line for RunOnce., xrefs: 00DBF390
Installed, xrefs: 00DBF33C
burn.runonce, xrefs: 00DBF371
c:\agent\_work\138\s\src\burn\user\registration.cpp, xrefs: 00DBF45B, 00DBF4A9
Failed to create run key., xrefs: 00DBF3B4
Failed to delete run key value., xrefs: 00DBF465
Resume, xrefs: 00DBF319
"%ls" /%ls, xrefs: 00DBF37C
Failed to write run key value., xrefs: 00DBF3D2
BundleResumeCommandLine, xrefs: 00DBF3DF, 00DBF472
Failed to write resume command line value., xrefs: 00DBF3F4
Failed to write Resume value., xrefs: 00DBF32A
Failed to delete resume command line value., xrefs: 00DBF4B3
Failed to write Installed value., xrefs: 00DBF34D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\138\s\src\burn\user\registration.cpp
API String ID: 2348918689-1449905986
Opcode ID: 3db55003b74eb3cd3012ac5964c60de8dcfe8f679686097c8768f4e40845210a
Instruction ID: dc58a7ff2222b6d0a1efd6542dca544f4772be5688f749e5a1e6f004d92c6a2e
Opcode Fuzzy Hash: 3db55003b74eb3cd3012ac5964c60de8dcfe8f679686097c8768f4e40845210a
Instruction Fuzzy Hash: 4C51B236E4072AFBCF119BA48C46BFFB6A4EF00714F158175FA02BA191DB749D5096B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDCA82 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(76228FB0,00000000,00000000), ref: 00DDCA8E

Part of subcall function 00DC4E07: UuidCreate.RPCRT4(?), ref: 00DC4E3A

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,00DD22B1,?,?,00000000,?,?,?), ref: 00DDCB6C
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 00DDCB76
GetProcessId.KERNEL32(00DD22B1,?,?,00000000,?,?,?,?), ref: 00DDCBAE

Part of subcall function 00DC554D: lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,7694B390,?,00DB45B7,?,00DFB4F0), ref: 00DC556E
Part of subcall function 00DC554D: GetCurrentProcessId.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC5579
Part of subcall function 00DC554D: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC55B0
Part of subcall function 00DC554D: ConnectNamedPipe.KERNEL32(?,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC55C5
Part of subcall function 00DC554D: GetLastError.KERNEL32(?,00DB45B7,?,00DFB4F0), ref: 00DC55CF
Part of subcall function 00DC554D: Sleep.KERNEL32(00000064,?,00DB45B7,?,00DFB4F0), ref: 00DC5604
Part of subcall function 00DC554D: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5627
Part of subcall function 00DC554D: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5642
Part of subcall function 00DC554D: WriteFile.KERNEL32(?,00DB45B7,00DFB4F0,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC565D
Part of subcall function 00DC554D: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00DB45B7,?,00DFB4F0), ref: 00DC5678

Part of subcall function 00DF0EA4: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00DB4F98,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00DF0EB0
Part of subcall function 00DF0EA4: GetLastError.KERNEL32(?,00DB4F98,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DF0EBE

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00DDC9E2,?,?,?,?,?,00000000,?,?,?,?), ref: 00DDCC32
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00DDC9E2,?,?,?,?,?,00000000,?,?,?,?), ref: 00DDCC41
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,00DDC9E2,?,?,?,?,?,00000000,?,?,?), ref: 00DDCC58

Strings

burn.embedded, xrefs: 00DDCB29
%ls -%ls %ls %ls %u, xrefs: 00DDCB31
Failed to create embedded pipe., xrefs: 00DDCB18
Failed to create embedded process at path: %ls, xrefs: 00DDCBA4
c:\agent\_work\138\s\src\burn\user\embedded.cpp, xrefs: 00DDCB97
Failed to allocate embedded command., xrefs: 00DDCB45
Failed to create embedded pipe name and client token., xrefs: 00DDCAF1
Failed to process messages from embedded message., xrefs: 00DDCBF5
Failed to wait for embedded process to connect to pipe., xrefs: 00DDCBD0
Failed to wait for embedded executable: %ls, xrefs: 00DDCC15

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\138\s\src\burn\user\embedded.cpp
API String ID: 875070380-4141207472
Opcode ID: 642d66e1f5773e4130529346d58cffc0423c679577b161df87ed7c72119c211b
Instruction ID: 07f9e0cd72d265b06059ef5894604d45f1e66e728261e64ee365501ba9078997
Opcode Fuzzy Hash: 642d66e1f5773e4130529346d58cffc0423c679577b161df87ed7c72119c211b
Instruction Fuzzy Hash: 83515F72D1032ABBDF11AB94DD46FEEBAB8AF04720F115117FA01B6291D7719A44CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBED63 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00DBEEF1

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

SysFreeString.OLEAUT32(?), ref: 00DBEEA9

Strings

Failed to get SoftwareTag text., xrefs: 00DBEF2E
Regid, xrefs: 00DBEE3F
Path, xrefs: 00DBEE57
Failed to get @Filename., xrefs: 00DBEF4C
Filename, xrefs: 00DBEE24
c:\agent\_work\138\s\src\burn\user\registration.cpp, xrefs: 00DBEDE6
Failed to allocate memory for software tag structs., xrefs: 00DBEDF0
Failed to select software tag nodes., xrefs: 00DBED93
SoftwareTag, xrefs: 00DBED72
`Dv, xrefs: 00DBEEA9, 00DBEEF1
Failed to get @Path., xrefs: 00DBEF38
Failed to convert SoftwareTag text to UTF-8, xrefs: 00DBEF24
Failed to get next node., xrefs: 00DBEF56
Failed to get software tag count., xrefs: 00DBEDB8
Failed to get @Regid., xrefs: 00DBEF42

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`Dv$c:\agent\_work\138\s\src\burn\user\registration.cpp
API String ID: 336948655-3310264085
Opcode ID: 43454c9a47495f1795da8fb14e1533b237213c8e1d6702a2f1456d1ea01d31ec
Instruction ID: 0d72a00526fb4e405a6e03475a5b5153d3e0e4515eac1b79c2e02b82eba9ca74
Opcode Fuzzy Hash: 43454c9a47495f1795da8fb14e1533b237213c8e1d6702a2f1456d1ea01d31ec
Instruction Fuzzy Hash: 2B51AF75A40319EBDB159BA4C885AFEBBA4EF04B10B1541A9F902FB280D770DE409BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF835E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00DF8848,00000001,?), ref: 00DF837E
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00DF8848,00000001,?), ref: 00DF8399
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00DF8848,00000001,?), ref: 00DF83B4
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00DF8848,00000001,?), ref: 00DF8420
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00DF8848,00000001,?), ref: 00DF8444
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00DF8848,00000001,?), ref: 00DF8468
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00DF8848,00000001,?), ref: 00DF8488
lstrlenW.KERNEL32(006C0064,?,00DF8848,00000001,?), ref: 00DF84A3

Strings

name, xrefs: 00DF83AB
sha1, xrefs: 00DF845F
digest, xrefs: 00DF8390
algorithm, xrefs: 00DF8417
http://appsyndication.org/2006/appsyn, xrefs: 00DF8371
msi.dll, xrefs: 00DF8378
md5, xrefs: 00DF843B
c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp, xrefs: 00DF84BB
sha256, xrefs: 00DF847F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-1522978707
Opcode ID: 92ee5d6fdf08446a33a8b0ca45ece453feca81a26c47cc438baf467f9f2739a4
Instruction ID: 35903ca62fd4e4d7bb7b6aac89a1caadf8f533215bd206e50bb6b397eef13637
Opcode Fuzzy Hash: 92ee5d6fdf08446a33a8b0ca45ece453feca81a26c47cc438baf467f9f2739a4
Instruction Fuzzy Hash: 6E51C031648716BBDB214E54CC86F767A62AB11B30F25C301F674EA2E1CBA0E890D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA0EF Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBA167

Strings

Failed to set variable., xrefs: 00DBA2ED
Failed to copy upgrade code., xrefs: 00DBA1C7
Unsupported product search type: %u, xrefs: 00DBA12F
Language, xrefs: 00DBA150
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 00DBA226
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00DBA300
AssignmentType, xrefs: 00DBA142
Failed to enumerate related products for upgrade code., xrefs: 00DBA1A2
Failed to format GUID string., xrefs: 00DBA172
Failed to get product info., xrefs: 00DBA294
Product or related product not found: %ls, xrefs: 00DBA252
VersionString, xrefs: 00DBA157, 00DBA1E2, 00DBA1F8, 00DBA20C, 00DBA225, 00DBA239
Failed to change value type., xrefs: 00DBA2CE
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 00DBA1F9
State, xrefs: 00DBA149

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: c6375e3c1b91d44c7b27232986e61afaaf523b8ec1395d31dbcf999efd46618b
Instruction ID: 56a52a4ee6afe0aa9d56379e2c9cbfb4937472d2384548f8e6f07fd973e34427
Opcode Fuzzy Hash: c6375e3c1b91d44c7b27232986e61afaaf523b8ec1395d31dbcf999efd46618b
Instruction Fuzzy Hash: E061E032D40218FBCB119EAC8945EFE7BB9EB05710F258165FA06AB251D233CE4097B6

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4B9D Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00DC4BF7
GetLastError.KERNEL32 ref: 00DC4C05
Sleep.KERNEL32(00000064), ref: 00DC4C29

Strings

feclient.dll, xrefs: 00DC4C5C, 00DC4CF7, 00DC4D0B, 00DC4D4F
Failed to verify parent pipe: %ls, xrefs: 00DC4C71
Failed to open companion process with PID: %u, xrefs: 00DC4D51
\\.\pipe\%ls.Cache, xrefs: 00DC4C8A
Failed to allocate name of parent pipe., xrefs: 00DC4BC3
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC4C42, 00DC4D45
Failed to allocate name of parent cache pipe., xrefs: 00DC4C9E
\\.\pipe\%ls, xrefs: 00DC4BAF
Failed to open parent pipe: %ls, xrefs: 00DC4C4F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\138\s\src\burn\user\pipe.cpp$feclient.dll
API String ID: 408151869-1154546980
Opcode ID: 590c68e13b02540b43c0a4d95378c7cca2dff17f85b6e4ba84a383acf7314cc9
Instruction ID: 575ac0e0375390ce85e6fe16bc99abecf25c757ae9e7183cee76f7fbf931e138
Opcode Fuzzy Hash: 590c68e13b02540b43c0a4d95378c7cca2dff17f85b6e4ba84a383acf7314cc9
Instruction Fuzzy Hash: 804125B6D41337B7D72167A08E16FAE7A24AF00730F114219FE11BB2E0DB649D5096F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DBF618 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00DC0565,InstallerVersion,InstallerVersion,00000000,00DC0565,InstallerName,InstallerName,00000000,00DC0565,Date,InstalledDate,00000000,00DC0565,LogonUser), ref: 00DBF7C6

Part of subcall function 00DF199A: RegSetValueExW.ADVAPI32(00020006,00E00FB8,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DBF3CC,00000000,?,00020006), ref: 00DF19CD

Strings

InstallerVersion, xrefs: 00DBF794, 00DBF799, 00DBF79A, 00DBF7AA
Failed to create the key for update registration., xrefs: 00DBF666
Failed to write %ls value., xrefs: 00DBF7AF
PackageName, xrefs: 00DBF692, 00DBF6A5
ThisVersionInstalled, xrefs: 00DBF672, 00DBF685
Publisher, xrefs: 00DBF6D2, 00DBF6E5
Date, xrefs: 00DBF75C
InstalledDate, xrefs: 00DBF757, 00DBF770
LogonUser, xrefs: 00DBF73C
PublishingGroup, xrefs: 00DBF6FA, 00DBF70D
PackageVersion, xrefs: 00DBF6B2, 00DBF6C5
Failed to get the formatted key path for update registration., xrefs: 00DBF63A
InstalledBy, xrefs: 00DBF737, 00DBF750
ReleaseType, xrefs: 00DBF71D, 00DBF722, 00DBF731
InstallerName, xrefs: 00DBF777, 00DBF77C, 00DBF77D, 00DBF78D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: a1fcfcc565f3a93e9a6b46937e2d883f7d7e1b249fc18b0770d587a98b9c0b59
Instruction ID: bc47db2219bf1273130c3f8d777109925d1ff1fb004b0f5d2ebfcfff53f77684
Opcode Fuzzy Hash: a1fcfcc565f3a93e9a6b46937e2d883f7d7e1b249fc18b0770d587a98b9c0b59
Instruction Fuzzy Hash: F941B532A4072AFBCB226750CC06EFE7A65DF00B10F2251B5FA42B6291CB71DD50A6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE720 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00DCE766
RegisterClassW.USER32(?), ref: 00DCE792
GetLastError.KERNEL32 ref: 00DCE79D
CreateWindowExW.USER32(00000080,00E0A23C,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00DCE804
GetLastError.KERNEL32 ref: 00DCE80E
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00DCE8AC

Strings

Failed to create window., xrefs: 00DCE83C
WixBurnMessageWindow, xrefs: 00DCE78B, 00DCE8A7
Unexpected return value from message pump., xrefs: 00DCE897
c:\agent\_work\138\s\src\burn\user\uithread.cpp, xrefs: 00DCE7C1, 00DCE832
Failed to register window., xrefs: 00DCE7CB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\138\s\src\burn\user\uithread.cpp
API String ID: 213125376-2797729333
Opcode ID: e58094fdd21e6b3db0d83495ed9ca12974c2401cbcccdfe9deac20817e48e015
Instruction ID: 8414e9b6c1465ed874e3da6d984eac53659b8aceca61c2171f78699cc3ca832b
Opcode Fuzzy Hash: e58094fdd21e6b3db0d83495ed9ca12974c2401cbcccdfe9deac20817e48e015
Instruction Fuzzy Hash: 454173B6940315EBDB109B90DC45FDABFA8EF04760F15812AF905FB290D7309944CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDC571 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to copy key for passthrough pseudo bundle payload., xrefs: 00DDC7C2
Failed to copy cache id for passthrough pseudo bundle., xrefs: 00DDC802
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00DDC5B1
Failed to copy download source for passthrough pseudo bundle., xrefs: 00DDC78C
Failed to copy install arguments for passthrough bundle package, xrefs: 00DDC85F
c:\agent\_work\138\s\src\burn\user\pseudobundle.cpp, xrefs: 00DDC5A5, 00DDC79E, 00DDC7D8
Failed to copy related arguments for passthrough bundle package, xrefs: 00DDC87F
Failed to copy key for passthrough pseudo bundle., xrefs: 00DDC785
Failed to copy local source path for passthrough pseudo bundle., xrefs: 00DDC7B4
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00DDC7E4
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00DDC8A9
Failed to recreate command-line arguments., xrefs: 00DDC840
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00DDC7AA
Failed to copy filename for passthrough pseudo bundle., xrefs: 00DDC7BB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\138\s\src\burn\user\pseudobundle.cpp
API String ID: 1357844191-3179816169
Opcode ID: 13dcd4e40b1b7186628cf9004dcb9a21e83b287b00328f7ff097d81c321ccc95
Instruction ID: c896fab8a6a21219e1b879e08530219fa15b373d84df41bbaf60644afe7d3b98
Opcode Fuzzy Hash: 13dcd4e40b1b7186628cf9004dcb9a21e83b287b00328f7ff097d81c321ccc95
Instruction Fuzzy Hash: EDB14636A00616EFDB11CF68C881FA5BBA1FF08710F11916AF915AB351DB71E861DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDDC09 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 00DDDC24

Strings

Falied to start BITS job., xrefs: 00DDDDDC
Failed to set credentials for BITS job., xrefs: 00DDDCD2
Failed to download BITS job., xrefs: 00DDDDBB
Failed to initialize BITS job callback., xrefs: 00DDDD45
Failed to set callback interface for BITS job., xrefs: 00DDDD5C
c:\agent\_work\138\s\src\burn\user\bitsuser.cpp, xrefs: 00DDDC3A, 00DDDD2D
Failed to complete BITS job., xrefs: 00DDDDCE
Failed to create BITS job., xrefs: 00DDDCB3
Failed to add file to BITS job., xrefs: 00DDDCF1
Failed to copy download URL., xrefs: 00DDDC6B
Invalid BITS user URL: %ls, xrefs: 00DDDC46
Failed while waiting for BITS download., xrefs: 00DDDDD5
Failed to create BITS job callback., xrefs: 00DDDD37

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS user URL: %ls$c:\agent\_work\138\s\src\burn\user\bitsuser.cpp
API String ID: 1659193697-2643649894
Opcode ID: 959637bebc2f1ee4dc6fb2e4d976f4d0dbaa8af3c750dd912081ca9a3aaf83a2
Instruction ID: cc2c5d761600f0e97d9191b2f5d8dc80850fff76a50f2d4bcb46f5a3257c6683
Opcode Fuzzy Hash: 959637bebc2f1ee4dc6fb2e4d976f4d0dbaa8af3c750dd912081ca9a3aaf83a2
Instruction Fuzzy Hash: EB517C35A01325EBCF119B94C885EAEBBA6EF08B20B264197FD05AB351D774DD409BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBBD4F Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBBDA1
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 00DBBEAE
GetLastError.KERNEL32(?,?,?,?), ref: 00DBBEB8
WaitForInputIdle.USER32(?,?), ref: 00DBBF0C
CloseHandle.KERNEL32(?,?,?), ref: 00DBBF57
CloseHandle.KERNEL32(?,?,?), ref: 00DBBF64

Strings

c:\agent\_work\138\s\src\burn\user\approvedexe.cpp, xrefs: 00DBBEDC
Failed to CreateProcess on path: %ls, xrefs: 00DBBEE9
D, xrefs: 00DBBE8D
Failed to create obfuscated executable command., xrefs: 00DBBE4C
Failed to create executable command., xrefs: 00DBBDDB
"%ls" %s, xrefs: 00DBBDC7, 00DBBE08
"%ls", xrefs: 00DBBE1E, 00DBBE38
Failed to format obfuscated argument string., xrefs: 00DBBDF8
Failed to format argument string., xrefs: 00DBBDAC

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\138\s\src\burn\user\approvedexe.cpp
API String ID: 155678114-1623605306
Opcode ID: de76f85c55380787626a20bb2052612343a37007573c1f4ef53f22fad439d00c
Instruction ID: 11ffbc48710ccc5f1c91985e8ac4f539b980e981adda279548eec2366b156d99
Opcode Fuzzy Hash: de76f85c55380787626a20bb2052612343a37007573c1f4ef53f22fad439d00c
Instruction Fuzzy Hash: B9516A72C0021AFBCF12AFA0CC419EEBB74EF04320B148566FA16B6221D7719E549BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD684E Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00DD6D9D,?), ref: 00DD6887
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DD6D9D,?,?,?), ref: 00DD6894
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00DD6D9D,?,?,?), ref: 00DD68DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DD6D9D,?,?,?), ref: 00DD68E8
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00DD6D9D,?,?,?), ref: 00DD6922
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DD6D9D,?,?,?), ref: 00DD692C
CloseServiceHandle.ADVAPI32(00000000), ref: 00DD69E3
CloseServiceHandle.ADVAPI32(?), ref: 00DD69ED

Strings

wuauserv, xrefs: 00DD68D6
Failed to open WU service., xrefs: 00DD6916
Failed to open service control manager., xrefs: 00DD68C2
c:\agent\_work\138\s\src\burn\user\msuuser.cpp, xrefs: 00DD68B8, 00DD690C, 00DD6950
Failed to read configuration for WU service., xrefs: 00DD6993
Failed to query status of WU service., xrefs: 00DD695A
Failed to mark WU service to start on demand., xrefs: 00DD69B4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\138\s\src\burn\user\msuuser.cpp$wuauserv
API String ID: 971853308-2240853446
Opcode ID: dcd0d1be0543c069f2572d7a612666528469e4685516c7d178fed6fd8410ba7a
Instruction ID: 3879d8e0cf9ba352ac3c58ead56fd2d933041f4587f3bc67b040232094d2d54c
Opcode Fuzzy Hash: dcd0d1be0543c069f2572d7a612666528469e4685516c7d178fed6fd8410ba7a
Instruction Fuzzy Hash: E141A776E403299BD7119BA8CC55AAEB6A4AF44720B164027FD05FB381DB70DD448AF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB2C8 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,00DBBBBB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB2D0
GetLastError.KERNEL32(?,00DBBBBB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DBB2DC
_memcmp.LIBVCRUNTIME ref: 00DBB384

Strings

.wixburn, xrefs: 00DBB37E
Failed to read section info, unsupported version: %08x, xrefs: 00DBB41E
c:\agent\_work\138\s\src\burn\user\section.cpp, xrefs: 00DBB300, 00DBB331, 00DBB35C, 00DBB3C5, 00DBB3E6, 00DBB40F, 00DBB44F
burn, xrefs: 00DBB3AB
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 00DBB45B
Failed to find Burn section., xrefs: 00DBB3F2
Failed to read section info, data to short: %u, xrefs: 00DBB3D4
.wix, xrefs: 00DBB3A3
Failed to find valid DOS image header in buffer., xrefs: 00DBB33D
Failed to find valid NT image header in buffer., xrefs: 00DBB368
Failed to get module handle to process., xrefs: 00DBB30A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\138\s\src\burn\user\section.cpp
API String ID: 3888311042-79629970
Opcode ID: 33a23038b37523b81f26ecaf5d56c38dcc4da89ab669e5521887f5028c309aba
Instruction ID: 30ef22ee5e89fec2c6bdfb7467a21c85a1f52d973ff594ea653d67295d0f69f1
Opcode Fuzzy Hash: 33a23038b37523b81f26ecaf5d56c38dcc4da89ab669e5521887f5028c309aba
Instruction Fuzzy Hash: 4D41DB36680715EBC72116459C46FBE2655EF81F30B2A8027FA475F382EBE5C80592FA

Uniqueness

Uniqueness Score: -1.00%

Function 00DC3BC4 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00DC3C18
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00DC3C22
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00DC3C8B
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00DC3C92
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00DC3D1C

Strings

Failed to format session id as a string., xrefs: 00DC3CC0
c:\agent\_work\138\s\src\burn\user\logging.cpp, xrefs: 00DC3C46
%u\, xrefs: 00DC3CAC
crypt32.dll, xrefs: 00DC3BD7
Failed to copy temp folder., xrefs: 00DC3D45
Failed to get length of temp folder., xrefs: 00DC3C7C
Failed to get temp folder., xrefs: 00DC3C50
4#v, xrefs: 00DC3C18
Failed to get length of session id string., xrefs: 00DC3CE7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: 4#v$%u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\138\s\src\burn\user\logging.cpp$crypt32.dll
API String ID: 2407829081-2827683534
Opcode ID: 860c58dd09bf4dcd21f3ad2e058c016681be655d443783e0617dd4f35e75f539
Instruction ID: 4c31a688f7c1f7404a6e46c891dd9fe9113cb96594765555d53dce354f14da84
Opcode Fuzzy Hash: 860c58dd09bf4dcd21f3ad2e058c016681be655d443783e0617dd4f35e75f539
Instruction Fuzzy Hash: B54183B2D8133EABCB219B50DD49FEE7768AB10710F114196B919B7291DA709F808BF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA33A Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBA362
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000), ref: 00DBA4B6

Strings

Failed to set variable., xrefs: 00DBA479
Failed to format value string., xrefs: 00DBA3EE
c:\agent\_work\138\s\src\burn\user\search.cpp, xrefs: 00DBA43A
Failed to format key string., xrefs: 00DBA36D
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00DBA48E
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00DBA451
Failed to query registry key value., xrefs: 00DBA444
Failed to open registry key. Key = '%ls', xrefs: 00DBA3B7
Registry key not found. Key = '%ls', xrefs: 00DBA3A3

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\138\s\src\burn\user\search.cpp
API String ID: 1561904661-903180124
Opcode ID: e45ce421e908d5619b6b5b45be4d88e9e421218cf3feef2061e76be79d3d5425
Instruction ID: cb9bb8fe47cc579aa9692f32be6b6d3001d09ea0fa7707a8d746475ccd1b1997
Opcode Fuzzy Hash: e45ce421e908d5619b6b5b45be4d88e9e421218cf3feef2061e76be79d3d5425
Instruction Fuzzy Hash: 2641D832D40128FFCF125BA8DC0AEFE7BA9EF04710F168161FD1AE6152D6718D1096B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB69EE Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00DB6A3E
GetLastError.KERNEL32 ref: 00DB6A48
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00DB6A8B
GetLastError.KERNEL32 ref: 00DB6A95
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00DB6BBE

Strings

RtlGetVersion, xrefs: 00DB6A80
Failed to locate RtlGetVersion., xrefs: 00DB6AC3
Failed to get OS info., xrefs: 00DB6AE6
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6A6C, 00DB6AB9
Failed to set variant value., xrefs: 00DB6BA2
Failed to locate NTDLL., xrefs: 00DB6A76
ntdll, xrefs: 00DB6A38

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\138\s\src\burn\user\variable.cpp$ntdll
API String ID: 3057421322-3435586203
Opcode ID: fa30d2ef7371365d365107adb19ee510acbd4d2de735a917de00078e0952011c
Instruction ID: 0d6144e9fdb2523e591f42e5bc41796bfa2f404ba73ef48cb17a74807e7dfb66
Opcode Fuzzy Hash: fa30d2ef7371365d365107adb19ee510acbd4d2de735a917de00078e0952011c
Instruction Fuzzy Hash: CF41A572D40238DBDB219B25CC05BF97AB5EB08761F058195F94AF6240DB78CE44CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4971 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00DB54DE,?,?,?,?), ref: 00DB49A2
GetLastError.KERNEL32(?,?,?,00DB54DE,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DB49B3
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DB4AF0
CloseHandle.KERNEL32(?,?,?,?,00DB54DE,?,?,?,?,?,?,?,?,?,?,?), ref: 00DB4AF9

Strings

Failed to allocate thread local storage for logging., xrefs: 00DB49E1
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB49D7, 00DB4A20
Failed to set elevated pipe into thread local storage for logging., xrefs: 00DB4A2A
Failed to connect to unelevated process., xrefs: 00DB4998
comres.dll, xrefs: 00DB4A5F
Failed to create the message window., xrefs: 00DB4A4E
Failed to pump messages from parent process., xrefs: 00DB4AC4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\138\s\src\burn\user\user.cpp$comres.dll
API String ID: 687263955-3592602874
Opcode ID: fba998a281579d028cec5dad889aa3ff3c07b2b13f41664fb5f43a7ec47fdee9
Instruction ID: a7e4d26a22449db682de5a2bd4f2716714c3f3dee7569f8592fc66cdee8b33c1
Opcode Fuzzy Hash: fba998a281579d028cec5dad889aa3ff3c07b2b13f41664fb5f43a7ec47fdee9
Instruction Fuzzy Hash: AF417172A4071AFBC711DBA0CC45EEBBA6CEF04724F054226B616E7142DB60A9548AF5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8091 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00DB80AE
LeaveCriticalSection.KERNEL32(?), ref: 00DB82D6

Strings

Failed to get numeric., xrefs: 00DB82A8
feclient.dll, xrefs: 00DB8189, 00DB81DF, 00DB8220
Failed to write variable value type., xrefs: 00DB82B6
Failed to write variable name., xrefs: 00DB82BD
Failed to write variable count., xrefs: 00DB80C9
Failed to write literal flag., xrefs: 00DB82AF
Failed to write variable value as number., xrefs: 00DB8280
Failed to get version., xrefs: 00DB8287
Failed to write included flag., xrefs: 00DB82C4
Failed to get string., xrefs: 00DB82A1
Unsupported variable type., xrefs: 00DB8293
Failed to write variable value as string., xrefs: 00DB829A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 7f78dd30854270926765019fb01b9e88b969c00578dff6a959e686487630446a
Instruction ID: 4244a7a1a6e21464aa7d898872512514aa3f0a54702e6df66678e5b0a405bc35
Opcode Fuzzy Hash: 7f78dd30854270926765019fb01b9e88b969c00578dff6a959e686487630446a
Instruction Fuzzy Hash: 2A715D32C01A1AEFCB129FA4C941AEE7BA9FF04364F154162E902A7251DF31DD54EBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DC9799 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,00DCA82B,?,00000000,00000000,00000000,?), ref: 00DC97B4
GetLastError.KERNEL32(?,00DCA82B,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00DC97C4

Part of subcall function 00DF454C: Sleep.KERNEL32(?,00000000,?,00DC85D8,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00DB4E38), ref: 00DF4563

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00DC98D0

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC97E8
Failed to verify payload hash: %ls, xrefs: 00DC985C
Failed to copy %ls to %ls, xrefs: 00DC98BE
Copying, xrefs: 00DC986F, 00DC987A
Moving, xrefs: 00DC9866
Failed to open payload in working path: %ls, xrefs: 00DC97F3
Failed to move %ls to %ls, xrefs: 00DC98A8
%ls payload from working path '%ls' to path '%ls', xrefs: 00DC987B
Failed to verify payload signature: %ls, xrefs: 00DC981F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 1275171361-267695647
Opcode ID: ffd9c4783567c805517448fa185aa8d16c7d2bca729e0379cdb79957c82eccd1
Instruction ID: 88968291ed524fd9357404beadc64e04cf97fe4aec9448ffef9126806b2591ed
Opcode Fuzzy Hash: ffd9c4783567c805517448fa185aa8d16c7d2bca729e0379cdb79957c82eccd1
Instruction Fuzzy Hash: A3310672D41726BBDB2227559C5EF3BAA1CDF42B60F06412ABD01BB281D661DD0086F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0714 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00DF0758
GetComputerNameW.KERNEL32(?,?), ref: 00DF07B0

Strings

--- logging level: %hs ---, xrefs: 00DF0870
Pk, xrefs: 00DF0859
Executable: %ls v%d.%d.%d.%d, xrefs: 00DF080C
dk, xrefs: 00DF0849
lk, xrefs: 00DF0869
Hk, xrefs: 00DF0861
@k, xrefs: 00DF0729
=== Logging started: %ls ===, xrefs: 00DF07DB
\k, xrefs: 00DF0851
Computer : %ls, xrefs: 00DF081E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$@k$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Hk$Pk$\k$dk$lk
API String ID: 2577110986-1757844057
Opcode ID: 985d159ace9eef3d7dc70e0a04407ccf2cff180f0f8609ffcd0064b3ce16878a
Instruction ID: c0ad141bf4d10d4ea79f28ec888718cc6ecd0405258c554eeff115a7ba8a0b2d
Opcode Fuzzy Hash: 985d159ace9eef3d7dc70e0a04407ccf2cff180f0f8609ffcd0064b3ce16878a
Instruction Fuzzy Hash: F04124B190011C9BCB14AF65DD45AFA7BBCEB44754F4581AAF605E3142D730AEC48FB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB666B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 00DB66A7

Part of subcall function 00DF0F42: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00DB5F1B,00000000), ref: 00DF0F57
Part of subcall function 00DF0F42: GetProcAddress.KERNEL32(00000000), ref: 00DF0F5E
Part of subcall function 00DF0F42: GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0F79

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DB66D3
GetLastError.KERNEL32 ref: 00DB66E1
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 00DB6719
GetLastError.KERNEL32 ref: 00DB6723
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DB6766
GetLastError.KERNEL32 ref: 00DB6770

Strings

Failed to get 64-bit system folder., xrefs: 00DB670F
Failed to backslash terminate system folder., xrefs: 00DB67B3
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6705, 00DB6747
Failed to get 32-bit system folder., xrefs: 00DB6751
Failed to set system folder variant value., xrefs: 00DB67CF

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 325818893-2244462321
Opcode ID: 45f74d3452675de4fc1823d6424b2c873940e2f84e6dbc35dfecbce3a2cbbad2
Instruction ID: 770deed03715e08c9e6024c390a966471342163b407d76d7382ac7601c67066a
Opcode Fuzzy Hash: 45f74d3452675de4fc1823d6424b2c873940e2f84e6dbc35dfecbce3a2cbbad2
Instruction Fuzzy Hash: 5E31F576D41338E7D73097608C0DBEA7668AF00769F058162BD06F7680DB78DD448AF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC400F Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00DC3B19: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00DC4029,feclient.dll,?,00000000,?,?,?,00DB4B92), ref: 00DC3BBA

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00DB4B92,?,?,00DFB478,?,00000001,00000000,00000000), ref: 00DC40C0

Strings

feclient.dll, xrefs: 00DC4023, 00DC40D0
log, xrefs: 00DC4067
msasn1.dll, xrefs: 00DC41DC, 00DC421D
Failed to get non-session specific TEMP folder., xrefs: 00DC416E
Failed to copy full log path to prefix., xrefs: 00DC4229
Failed to copy log path to prefix., xrefs: 00DC41E8
clbcatq.dll, xrefs: 00DC41FF
crypt32.dll, xrefs: 00DC4066, 00DC40CB, 00DC40D3, 00DC4136, 00DC4178, 00DC41BB, 00DC41DA, 00DC4218, 00DC4242
Setup, xrefs: 00DC406D
Failed to copy log extension to extension., xrefs: 00DC420B
Failed to open log: %ls, xrefs: 00DC4138
Failed to get current directory., xrefs: 00DC40A2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: ed0f4376cb68a39f77f7a633169fac15a7cd50b97120bcd8e75ac3350c16b105
Instruction ID: c97e22114985f2cc4669c033e440958863aa18cf34ee002f3681601946123a32
Opcode Fuzzy Hash: ed0f4376cb68a39f77f7a633169fac15a7cd50b97120bcd8e75ac3350c16b105
Instruction Fuzzy Hash: 4F61B471A40317AADB259F74CC62F7A7BA8EF10350B198529F901DB141EB70DD9097B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB6E72 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00DB5435,00000000,00DB54BD,00000000,?,00DB83A0,?,?,?,00000000,00000000), ref: 00DB6E81

Part of subcall function 00DB571D: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00DB6640,00DB6640,?,00DB56B3,?,?,00000000), ref: 00DB5759
Part of subcall function 00DB571D: GetLastError.KERNEL32(?,00DB56B3,?,?,00000000,?,?,00DB6640,?,00DB7FF2,?,?,?,?,?), ref: 00DB5788

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 00DB7011

Strings

Attempt to set built-in variable value: %ls, xrefs: 00DB6F0F
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00DB6F86
Failed to set value of variable: %ls, xrefs: 00DB6FF9
Setting string variable '%ls' to value '%ls', xrefs: 00DB6FA1, 00DB6FA9
Unsetting variable '%ls', xrefs: 00DB6F9A, 00DB6FCD
Failed to find variable value '%ls'., xrefs: 00DB6E9C
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6F04
Setting numeric variable '%ls' to value %lld, xrefs: 00DB6FB2
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00DB7023
Failed to insert variable '%ls'., xrefs: 00DB6EC6
Setting hidden variable '%ls', xrefs: 00DB6F3F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 2716280545-303591679
Opcode ID: 2249907cfdd95b9f24f5d4bf87c8c061116f60ad7c9b4cc8f68337560a933f1a
Instruction ID: b403fabd7f65d6c1ae17207fadab2031e5d2fa79807270a31c9c26618d0c0836
Opcode Fuzzy Hash: 2249907cfdd95b9f24f5d4bf87c8c061116f60ad7c9b4cc8f68337560a933f1a
Instruction Fuzzy Hash: BC51E471A00229EBCB309E15DC4AFFB3A69DF84714F258019F9469B282D239ED50CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE8CD4 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00DE8D18

Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE8858
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE886A
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE887C
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE888E
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88A0
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88B2
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88C4
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88D6
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88E8
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE88FA
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE890C
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE891E
Part of subcall function 00DE883B: _free.LIBCMT ref: 00DE8930

_free.LIBCMT ref: 00DE8D0D

Part of subcall function 00DE604F: HeapFree.KERNEL32(00000000,00000000,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?), ref: 00DE6065
Part of subcall function 00DE604F: GetLastError.KERNEL32(?,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?,?), ref: 00DE6077

_free.LIBCMT ref: 00DE8D2F
_free.LIBCMT ref: 00DE8D44
_free.LIBCMT ref: 00DE8D4F
_free.LIBCMT ref: 00DE8D71
_free.LIBCMT ref: 00DE8D84
_free.LIBCMT ref: 00DE8D92
_free.LIBCMT ref: 00DE8D9D
_free.LIBCMT ref: 00DE8DD5
_free.LIBCMT ref: 00DE8DDC
_free.LIBCMT ref: 00DE8DF9
_free.LIBCMT ref: 00DE8E11

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c893e678a645326740e9196c39f404334d4f361cf3b18ed77eee09cdba37288d
Instruction ID: f102b2f9820609d2fd28aa5451e70601bd77771827d458df49bf4bb33593be23
Opcode Fuzzy Hash: c893e678a645326740e9196c39f404334d4f361cf3b18ed77eee09cdba37288d
Instruction Fuzzy Hash: 4C3139316002849FEB31BA7ADC45B5A73E9EF60751F28542AE45CD71A2DF75EC80AB30

Uniqueness

Uniqueness Score: -1.00%

Function 00DC2D02 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,00707063,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00DC2D70

Strings

Failed to create the string dictionary., xrefs: 00DC2DA9
Failed to add dependents ignored from command-line., xrefs: 00DC2E25
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00DC2EDA
Failed to add self-dependent to ignore dependents., xrefs: 00DC2DF4
Failed to add registration action for self dependent., xrefs: 00DC303D
Failed to add registration action for dependent related bundle., xrefs: 00DC3072
Failed to check for remaining dependents during planning., xrefs: 00DC2F16
crypt32.dll, xrefs: 00DC2DBB, 00DC2EB5, 00DC2FAA, 00DC301F
wininet.dll, xrefs: 00DC2FBD
Failed to allocate registration action., xrefs: 00DC2DD9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: cba741e19ab17b25c2a45794374da5d4f9892d2044c99a09cdee93f99c3cd7f0
Instruction ID: 88c17f2515446dd7d21462eac83f27f932f569371498ed8f7af1b6d6a3142339
Opcode Fuzzy Hash: cba741e19ab17b25c2a45794374da5d4f9892d2044c99a09cdee93f99c3cd7f0
Instruction Fuzzy Hash: 35B15871A0022BEBCB259F58C881FAA7BB5FF14710F04816EF815AB251D774DA90DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF858 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DCF894
UuidCreate.RPCRT4(?), ref: 00DCF977
StringFromGUID2.OLE32(?,?,00000027), ref: 00DCF998
LeaveCriticalSection.KERNEL32(?,?), ref: 00DCFA41

Strings

Failed to convert bundle update guid into string., xrefs: 00DCF9B7
Failed to create bundle update guid., xrefs: 00DCF984
Failed to set update bundle., xrefs: 00DCFA1B
update\%ls, xrefs: 00DCF8F0
Failed to recreate command-line for update bundle., xrefs: 00DCF95F
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCF9AD
Failed to default local update source, xrefs: 00DCF904

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp$update\%ls
API String ID: 171215650-4014518301
Opcode ID: a0934882badf689f57de0ab73d951b452369b423c17b7fbed4c97ea24545f54c
Instruction ID: c27f28f469aeea17c78bf176ab73a3557dc2993f00e7f82c64b5f0969a50d79b
Opcode Fuzzy Hash: a0934882badf689f57de0ab73d951b452369b423c17b7fbed4c97ea24545f54c
Instruction Fuzzy Hash: AB513A3194031AEBCF218FA5C845FEEB7B6EF08710F19417AE909AB251DB309840CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4B65 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00DB4CE4
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DB4CF5

Strings

Failed while running , xrefs: 00DB4CAA
Failed to set action variables., xrefs: 00DB4C44
Failed to check global conditions, xrefs: 00DB4BC9
Failed to query registration., xrefs: 00DB4C2E
WixBundleLayoutDirectory, xrefs: 00DB4C75
Failed to set registration variables., xrefs: 00DB4C5E
Failed to create the message window., xrefs: 00DB4C18
Failed to open log., xrefs: 00DB4B98
Failed to set layout directory variable to value provided from command-line., xrefs: 00DB4C86

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 9534a43024fc731e6cbe3de6a21262f48fbdbef7a6976de4ce70810d55a39e2a
Instruction ID: c423dd10dd6ce1363b10ad023a8dfe7f82b57e7218f0808a778b3c4b7b903834
Opcode Fuzzy Hash: 9534a43024fc731e6cbe3de6a21262f48fbdbef7a6976de4ce70810d55a39e2a
Instruction Fuzzy Hash: B341C03164261BFECB169A60CD45FFABB6CFF00B60F054216BA06A6142EB70ED5497B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCEFAD Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 00DCEFCA
LeaveCriticalSection.KERNEL32(?), ref: 00DCF0F7

Strings

user is active, cannot change user state., xrefs: 00DCEFE5
Failed to copy the arguments., xrefs: 00DCF089
Failed to post launch approved exe message., xrefs: 00DCF0E2
UX requested unknown approved exe with id: %ls, xrefs: 00DCF02A
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCF0D8
Failed to copy the id., xrefs: 00DCF05C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: user is active, cannot change user state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 1367039788-1363755703
Opcode ID: 5e08bdb2e7c9ed95862ac18a6f4b968c3689ac3fc45a9da5c68d77546a92bae1
Instruction ID: ddd77857217dd5e1f27c21edecdd997ef8b33a9d6a32e35d0fa67191d5bf88af
Opcode Fuzzy Hash: 5e08bdb2e7c9ed95862ac18a6f4b968c3689ac3fc45a9da5c68d77546a92bae1
Instruction Fuzzy Hash: C231A572600326EBC7219B64DC05FFA7BA9DF00B60B158129FD05EB292EB71DD4097B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC9684 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,00DCA7BE,?,00000000,00000000,00000000,?), ref: 00DC969F
GetLastError.KERNEL32(?,00DCA7BE,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00DC96AD

Part of subcall function 00DF454C: Sleep.KERNEL32(?,00000000,?,00DC85D8,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00DB4E38), ref: 00DF4563

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00DC978B

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC96D1
Failed to open container in working path: %ls, xrefs: 00DC96DC
Failed to copy %ls to %ls, xrefs: 00DC9779
Copying, xrefs: 00DC972A, 00DC9735
%ls container from working path '%ls' to path '%ls', xrefs: 00DC9736
Moving, xrefs: 00DC9721
Failed to move %ls to %ls, xrefs: 00DC9763
Failed to verify container hash: %ls, xrefs: 00DC970E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 1275171361-282647985
Opcode ID: 568e3d5abf513d1c57635beb46423657db77f85156d8c28f9d7e228490b289ff
Instruction ID: 2634956bcb934a43322663e038c68e9d7a5e32519ce60f3bc7bd565910ebe9bd
Opcode Fuzzy Hash: 568e3d5abf513d1c57635beb46423657db77f85156d8c28f9d7e228490b289ff
Instruction Fuzzy Hash: 6D215A32E8172677D7222A249C5AF7B661CCF41F60F124119FE02BB2C1D652AC5185F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB703B Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DB7068
LeaveCriticalSection.KERNEL32(?), ref: 00DB7274

Strings

Failed to set variable., xrefs: 00DB7248
Failed to read variable value type., xrefs: 00DB7256
Failed to read variable literal flag., xrefs: 00DB724F
Failed to read variable value as string., xrefs: 00DB7241
Failed to read variable count., xrefs: 00DB7088
Failed to read variable value as number., xrefs: 00DB722E
Failed to read variable name., xrefs: 00DB725D
Failed to set variable value., xrefs: 00DB7227
Failed to read variable included flag., xrefs: 00DB7264
Unsupported variable type., xrefs: 00DB723A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: c22325ae5a5c8b03596cabb1a741789a227332a52082974c7ab0aef6d363c5a9
Instruction ID: b82f3bb7ecb0f31e4d8634c0f855751cca25a96c8b091c196c9c2f1fa206adc2
Opcode Fuzzy Hash: c22325ae5a5c8b03596cabb1a741789a227332a52082974c7ab0aef6d363c5a9
Instruction Fuzzy Hash: DA717D32C0821EEFCF119EA5D845EEEBBB9EF84750F114126FA02A6250D730DE049BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF491A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00DF4997
GetLastError.KERNEL32 ref: 00DF49AD
GetFileSizeEx.KERNEL32(00000000,?), ref: 00DF49FD
GetLastError.KERNEL32 ref: 00DF4A07
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00DF4A5B
GetLastError.KERNEL32 ref: 00DF4A66
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00DF4B55
CloseHandle.KERNEL32(?), ref: 00DF4BC8

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF493A, 00DF49E6, 00DF4A27, 00DF4BAB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-3168567549
Opcode ID: 540532f61ad514762dfda5a83206df1288f79d22581a6110ddaf0cf96affc499
Instruction ID: bbe5fdc20d0003358f989d393275cd75daf5b8892ee14d9bb2e439439c212d4f
Opcode Fuzzy Hash: 540532f61ad514762dfda5a83206df1288f79d22581a6110ddaf0cf96affc499
Instruction Fuzzy Hash: 6281E931A8022EEBDB218E558C45B7B76A8EF40764F17C159FF55EB280D674CE009BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB319C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 00DB31E7
GetLastError.KERNEL32 ref: 00DB31ED
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00DB3247
GetLastError.KERNEL32 ref: 00DB324D
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DB3301
GetLastError.KERNEL32 ref: 00DB330B
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DB3361
GetLastError.KERNEL32 ref: 00DB336B

Strings

@, xrefs: 00DB31C1
c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp, xrefs: 00DB3211

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-3477864740
Opcode ID: 7fecf6e8357167dab7f3544e1af945f7b9c2a02a68cc3830c3ec8137677bfc1b
Instruction ID: 363734532ef9fdac5571aad5ce185bf4744a5755d0db03592a8aa9bc16f9229f
Opcode Fuzzy Hash: 7fecf6e8357167dab7f3544e1af945f7b9c2a02a68cc3830c3ec8137677bfc1b
Instruction Fuzzy Hash: 5661B777D40629FBDB219AE58C85BEFBAA8AF00760F154155ED02BB240DB35DF00A7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2EE7 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00DB2F87
GetLastError.KERNEL32 ref: 00DB2F91
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00DB3031
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00DB30BE
GetLastError.KERNEL32 ref: 00DB30CB
Sleep.KERNEL32(00000064), ref: 00DB30DF
CloseHandle.KERNEL32(?), ref: 00DB3147

Strings

c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp, xrefs: 00DB2FB5
4#v, xrefs: 00DB2F87
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00DB308E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: 4#v$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-3466956741
Opcode ID: 6b07ae2387202d9d8a1c2abf4bfe617d1c33e1d7e1067f736afb7f5e1dde5022
Instruction ID: 24bd0347212298eddedaeb86240f6eb9c0f3ca6982b12869c950dcfca7c50df3
Opcode Fuzzy Hash: 6b07ae2387202d9d8a1c2abf4bfe617d1c33e1d7e1067f736afb7f5e1dde5022
Instruction Fuzzy Hash: 76716572D01229EBDB209F69DC49BFAB2B8AF08750F054195F916E7290D7349E84DF70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF7144 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7622DFD0,?,00DF76B6,?,?), ref: 00DF719A
SysFreeString.OLEAUT32(00000000), ref: 00DF7205
SysFreeString.OLEAUT32(00000000), ref: 00DF727D
SysFreeString.OLEAUT32(00000000), ref: 00DF72BC

Strings

label, xrefs: 00DF718C
`Dv, xrefs: 00DF7205, 00DF727D, 00DF72BC
term, xrefs: 00DF71CD
scheme, xrefs: 00DF71AD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$Free$Compare
String ID: `Dv$label$scheme$term
API String ID: 1324494773-22456348
Opcode ID: fa42dbb8a6123360ec3f45ab0653d92149772a6394298fcc4bfce3163257ab4b
Instruction ID: ec948321d07e246fc42e07e0c71b1e2d1b8e04a8455e9e2611aff49179982fa4
Opcode Fuzzy Hash: fa42dbb8a6123360ec3f45ab0653d92149772a6394298fcc4bfce3163257ab4b
Instruction Fuzzy Hash: C6513A31905219AFDB11DBA4CC45EFEBBB9AF04721F268295FA11A62A0D7309E40DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4E07 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00DC4E3A
StringFromGUID2.OLE32(?,?,00000027), ref: 00DC4E69
UuidCreate.RPCRT4(?), ref: 00DC4EB4
StringFromGUID2.OLE32(?,?,00000027), ref: 00DC4EE0

Strings

Failed to allocate pipe secret., xrefs: 00DC4F09
Failed to create pipe guid., xrefs: 00DC4E47
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC4E7A, 00DC4EC7
Failed to allocate pipe name., xrefs: 00DC4EA9
BurnPipe.%s, xrefs: 00DC4E95
Failed to convert pipe guid into string., xrefs: 00DC4E86

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 4041566446-1585371156
Opcode ID: 9ddd2ef3b2ff69b52721bcf81bc772b588eeb039f36955b36add8484915a7161
Instruction ID: 0bc57860fbbab3c54b84782688141536c7859ece7a4455b5b6ea3a443312a9bc
Opcode Fuzzy Hash: 9ddd2ef3b2ff69b52721bcf81bc772b588eeb039f36955b36add8484915a7161
Instruction Fuzzy Hash: E44147B2D00309EBDB11DAE5D945FEEB7B8AB44710F21412AF905FB290D6749A44CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB609A Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00DB60C5
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00DB60D9
GetLastError.KERNEL32 ref: 00DB60EB
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00DB613F
GetLastError.KERNEL32 ref: 00DB6149

Strings

Failed to get the required buffer length for the Date., xrefs: 00DB6110
Failed to get the Date., xrefs: 00DB616E
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6106, 00DB6164
Failed to allocate the buffer for the Date., xrefs: 00DB6127
Failed to set variant value., xrefs: 00DB6187

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 2700948981-3071540250
Opcode ID: 48424f2026081e7d38b4640a9f9eefdeeebeac56a6811f8763cd46a66a35b0b4
Instruction ID: 4b472d20785a2121cf05a80ad3da4d4df98b6973045befdeebc6f7c3cb66be38
Opcode Fuzzy Hash: 48424f2026081e7d38b4640a9f9eefdeeebeac56a6811f8763cd46a66a35b0b4
Instruction Fuzzy Hash: EE31B572E40329FBDB119BA9CC46EFF7A79AB04750F014126FA06F7281DA64DD0486F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE9E2 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00DB5506,?,?), ref: 00DCEA02
GetLastError.KERNEL32(?,00DB5506,?,?), ref: 00DCEA0F
CreateThread.KERNEL32(00000000,00000000,00DCE720,?,00000000,00000000), ref: 00DCEA68
GetLastError.KERNEL32(?,00DB5506,?,?), ref: 00DCEA75
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00DB5506,?,?), ref: 00DCEAB0
CloseHandle.KERNEL32(00000000,?,00DB5506,?,?), ref: 00DCEACF
CloseHandle.KERNEL32(?,?,00DB5506,?,?), ref: 00DCEADC

Strings

Failed to create the UI thread., xrefs: 00DCEAA0
c:\agent\_work\138\s\src\burn\user\uithread.cpp, xrefs: 00DCEA30, 00DCEA96
Failed to create initialization event., xrefs: 00DCEA3A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\138\s\src\burn\user\uithread.cpp
API String ID: 2351989216-616715975
Opcode ID: 090276d17914a98cb273e728581e2b848fb8b40da32067705cb5948ac6f166f0
Instruction ID: 537c955b08032db1683ee5d951b069b1b41b8b9a31fcf0a9b2f341f6286ac227
Opcode Fuzzy Hash: 090276d17914a98cb273e728581e2b848fb8b40da32067705cb5948ac6f166f0
Instruction Fuzzy Hash: 523164B6D4132ABFD711DB998C45FAEBBA8FF04760F15412AB905F7280D7309E008AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE5B5 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00DB5506,?,?), ref: 00DCE5D6
GetLastError.KERNEL32(?,?,00DB5506,?,?), ref: 00DCE5E3
CreateThread.KERNEL32(00000000,00000000,00DCE33A,00000000,00000000,00000000), ref: 00DCE642
GetLastError.KERNEL32(?,?,00DB5506,?,?), ref: 00DCE64F
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00DB5506,?,?), ref: 00DCE68A
CloseHandle.KERNEL32(?,?,?,00DB5506,?,?), ref: 00DCE69E
CloseHandle.KERNEL32(?,?,?,00DB5506,?,?), ref: 00DCE6AB

Strings

c:\agent\_work\138\s\src\burn\user\splashscreen.cpp, xrefs: 00DCE604, 00DCE670
Failed to create UI thread., xrefs: 00DCE67A
Failed to create modal event., xrefs: 00DCE60E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\138\s\src\burn\user\splashscreen.cpp
API String ID: 2351989216-1941576802
Opcode ID: 4aa35322351f440cabff39ec72f39ab8fba79c7c778a7ed7fe1d60d9ba3c340e
Instruction ID: 13eaa797f744536b4c69306d5fa48392c644e9162990ac8d65712665bb988ae8
Opcode Fuzzy Hash: 4aa35322351f440cabff39ec72f39ab8fba79c7c778a7ed7fe1d60d9ba3c340e
Instruction Fuzzy Hash: 193174B6D5032ABBD7119B99CC05EAFBBB8EF54710F11852AED11F7250D7308940CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD139A Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,76232F60,?,?), ref: 00DD13BE
GetLastError.KERNEL32 ref: 00DD13D1
GetExitCodeThread.KERNEL32(00DFB478,00000000), ref: 00DD1413
GetLastError.KERNEL32 ref: 00DD1421
ResetEvent.KERNEL32(00DFB450), ref: 00DD145C
GetLastError.KERNEL32 ref: 00DD1466

Strings

Failed to reset operation complete event., xrefs: 00DD1497
Failed to get extraction thread exit code., xrefs: 00DD1452
Failed to wait for operation complete event., xrefs: 00DD1402
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD13F8, 00DD1448, 00DD148D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2979751695-2767648441
Opcode ID: 13977c0b5fce1307e068ca690b395e1aca75af8b9fd38b0af73e724388e6195d
Instruction ID: 0b6418e0eebd715d075ab5a818111e371f9df83057ef24d825142cd5cfeecf9d
Opcode Fuzzy Hash: 13977c0b5fce1307e068ca690b395e1aca75af8b9fd38b0af73e724388e6195d
Instruction Fuzzy Hash: 42319178A4031AFBE7009B64DD05BBF77F8EB00711F14812AF445EA2A0EB71DA409B71

Uniqueness

Uniqueness Score: -1.00%

Function 00DD14B4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00DFB468,?,00000000,?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000,?), ref: 00DD14D1
GetLastError.KERNEL32(?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000,?,00DB5501,FFF9E89D,00DB5501), ref: 00DD14DB
WaitForSingleObject.KERNEL32(00DFB478,000000FF,?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000,?,00DB5501), ref: 00DD1515
GetLastError.KERNEL32(?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000,?,00DB5501,FFF9E89D,00DB5501), ref: 00DD151F
CloseHandle.KERNEL32(00000000,00DB5501,?,00000000,?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000), ref: 00DD156A
CloseHandle.KERNEL32(00000000,00DB5501,?,00000000,?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000), ref: 00DD1579
CloseHandle.KERNEL32(00000000,00DB5501,?,00000000,?,00DBC289,?,00DB5435,00000000,?,00DC7846,?,00DB56E5,00DB54F1,00DB54F1,00000000), ref: 00DD1588

Strings

Failed to wait for thread to terminate., xrefs: 00DD154D
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD14FF, 00DD1543
Failed to set begin operation event., xrefs: 00DD1509

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 1206859064-76747171
Opcode ID: cd2582cd3a512808ea11c6a97f2c5a16656622af04aee9a448224856a4b02474
Instruction ID: a5f2b1b99e69121cd1c037231f18e4766b267fa31ebb0686db451ea5b3fa7a87
Opcode Fuzzy Hash: cd2582cd3a512808ea11c6a97f2c5a16656622af04aee9a448224856a4b02474
Instruction Fuzzy Hash: FD21F337500726F7D7214B65EC09B56BAB0FF04721F094227E90AA6AD0D778ECA0CAF5

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0F42 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00DB5F1B,00000000), ref: 00DF0F57
GetProcAddress.KERNEL32(00000000), ref: 00DF0F5E
GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0F79
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,?,00DB5F1B,00000000), ref: 00DF0FBB
GetProcAddress.KERNEL32(00000000), ref: 00DF0FC2
GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0FD9

Strings

c:\agent\_work\138\s\src\libs\dutil\procutil.cpp, xrefs: 00DF0F9A
IsWow64Process, xrefs: 00DF0FB1
kernel32, xrefs: 00DF0F4F, 00DF0FB6
IsWow64Process2, xrefs: 00DF0F48

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$IsWow64Process2$c:\agent\_work\138\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-515427556
Opcode ID: f1b6c02071604c7ba7e1cdb8521d863e4e9e8b74300ec916cb262e4461e4afa3
Instruction ID: 34347dd29164058be18518280780440bd7e5aa3f2f55a235278e4a0a400e0cf9
Opcode Fuzzy Hash: f1b6c02071604c7ba7e1cdb8521d863e4e9e8b74300ec916cb262e4461e4afa3
Instruction Fuzzy Hash: 3F118E76A4137AABC7305B95DC09ABBBE68EF057A1B06C115BE05EB241EB60CD40C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4264 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00DF093D: EnterCriticalSection.KERNEL32(00E1C6EC,00000000,?,?,?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?), ref: 00DF094D
Part of subcall function 00DF093D: LeaveCriticalSection.KERNEL32(00E1C6EC,?,?,00E1C6E4,?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?), ref: 00DF0A94

OpenEventLogW.ADVAPI32(00000000,Application), ref: 00DC428A
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DC4296
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,00E03CC4,00000000), ref: 00DC42E3
CloseEventLog.ADVAPI32(00000000), ref: 00DC42EA

Strings

Application, xrefs: 00DC4284
Failed to open Application event log, xrefs: 00DC42C4
c:\agent\_work\138\s\src\burn\user\logging.cpp, xrefs: 00DC42BA
_Failed, xrefs: 00DC426F
Setup, xrefs: 00DC4274
txt, xrefs: 00DC426A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$Setup$_Failed$c:\agent\_work\138\s\src\burn\user\logging.cpp$txt
API String ID: 1844635321-3521639449
Opcode ID: 8a0e89dc0e57885cda39b5d23c7a84eda513696c8036d3e2c8b0f64c2a2b5844
Instruction ID: 89aba3d86ef8eefddfed3d35152f1c3d3667452dfe2457b2368b525b0456f9ae
Opcode Fuzzy Hash: 8a0e89dc0e57885cda39b5d23c7a84eda513696c8036d3e2c8b0f64c2a2b5844
Instruction Fuzzy Hash: D3F081329927727AA2312272AC1AE7B996CCED6F717014219FD11F62C1DB448D82C4B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DC93D4 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00DC9487
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 00DC94AF

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC94CF, 00DC95E3, 00DC9634
0, xrefs: 00DC9547
Could not verify file %ls., xrefs: 00DC95F0
Failed to allocate string., xrefs: 00DC951D
Failed to encode file hash., xrefs: 00DC953A
$, xrefs: 00DC9586
Failed to allocate memory, xrefs: 00DC9445
Failed to get file hash., xrefs: 00DC94D9
Could not close verify handle., xrefs: 00DC963E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 1452528299-4273620891
Opcode ID: d15b5d22952a424b69135bf05c10763bc148ab28814663bf5f462340bd4f528b
Instruction ID: 643a4cca57ab3b0cc1c11045d8f2db528dde2fba42a5c631ccc78e380c149acc
Opcode Fuzzy Hash: d15b5d22952a424b69135bf05c10763bc148ab28814663bf5f462340bd4f528b
Instruction Fuzzy Hash: 5E819E72D4022AABDB11DFA4C855FEEF7B8AF08710F15012AE905BB281E7349D418BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE4DC Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00DCE4E7
DefWindowProcW.USER32(?,00000082,?,?), ref: 00DCE525
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00DCE532
SetWindowLongW.USER32(?,000000EB,?), ref: 00DCE541
DefWindowProcW.USER32(?,?,?,?), ref: 00DCE54F
CreateCompatibleDC.GDI32(?), ref: 00DCE55B
SelectObject.GDI32(00000000,00000000), ref: 00DCE56C
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00DCE58E
SelectObject.GDI32(00000000,00000000), ref: 00DCE596
DeleteDC.GDI32(00000000), ref: 00DCE599
PostQuitMessage.USER32(00000000), ref: 00DCE5A7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 0c04cfde1c1094aa32e7138efca05a4e8a4a6051f501695830484c24c0d0b642
Instruction ID: abba031ee5bb1ba01a51145e951485b4fc84b68c0fb3cdd2d55f3d1678ede597
Opcode Fuzzy Hash: 0c04cfde1c1094aa32e7138efca05a4e8a4a6051f501695830484c24c0d0b642
Instruction Fuzzy Hash: D62178B2150205BFCB156FA8DC0DE7B3FA8EB49325B198619F616D72A1E7318810DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DCA113 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

Failed to copy source path., xrefs: 00DCA304
WixBundleLayoutDirectory, xrefs: 00DCA250
Failed to combine layout source with source., xrefs: 00DCA28A
Failed to get current process directory., xrefs: 00DCA1D6
WixBundleOriginalSource, xrefs: 00DCA197
Failed to combine last source with source., xrefs: 00DCA1F5
Failed to get bundle layout directory property., xrefs: 00DCA26B
WixBundleLastUsedSource, xrefs: 00DCA17C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: aa4da5980a4486362a5bd96306b425fc866342404760bc80c5a573efdca31ecf
Instruction ID: b4aec2d10f2e6d79d02e92ae9fc6e6a6162db8fbd43941e9e24bbce3b5b678b7
Opcode Fuzzy Hash: aa4da5980a4486362a5bd96306b425fc866342404760bc80c5a573efdca31ecf
Instruction Fuzzy Hash: 0D811572D0022AABCF15DFE9D841EEEBBB5AB08714F15012AE911B7260DB719D408BB5

Uniqueness

Uniqueness Score: -1.00%

Function 00DBCC73 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,00DB5435,00000000,00DB5501,00DB54BD,WixBundleUILevel,840F01E8,?,00000001), ref: 00DBCCCA

Strings

c:\agent\_work\138\s\src\burn\user\payload.cpp, xrefs: 00DBCDCB
Failed to extract file., xrefs: 00DBCD95
Failed to find embedded payload: %ls, xrefs: 00DBCCF6
Failed to get directory portion of local file path, xrefs: 00DBCDA3
Failed to concat file paths., xrefs: 00DBCDAA
Failed to get next stream., xrefs: 00DBCDB1
Payload was not found in container: %ls, xrefs: 00DBCDD7
Failed to ensure directory exists, xrefs: 00DBCD9C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\138\s\src\burn\user\payload.cpp
API String ID: 1825529933-3713461909
Opcode ID: 9f8814adb2cef8cbb520b292bb94dc00933c2565670de736d286773f02668ccb
Instruction ID: 08817712e946d46b9010ec748cba09b7b269ee058f5d9ff76e8513753f0f672e
Opcode Fuzzy Hash: 9f8814adb2cef8cbb520b292bb94dc00933c2565670de736d286773f02668ccb
Instruction Fuzzy Hash: 3241DC35910215EBCF249F99CC81AEEBBA5FF40720F14916AE856BB291D670DD80DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB481A Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00DB483F
GetCurrentThreadId.KERNEL32 ref: 00DB4845
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DB48D3

Strings

Unexpected return value from message pump., xrefs: 00DB4929
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00DB491F
Failed to create user for UX., xrefs: 00DB485F
Failed to start bootstrapper application., xrefs: 00DB48A1
Failed to load UX., xrefs: 00DB4888
wininet.dll, xrefs: 00DB4872

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\138\s\src\burn\user\user.cpp$wininet.dll
API String ID: 673430819-242469113
Opcode ID: 028029c1c62569ae79b7d39e60d5b68bf047a598ba3d46bc81108046e79b9dcb
Instruction ID: ac06c3e5e6d9ccdae5a7b531e99a31f3512f9ad1800754c851c6c9d0032dfd0e
Opcode Fuzzy Hash: 028029c1c62569ae79b7d39e60d5b68bf047a598ba3d46bc81108046e79b9dcb
Instruction Fuzzy Hash: 93414A7560061AEFEB15DAA4CC85EFA77ACEB04724F10412AF606E7291DB20ED158BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD9AC7 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00DDAE4C,?,00000001,00000000), ref: 00DD9B52
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00DDAE4C,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00DD9B5C
CopyFileExW.KERNEL32(00000000,00000000,00DD99A0,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00DD9BAA
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00DDAE4C,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00DD9BD9

Strings

Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00DD9C0B
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00DD9BD2
c:\agent\_work\138\s\src\burn\user\apply.cpp, xrefs: 00DD9B80, 00DD9BC4, 00DD9BFD
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00DD9B8B
copy, xrefs: 00DD9B20

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\138\s\src\burn\user\apply.cpp$copy
API String ID: 1969131206-384873077
Opcode ID: 6447cfdfd26e17ec7513f0c4c974524bc663e6f763dbad4c948bbce8b88a8515
Instruction ID: 12695c886f82fb569960658e65ff52f579da8805eb9d00c069da1cd327cb3515
Opcode Fuzzy Hash: 6447cfdfd26e17ec7513f0c4c974524bc663e6f763dbad4c948bbce8b88a8515
Instruction Fuzzy Hash: 6731D636A41325BBD7208E659C95E6BB668EF41B50B1A812BBD05EB391D662CD00C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC8E98 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00DC8FE3

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC8F8C
Failed to allocate access for Everyone group to path: %ls, xrefs: 00DC8F2D
Failed to allocate access for Users group to path: %ls, xrefs: 00DC8F4E
Failed to secure cache path: %ls, xrefs: 00DC8FC6
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00DC8F0C
Failed to allocate access for Administrators group to path: %ls, xrefs: 00DC8EEB
Failed to create ACL to secure cache path: %ls, xrefs: 00DC8F97

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 2826327444-1071548903
Opcode ID: 387cbcca84594b34ada651a76cf4a89330d3e7449f8b0ec7eef9a31ea99e9e51
Instruction ID: c787152bafde2cadad95bc63d5f2377787294434a1f7f362b56397d592b03a26
Opcode Fuzzy Hash: 387cbcca84594b34ada651a76cf4a89330d3e7449f8b0ec7eef9a31ea99e9e51
Instruction Fuzzy Hash: 4F31C032E4032AB6EB3196508C06FAE7669EF40B11F51406DBA44FB1C1DE70AE45E7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF701F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7622DFD0), ref: 00DF707E
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00DF709B
SysFreeString.OLEAUT32(00000000), ref: 00DF70D9
SysFreeString.OLEAUT32(00000000), ref: 00DF711D

Strings

name, xrefs: 00DF7070
`Dv, xrefs: 00DF70D9, 00DF711D
uri, xrefs: 00DF70A9
email, xrefs: 00DF708D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$CompareFree
String ID: `Dv$email$name$uri
API String ID: 3589242889-3963012511
Opcode ID: 24c4abc9bf3e5899f3a3bc59d7ce145bdbb99df162b4488a249b039d29ca7eaf
Instruction ID: 09c87639464e85a0cd6aea4657357cdf9a1207ae9644ccfdda5fc493c27dc420
Opcode Fuzzy Hash: 24c4abc9bf3e5899f3a3bc59d7ce145bdbb99df162b4488a249b039d29ca7eaf
Instruction Fuzzy Hash: 73411E75908219BBDF119B94CC45FFDB775AF04721F2682A4EA21BB1D0CB709E44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DBF4E6 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBF51F

Part of subcall function 00DB419A: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?), ref: 00DB41A8
Part of subcall function 00DB419A: GetLastError.KERNEL32(?,00DCA0C3,00000000,00000000,?,00000000,00DB5435,00000000,?,?,00DBD652,?,00000000,00000000), ref: 00DB41B6

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,00DC0545,swidtag,00000094,00DFB4F0,00330074,00DC0545,00000000,crypt32.dll,00000000), ref: 00DBF572

Part of subcall function 00DF51E2: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00DC0545,00000000,?,00DBF589,00DFB4F0,00000080,002E0032,00000000), ref: 00DF51FA
Part of subcall function 00DF51E2: GetLastError.KERNEL32(?,00DBF589,00DFB4F0,00000080,002E0032,00000000,?,00DC0545,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00DF5207

Strings

Failed to format tag folder path., xrefs: 00DBF5D8
Failed to allocate regid file path., xrefs: 00DBF5CA
Failed to write tag xml to file: %ls, xrefs: 00DBF5B0
Failed to create regid folder: %ls, xrefs: 00DBF5BA
crypt32.dll, xrefs: 00DBF50F, 00DBF54C, 00DBF54D
Failed to allocate regid folder path., xrefs: 00DBF5D1
swidtag, xrefs: 00DBF532

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: 572878e496ceb791a89fbc8509be0e0ae5b66857e8bbf05648194c979676a277
Instruction ID: 74fee5c9f1a4ccfcec7ca9d26f1bca26adb7ad834c3ca6776ccb095cfbf7fde0
Opcode Fuzzy Hash: 572878e496ceb791a89fbc8509be0e0ae5b66857e8bbf05648194c979676a277
Instruction Fuzzy Hash: 6A316032D01219FBCB219FA4CC41EEDBBF5EF04710F148166F912BA1A1D7719A509BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE223 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 00DCE259
GetLastError.KERNEL32 ref: 00DCE265
GetObjectW.GDI32(00000000,00000018,?), ref: 00DCE2AC
GetCursorPos.USER32(?), ref: 00DCE2CD
MonitorFromPoint.USER32(?,?,00000002), ref: 00DCE2DF
GetMonitorInfoW.USER32(00000000,?), ref: 00DCE2F5

Strings

c:\agent\_work\138\s\src\burn\user\splashscreen.cpp, xrefs: 00DCE289
Failed to load splash screen bitmap., xrefs: 00DCE293
(, xrefs: 00DCE2EC

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\138\s\src\burn\user\splashscreen.cpp
API String ID: 2342928100-1828971274
Opcode ID: 73a9f71e46350e2167b5838ff5f8210c817659081a8dedf3161cee12f5baff89
Instruction ID: 50d9aadf38d8efc85a51ae20403ebdb88f1b47dc9e6665721e6ffd2de5bd47ae
Opcode Fuzzy Hash: 73a9f71e46350e2167b5838ff5f8210c817659081a8dedf3161cee12f5baff89
Instruction Fuzzy Hash: 64311F75A403199BDB10CFA8D949BAEBBF4FF08711F548119E904EB281DB70E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC5143 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,00DFB4F0), ref: 00DC514C
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00DC51EA
CloseHandle.KERNEL32(00000000), ref: 00DC5203

Strings

open, xrefs: 00DC51B4, 00DC51C2
runas, xrefs: 00DC51AA
burn.elevated, xrefs: 00DC516C
Failed to allocate parameters for elevated process., xrefs: 00DC5185
-q -%ls %ls %ls %u, xrefs: 00DC5171
Failed to launch elevated child process: %ls, xrefs: 00DC51D7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: aa12ec6afe2732f88d6f99bfa8887d6d9d0c9545255f06fc73953cdc6294f990
Instruction ID: 88503e252c723d17bf89d931c393656459e23778b2f9b59ca153250322f42fd5
Opcode Fuzzy Hash: aa12ec6afe2732f88d6f99bfa8887d6d9d0c9545255f06fc73953cdc6294f990
Instruction Fuzzy Hash: 69217EB5D00719FFCF019F94D985DAEBBB8EF05350B04816AF611A3241C731AE90DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB6927 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00DB6951
GetProcAddress.KERNEL32(00000000), ref: 00DB6958
GetLastError.KERNEL32 ref: 00DB6962

Strings

Failed to get msi.dll version info., xrefs: 00DB69AA
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6986
Failed to set variant value., xrefs: 00DB69CE
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00DB6990
msi, xrefs: 00DB6948
DllGetVersion, xrefs: 00DB6943

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp$msi
API String ID: 4275029093-3800379381
Opcode ID: 5c6f33987a6a1c7ea29533c47a3cf071f90aecaa8c03ee53ecb16577b4e8fdb2
Instruction ID: 5d35899d4513638c973afb9c83d972517f40272b4d6bde05e7fa16c4ad2120bd
Opcode Fuzzy Hash: 5c6f33987a6a1c7ea29533c47a3cf071f90aecaa8c03ee53ecb16577b4e8fdb2
Instruction Fuzzy Hash: 3811E972E40339FADB105BA9DC06BBFBAA5DB04750B024426FE06F7280DA74ED0489F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD764 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00DB4882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DB5506,?), ref: 00DBD775
GetLastError.KERNEL32(?,00DB4882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DB5506,?,?), ref: 00DBD782
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00DBD7BA
GetLastError.KERNEL32(?,00DB4882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DB5506,?,?), ref: 00DBD7C6

Strings

Failed to create UX., xrefs: 00DBD80A
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00DBD7F1
Failed to load UX DLL., xrefs: 00DBD7AD
BootstrapperApplicationCreate, xrefs: 00DBD7B4
c:\agent\_work\138\s\src\burn\user\userexperience.cpp, xrefs: 00DBD7A3, 00DBD7E7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\138\s\src\burn\user\userexperience.cpp
API String ID: 1866314245-3647149291
Opcode ID: 2b171fa8cc5b916d716b0337e261ea5a78b60a8620ec5e214b76dd59f2905b33
Instruction ID: 3271c1d13161ecbf6d5212215d22ba0e107ec8c596a3c3a9ef9768d198c01bfd
Opcode Fuzzy Hash: 2b171fa8cc5b916d716b0337e261ea5a78b60a8620ec5e214b76dd59f2905b33
Instruction Fuzzy Hash: 6811943BA41732E7D72157949C09FEB7A95AF04B61F05812ABE57FB291FA20DC4086F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB1184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DB119D
GetLastError.KERNEL32(?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB11B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DB11C0
GetLastError.KERNEL32(?,?,?,?,?,00DB111A,cabinet.dll,00000009,?,?,00000000), ref: 00DB11D5

Strings

kernel32, xrefs: 00DB118A
SetDefaultDllDirectories, xrefs: 00DB1197
SetDllDirectoryW, xrefs: 00DB11BA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 40a63f407861246073b54389528e1242c0c66b67cee72a75520bb83aad6c3b28
Instruction ID: 788d38efba40359d159234eb7f332c05dfa4f8caa8a98b2b2e73779c312cff70
Opcode Fuzzy Hash: 40a63f407861246073b54389528e1242c0c66b67cee72a75520bb83aad6c3b28
Instruction Fuzzy Hash: 17015E3560031AFA9B106BAADC19DBF7B5CEB417A17058012BE16D2240EB74DA05CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF58A Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DCF59F
LeaveCriticalSection.KERNEL32(?), ref: 00DCF71A

Strings

user is active, cannot change user state., xrefs: 00DCF5B9
UX requested unknown container with id: %ls, xrefs: 00DCF644
UX requested unknown payload with id: %ls, xrefs: 00DCF5F4
Failed to set download URL., xrefs: 00DCF679
Failed to set download password., xrefs: 00DCF6C8
UX did not provide container or payload id., xrefs: 00DCF709
Failed to set download user., xrefs: 00DCF6A2
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00DCF60A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: user is active, cannot change user state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: c0e879f14c9ea92dc2b74dbbcd6bdd8209e61279853cb12020a4b2b70b728715
Instruction ID: 7c47c97c59015f674e9368c457d955eb4d524d7e4167b27a2c90b460cc1ecb3b
Opcode Fuzzy Hash: c0e879f14c9ea92dc2b74dbbcd6bdd8209e61279853cb12020a4b2b70b728715
Instruction Fuzzy Hash: DF41BF32A40317EBCB119F64D846FEA77BAEF00710B19817AF405E7291EB71DD5086B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5A73 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DE5A89

Part of subcall function 00DE604F: HeapFree.KERNEL32(00000000,00000000,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?), ref: 00DE6065
Part of subcall function 00DE604F: GetLastError.KERNEL32(?,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?,?), ref: 00DE6077

_free.LIBCMT ref: 00DE5A95
_free.LIBCMT ref: 00DE5AA0
_free.LIBCMT ref: 00DE5AAB
_free.LIBCMT ref: 00DE5AB6
_free.LIBCMT ref: 00DE5AC1
_free.LIBCMT ref: 00DE5ACC
_free.LIBCMT ref: 00DE5AD7
_free.LIBCMT ref: 00DE5AE2
_free.LIBCMT ref: 00DE5AF0

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0171dc21aa90f8870ddb5a15ac92af2a49809c209d4846700d183fa99da4b9ca
Instruction ID: ff70e27e447e079a2b306be9185d2eacc464e54cde35b4a87913a74010184c57
Opcode Fuzzy Hash: 0171dc21aa90f8870ddb5a15ac92af2a49809c209d4846700d183fa99da4b9ca
Instruction Fuzzy Hash: 7E21EB76900158AFCB51FF95C891CDD7BB9FF48381F0051A6F5099B122DB36EA84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF5E6C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00DF5EA9
GetLastError.KERNEL32 ref: 00DF5EB7
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00DF5EF8
GetLastError.KERNEL32 ref: 00DF5F05
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DF6078
CloseHandle.KERNEL32(?), ref: 00DF6087

Strings

GET, xrefs: 00DF5FAC
c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF5EDB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-1175425030
Opcode ID: 6071aeca2c936380787a688712ed61170a9b9d817224afb2374e1648187bb751
Instruction ID: 4066dc01c7b9894ec67bb77e27d260c8295e8a1c750e6b3638f8798ad1aa1681
Opcode Fuzzy Hash: 6071aeca2c936380787a688712ed61170a9b9d817224afb2374e1648187bb751
Instruction Fuzzy Hash: FD61497290061EABDB21CFA4DC45BFE7BB8AF08764F168159FF15E6240DB74D9408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC0CD4 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00DC10A0: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00DC0CF3,?,00000000,?,00000000,00000000), ref: 00DC10CF

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00DC0E77
GetLastError.KERNEL32 ref: 00DC0E84

Strings

c:\agent\_work\138\s\src\burn\user\plan.cpp, xrefs: 00DC0EA8
Failed to create syncpoint event., xrefs: 00DC0EB2
Failed to append payload cache action., xrefs: 00DC0E2E
Failed to append rollback cache action., xrefs: 00DC0D53
Failed to append cache action., xrefs: 00DC0DCE
Failed to append package start action., xrefs: 00DC0D19

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\138\s\src\burn\user\plan.cpp
API String ID: 801187047-4180891441
Opcode ID: 09662f8111e9cdac11d70f4bd913ea3debe427d7d14e3348dbcd0de384a54464
Instruction ID: 23ad481cdf393b6441119608e3503802a32b54271a5401a34c943238c4703217
Opcode Fuzzy Hash: 09662f8111e9cdac11d70f4bd913ea3debe427d7d14e3348dbcd0de384a54464
Instruction Fuzzy Hash: E061407950070AEFCB15DF54C880EAABBF9EF84310B25845EE9159B251DB31EE41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DF72F1 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7622DFD0,000000FF,type,000000FF,?,7622DFD0,7622DFD0,7622DFD0), ref: 00DF7347
SysFreeString.OLEAUT32(00000000), ref: 00DF7392
SysFreeString.OLEAUT32(00000000), ref: 00DF740E
SysFreeString.OLEAUT32(00000000), ref: 00DF745A

Strings

url, xrefs: 00DF735A
`Dv, xrefs: 00DF7392, 00DF740E, 00DF745A
type, xrefs: 00DF7339

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$Free$Compare
String ID: `Dv$type$url
API String ID: 1324494773-3411263640
Opcode ID: 2698d339fe1337f130e7568dd37282e36352db366baf875d267cfc68b55c76fe
Instruction ID: cf07259b06def448a5df569bfed3b08feb37d73f4c2c50c0a8d62fd0dd9a28b2
Opcode Fuzzy Hash: 2698d339fe1337f130e7568dd37282e36352db366baf875d267cfc68b55c76fe
Instruction Fuzzy Hash: 94511B35905219FBCB15DBA4C845EFEBBB8EF04715F1682A5EA11EB260D7309E40DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9F7A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9FA0
_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9FC5

Strings

Failed to set variable., xrefs: 00DBA0A9
Failed to format component id string., xrefs: 00DB9FAB
Failed to get component path: %d, xrefs: 00DBA029
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00DBA0B9
Failed to format product code string., xrefs: 00DB9FD0

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: fd46feb3082457f69d7a1289a69d8f5f554a85c4054eda605c786aba22efe6cf
Instruction ID: 50f53c5b393d8c77b37f45ee06837907ee4fef75c26c5756e7efbd9c6c98533c
Opcode Fuzzy Hash: fd46feb3082457f69d7a1289a69d8f5f554a85c4054eda605c786aba22efe6cf
Instruction Fuzzy Hash: 5341E332900119FECB31BA6C8C56FFEB6A8EF04310F294516F613E61A5E731D944D672

Uniqueness

Uniqueness Score: -1.00%

Function 00DC49A6 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,00000000,crypt32.dll,00000000), ref: 00DC49D1
GetLastError.KERNEL32 ref: 00DC49DE
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 00DC4A89
GetLastError.KERNEL32 ref: 00DC4A93

Strings

Failed to read message from pipe., xrefs: 00DC4A5E
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC4A3D, 00DC4A54, 00DC4AB7
Failed to read data for message., xrefs: 00DC4AC1
Failed to allocate data for message., xrefs: 00DC4A47

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 1948546556-2975516947
Opcode ID: 31533ac67cca1acbac8aa5934c907df0eff2e2dcd5000ee0800486ab7e7b26d4
Instruction ID: 2095cf69356c9e85c662548c02a64b8ff54d088f80522bc462848c1ea9a9a56d
Opcode Fuzzy Hash: 31533ac67cca1acbac8aa5934c907df0eff2e2dcd5000ee0800486ab7e7b26d4
Instruction Fuzzy Hash: D831C472D80326BBD7109AA4CD55FAEBA68EB00769F11812DF951F7280D770DE408BF8

Uniqueness

Uniqueness Score: -1.00%

Function 00DC5455 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00DB5506,00000000,00000000,?,00000000), ref: 00DC54FE
GetLastError.KERNEL32(?,?,?,00DB4CE1,?,?,00000000,?,?,?,?,?,?,00DFB490,?,?), ref: 00DC5509

Strings

Failed to write exit code to message buffer., xrefs: 00DC5479
Failed to write restart to message buffer., xrefs: 00DC54A1
Failed to wait for child process exit., xrefs: 00DC5537
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC552D
Failed to post terminate message to child process., xrefs: 00DC54E9
Failed to post terminate message to child process cache thread., xrefs: 00DC54CD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 1211598281-48580095
Opcode ID: cf9a841db64c12ee7a56c12a183525f6ebe6ddcb99d495a1c99086e82e665458
Instruction ID: 1e1337bc2449c3ab5f30ba825bda584d279c0b3c26c0c6b91c4373c90566af33
Opcode Fuzzy Hash: cf9a841db64c12ee7a56c12a183525f6ebe6ddcb99d495a1c99086e82e665458
Instruction Fuzzy Hash: 8E21C172944B2BBBCB125B90EC05FAE7A69EF00361F214269F910B71D4D730AED097B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DC9072 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00DC9EE1,00000003,000007D0,00000003,?,000007D0), ref: 00DC908C
GetLastError.KERNEL32(?,00DC9EE1,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 00DC9099
CloseHandle.KERNEL32(00000000,?,00DC9EE1,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 00DC9161

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC90D0
Failed to verify signature of payload: %ls, xrefs: 00DC9109
Failed to verify hash of payload: %ls, xrefs: 00DC914C
Failed to verify catalog signature of payload: %ls, xrefs: 00DC9128
Failed to open payload at path: %ls, xrefs: 00DC90DD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 2528220319-2587096086
Opcode ID: a85c8e2ba56101493a5ad8f2369b2eff93651d70205e3c4550ad5069f810cf16
Instruction ID: 934dc562a94cd35ba62d9c3075a03015c78dfd4a5148d3d4803c75cb190966ef
Opcode Fuzzy Hash: a85c8e2ba56101493a5ad8f2369b2eff93651d70205e3c4550ad5069f810cf16
Instruction Fuzzy Hash: B721D332940727B7CB2226548C5EF6BBB18EF017B1F19821AF9556729097329C60D6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB6BD7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00DB6C22
GetLastError.KERNEL32 ref: 00DB6C2C
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00DB6C70
GetLastError.KERNEL32 ref: 00DB6C7A

Strings

Failed to get volume path name., xrefs: 00DB6CA8
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB6C50, 00DB6C9E
Failed to set variant value., xrefs: 00DB6CC4
Failed to get windows directory., xrefs: 00DB6C5A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 124030351-3909613369
Opcode ID: 4d37bbd698b7ea63039f03c51736430ef430ca3fbcb838b3caab83e3f748780d
Instruction ID: 6c838feb1b6ed4982b4587e3b01d176867a7e2df159ba5deb172f3018a5db013
Opcode Fuzzy Hash: 4d37bbd698b7ea63039f03c51736430ef430ca3fbcb838b3caab83e3f748780d
Instruction Fuzzy Hash: F821E576D41338A7D72097559C0AFEA7A6CDB40B20F068166BE46F7281DA78ED0486F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9D1E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9D37
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00DBA95B,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00DB9D4F
GetLastError.KERNEL32(?,00DBA95B,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00DB9D5C

Strings

Failed to set variable., xrefs: 00DB9DE5
c:\agent\_work\138\s\src\burn\user\search.cpp, xrefs: 00DB9D8C
Failed to format variable string., xrefs: 00DB9D42
Failed get to file attributes. '%ls', xrefs: 00DB9D99
File search: %ls, did not find path: %ls, xrefs: 00DB9DAE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\138\s\src\burn\user\search.cpp
API String ID: 1811509786-3251416904
Opcode ID: fef295632a0bf3d3cdcc6dc6ff85d4f6ef99cb3bf662147e58c91a56aae2736a
Instruction ID: 1052f677a9da1657e13ccf0ea04bf931e39c5d5c93545c21271a14ca44a06ba4
Opcode Fuzzy Hash: fef295632a0bf3d3cdcc6dc6ff85d4f6ef99cb3bf662147e58c91a56aae2736a
Instruction Fuzzy Hash: F8212533900225FBCB1126658C17BFEFA65EF00720F228115FF03A61A1EB619D1096F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCAD19 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00DCAD30
GetLastError.KERNEL32 ref: 00DCAD3A
CoInitializeEx.OLE32(00000000,00000000), ref: 00DCAD79
CoUninitialize.OLE32(?,00DCC6D1,?,?), ref: 00DCADB6

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00DCAD68
c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00DCAD5E
Failed to initialize COM., xrefs: 00DCAD85
Failed to pump messages in child process., xrefs: 00DCADA4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 876858697-4171771178
Opcode ID: 7c4de12b30ab509dec057104f8ad461aa4e8945fa1cffe92dc8e5da546a80694
Instruction ID: 4408c83ad740512802a98884ecd65da33a6dd078187e50d4af19aea25ca63129
Opcode Fuzzy Hash: 7c4de12b30ab509dec057104f8ad461aa4e8945fa1cffe92dc8e5da546a80694
Instruction Fuzzy Hash: 3E11E37294173ABB86211748EC0AEABAE68EF01B71701411AFD46F7650FB60AD0086F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB5D4F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00DB5DD5

Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00DF15E7
Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00DF161F

Strings

ProgramFilesDir, xrefs: 00DB5D64
CommonFilesDir, xrefs: 00DB5D5D, 00DB5D91, 00DB5DA0
Failed to ensure path was backslash terminated., xrefs: 00DB5DBF
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00DB5D72
+, xrefs: 00DB5D57
Failed to read folder path for '%ls'., xrefs: 00DB5DA1
Failed to open Windows folder key., xrefs: 00DB5D87

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 83010fe15cbe2277d4d369d6f7c39063f37b62fcaf3b9c806e9402b965213a6e
Instruction ID: af35782afe5b1baf2cc591500f3e5223496b43da8fc43da7fb6263a8f38be8c8
Opcode Fuzzy Hash: 83010fe15cbe2277d4d369d6f7c39063f37b62fcaf3b9c806e9402b965213a6e
Instruction Fuzzy Hash: 9401F53290062CFBCB126741FC0ABFE7A7ACF44760F1A8215FA01B6255DA70CE00D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA0B6 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 00DDA183
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 00DDA18D

Strings

:, xrefs: 00DDA206
c:\agent\_work\138\s\src\burn\user\apply.cpp, xrefs: 00DDA1B1
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00DDA1BC
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00DDA26A
download, xrefs: 00DDA14D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\138\s\src\burn\user\apply.cpp$download
API String ID: 1799206407-3795046138
Opcode ID: ef97b29fe4f0fc0593ff73b6722b9f1b42a14e486003bf9f77eed65c4b64000f
Instruction ID: 73f5265fd0259a1c495f3a0a3ab150c974a1cb47e00a93118dd66b3e2b5bacb3
Opcode Fuzzy Hash: ef97b29fe4f0fc0593ff73b6722b9f1b42a14e486003bf9f77eed65c4b64000f
Instruction Fuzzy Hash: 42517D75A00619ABDB20DFA9C841EAEBBB5FF05710F14C05AE905EB350E775DA40CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DF88A5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00DD8EAF,000002C0,00000100), ref: 00DF88D3
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00DD8EAF,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00DF88EE

Strings

application, xrefs: 00DF88E0
http://appsyndication.org/2006/appsyn, xrefs: 00DF88C6
c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp, xrefs: 00DF8989
type, xrefs: 00DF8915

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\138\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-2726911551
Opcode ID: a3be81cbc251e7bd01165af4b6a86788cbb07c1a5309572850847258b38fc2fb
Instruction ID: e38c4b992abaea0bbe23f8f87aff5f5e26fb0769784afa666522166d19780dad
Opcode Fuzzy Hash: a3be81cbc251e7bd01165af4b6a86788cbb07c1a5309572850847258b38fc2fb
Instruction Fuzzy Hash: 06519031644709EBDB208E54CC81F7A77A5EB00760F25C519FA66EB2D5DBB0E940EB32

Uniqueness

Uniqueness Score: -1.00%

Function 00DF68BB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DF6917
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00DF6A0E
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00DF6A1D

Strings

WiX\Burn, xrefs: 00DF6955
Burn, xrefs: 00DF6906
c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF693B
DownloadTimeout, xrefs: 00DF6950

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-4112428647
Opcode ID: 40d91cc82b73e26133b1b10fa7748327c3e563f90cfc8c03dc4143d3b11addd7
Instruction ID: 2fed5529f053d2ac5b50b3363940e3123a236494733ec9a95dbf90ed75b5174d
Opcode Fuzzy Hash: 40d91cc82b73e26133b1b10fa7748327c3e563f90cfc8c03dc4143d3b11addd7
Instruction Fuzzy Hash: 23510476940219BBDB12DFA4CC45EFEBBB9EB08710F058166FA15F6190E731CA509BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC925F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00DC92ED

Part of subcall function 00DF5AE9: GetLastError.KERNEL32(?,?,00DC9312,?,00000003,00DB5501,?), ref: 00DF5B08

_memcmp.LIBVCRUNTIME ref: 00DC9327
GetLastError.KERNEL32 ref: 00DC939F

Strings

Failed to get certificate public key identifier., xrefs: 00DC93CD
c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC93C3
Failed to read certificate thumbprint., xrefs: 00DC9393
Failed to find expected public key in certificate chain., xrefs: 00DC9362

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 3428363238-3530351678
Opcode ID: d320781a91b9fb28adbfda6cfc51f94206288c977ec95f330bee594cb8e80b51
Instruction ID: 9ca4b76dd625b48044d5364c58658cf49f1f76470bd758ce885536c857cba481
Opcode Fuzzy Hash: d320781a91b9fb28adbfda6cfc51f94206288c977ec95f330bee594cb8e80b51
Instruction Fuzzy Hash: 31416E72E00216ABDB10DBA9C855FAEF7B8BF08710F15406AE945FB291D734ED008BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DC0626 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 00DC0757
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 00DC0766

Part of subcall function 00DF10B8: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00DC069E,?,00000000,00020006), ref: 00DF10DD

Strings

%ls.RebootRequired, xrefs: 00DC0674
Failed to update resume mode., xrefs: 00DC073B
Failed to delete registration key: %ls, xrefs: 00DC0705
Failed to open registration key., xrefs: 00DC079C
Failed to write volatile reboot required registry key., xrefs: 00DC06A2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: 5414fcc001fadfda0b62bfa189b0d93a384b6c9ce660349974db5f05373b1fbc
Instruction ID: b80451de8613f8602ee7ef81d2b91a25df85ab6fafbdd89f4148c1102486b4fa
Opcode Fuzzy Hash: 5414fcc001fadfda0b62bfa189b0d93a384b6c9ce660349974db5f05373b1fbc
Instruction Fuzzy Hash: F041703584061AFBDF26AFA0DC46FAE7BB5EF80311F14401DF945620A2D771AA50DA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBF8A1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00DBF9D1
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00DBF9DE

Strings

%ls.RebootRequired, xrefs: 00DBF8BE
Resume, xrefs: 00DBF945
Failed to read Resume value., xrefs: 00DBF967
Failed to format pending restart registry key to read., xrefs: 00DBF8D5
Failed to open registration key., xrefs: 00DBF93A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: b15da2f5495fad2ef29ef477003a5fb414f8cd21667ba335fe82ccca1a55e613
Instruction ID: fb93af729041a41b97144e23ee1f0167c759745344cdcad83705579d35d97020
Opcode Fuzzy Hash: b15da2f5495fad2ef29ef477003a5fb414f8cd21667ba335fe82ccca1a55e613
Instruction Fuzzy Hash: 29414A36904219FFDF119F98CC81BEDBBB5EB00314F258166E852AB251C371AE909FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD383B Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DD38A2

Strings

feclient.dll, xrefs: 00DD387D, 00DD389E
%s%="%s", xrefs: 00DD38D5
Failed to escape string., xrefs: 00DD3924
Failed to format property string part., xrefs: 00DD391D
Failed to append property string part., xrefs: 00DD3916
Failed to format property value., xrefs: 00DD392B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.$feclient.dll
API String ID: 3613110473-656185529
Opcode ID: 7db952eda11a1d9f191b893a5584ec250a7873e65c2c9f47a5adc1fb40a35681
Instruction ID: 64afcdfa513a66a0b72454089e481bb7aa6e2baa406a1830921e453143638350
Opcode Fuzzy Hash: 7db952eda11a1d9f191b893a5584ec250a7873e65c2c9f47a5adc1fb40a35681
Instruction Fuzzy Hash: 46317C72D05225FBCB159F94C851AAEB768EF00714F14416AF80266391D7B09F50DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCA9E4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

Failed to determine length of relative path., xrefs: 00DCAA31
Failed to determine length of source path., xrefs: 00DCAA14
Failed to set last source., xrefs: 00DCAAD4
Failed to trim source folder., xrefs: 00DCAA79
WixBundleLastUsedSource, xrefs: 00DCAA83, 00DCAA89, 00DCAAC5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 9eea3d9d79926259518cdead6323f6c07c9695b86ceb31244fcd20f4f93ecc89
Instruction ID: d33cac449574cf2ad9026bd8f187c4f8b3d4f61c8988d2a1a4a52c9aab574b46
Opcode Fuzzy Hash: 9eea3d9d79926259518cdead6323f6c07c9695b86ceb31244fcd20f4f93ecc89
Instruction Fuzzy Hash: B731733294422EFBCF119A98CD41FAEBBB9DB40724F21426AF811F71D0DA719D50D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD684 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00E11228,00000000,00000017,00E11238,?,?,00000000,00000000,?,?,?,?,?,00DDDCAA,00000000,00000000), ref: 00DDD6BC

Strings

WixBurn, xrefs: 00DDD6E7
Failed to set BITS job to foreground., xrefs: 00DDD73D
Failed to create IBackgroundCopyManager., xrefs: 00DDD6C8
Failed to create BITS job., xrefs: 00DDD6F6
Failed to set notification flags for BITS job., xrefs: 00DDD70E
Failed to set progress timeout., xrefs: 00DDD726

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: 4c72d64bdd51f060ec8ce5b77ea6d4a23aeed0505dbdd9c1dba617118038cd6c
Instruction ID: 9746cd306bfb3f2c89df609cdf30de61be680e5d4d97f4d648dd66c686a8ef76
Opcode Fuzzy Hash: 4c72d64bdd51f060ec8ce5b77ea6d4a23aeed0505dbdd9c1dba617118038cd6c
Instruction Fuzzy Hash: 36318231A40319AFDB15CB69C845DBFBBF5AF48710B00419AEA06FB360DA70EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF61B8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00DF6202
GetLastError.KERNEL32 ref: 00DF620F
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00DF6256
GetLastError.KERNEL32 ref: 00DF628A
CloseHandle.KERNEL32(00000000,c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 00DF62BE

Strings

c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF6233, 00DF62AE
%ls.R, xrefs: 00DF61D6

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-1562451261
Opcode ID: fd11c24b1ab8f5527065d90f638434355949dd1a4f18cc6f688f6a3ac10b30b3
Instruction ID: 59f66c977863ff6f8c3f70624ea58156042acf21f1be9a850e8268677cffc402
Opcode Fuzzy Hash: fd11c24b1ab8f5527065d90f638434355949dd1a4f18cc6f688f6a3ac10b30b3
Instruction Fuzzy Hash: 7D31C472941328ABE7208B94CC45BBE7A64AB05730F16C215FE11EB6C0D770DC0097B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DBC996 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DBCE0A: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,00DBE4DA,000000FF,00000000,00000000,00DBE4DA,?,?,00DBDC82,?,?,?,?), ref: 00DBCE35

CreateFileW.KERNEL32(E900DFBA,80000000,00000005,00000000,00000003,08000000,00000000,00DB543D,?,00000000,840F01E8,E0680A79,00000001,00DB5435,00000000,00DB5501), ref: 00DBCA06
GetLastError.KERNEL32(?,?,?,00DC7802,00DB56E5,00DB54F1,00DB54F1,00000000,?,00DB5501,FFF9E89D,00DB5501,00DB5535,00DB54BD,?,00DB54BD), ref: 00DBCA4B

Strings

Failed to get catalog local file path, xrefs: 00DBCA89
c:\agent\_work\138\s\src\burn\user\catalog.cpp, xrefs: 00DBCA6C
Failed to open catalog in working path: %ls, xrefs: 00DBCA79
Failed to find payload for catalog file., xrefs: 00DBCA90
Failed to verify catalog signature: %ls, xrefs: 00DBCA44

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\138\s\src\burn\user\catalog.cpp
API String ID: 1774366664-1365303238
Opcode ID: bb6ea9f58dff90a4134d10e7b0bdc48f0ef9d65f7617893ff9b6685acdabf6f4
Instruction ID: eb90f6a3ac6f33c0699d01899f7112c97084a2dc0b03daba726f0031f6f33f55
Opcode Fuzzy Hash: bb6ea9f58dff90a4134d10e7b0bdc48f0ef9d65f7617893ff9b6685acdabf6f4
Instruction Fuzzy Hash: 2831A432910629FFD711DB64CC46FA9BAA4FF04750F158125F916EB240E670ED5097B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0D4F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00DF0DBF
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00DF0DC9
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 00DF0E12
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00DF0E1F

Strings

c:\agent\_work\138\s\src\libs\dutil\procutil.cpp, xrefs: 00DF0DED
"%ls" %ls, xrefs: 00DF0D88
D, xrefs: 00DF0DA7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\138\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-337939606
Opcode ID: 60085f20c7fa4604baa390542ea8b9fcf373bf2dc26a313b645be8de2112d08f
Instruction ID: 7723a8e9b5b467fa2e49348a28c3a4c09634ede350e9d54e5f3a6cbfcc2df1ad
Opcode Fuzzy Hash: 60085f20c7fa4604baa390542ea8b9fcf373bf2dc26a313b645be8de2112d08f
Instruction Fuzzy Hash: F22108B690121EEBDB119FE4CD419FEBBB8EF04754F158426EA01B7211D7709E44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD129 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,00DDD425,?), ref: 00DDD148
ReleaseMutex.KERNEL32(?,?,?,00DDD425,?), ref: 00DDD15C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DDD1A1
ReleaseMutex.KERNEL32(?), ref: 00DDD1B4
SetEvent.KERNEL32(?), ref: 00DDD1BD

Strings

Failed to get message from netfx chainer., xrefs: 00DDD1DE
Failed to send files in use message from netfx chainer., xrefs: 00DDD201

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 923004e94b9228a9ba71563b4918703553cbfcb01f992b4f255a0590711eeabc
Instruction ID: d9472b0a6dfbd6fb53236a5efdf742e9dee613937dd3d7fda9e8b3d408496a58
Opcode Fuzzy Hash: 923004e94b9228a9ba71563b4918703553cbfcb01f992b4f255a0590711eeabc
Instruction Fuzzy Hash: E431913250061AAFDF019F94CC45EFEBBB9EF05324F148266F511A6251C774D9509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9C4D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9C66
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00DBA971,00000100,000002C0,000002C0,00000100), ref: 00DB9C86
GetLastError.KERNEL32(?,00DBA971,00000100,000002C0,000002C0,00000100), ref: 00DB9C91

Strings

Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00DB9CFD
Failed to format variable string., xrefs: 00DB9C71
Failed to set directory search path variable., xrefs: 00DB9CC2
Failed while searching directory search: %ls, for path: %ls, xrefs: 00DB9CE7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: f1c071abe164c6a6d9f7d4e52cf1a9469ee6b2f6a32ad6b831901b1b3c2f4a6b
Instruction ID: 33ae94c31e6329a614829a60b215d9f4dc4337909b63eac267432712dd799d2e
Opcode Fuzzy Hash: f1c071abe164c6a6d9f7d4e52cf1a9469ee6b2f6a32ad6b831901b1b3c2f4a6b
Instruction Fuzzy Hash: C811F633840169F7CB222794DD12BEDFE65DF41760F218116FE12B62A1D7229E10A6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9E02 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9E1B
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00DBA949,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00DB9E3B
GetLastError.KERNEL32(?,00DBA949,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00DB9E46

Strings

Failed to set variable to file search path., xrefs: 00DB9E9E
Failed while searching file search: %ls, for path: %ls, xrefs: 00DB9E74
Failed to format variable string., xrefs: 00DB9E26
File search: %ls, did not find path: %ls, xrefs: 00DB9EAA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 3d969f30b966044d909add7d6267f607730209ff53c615cc07abee72b87544bc
Instruction ID: 826dbede0869555f89a9160c3857232875d6d525a4e66356a9ab086661b41c0f
Opcode Fuzzy Hash: 3d969f30b966044d909add7d6267f607730209ff53c615cc07abee72b87544bc
Instruction Fuzzy Hash: 0E110533842165FBDB22A7A4DD12BEEFB24DF10720F254101FE16A61A19732DE10AAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCCECF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE), ref: 00DCCEE1
GetLastError.KERNEL32(?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE,?,?,?), ref: 00DCCEEB
GetExitCodeThread.KERNEL32(?,?,?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE,?), ref: 00DCCF27
GetLastError.KERNEL32(?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE,?,?,?), ref: 00DCCF31

Strings

Failed to get cache thread exit code., xrefs: 00DCCF5F
c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00DCCF0F, 00DCCF55
Failed to wait for cache thread to terminate., xrefs: 00DCCF19

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 3686190907-884696695
Opcode ID: 39450d0df1485fa3ef09718af920c941e2695d691bb511e483a7fe1fdea23f32
Instruction ID: bb194e27353c841174f25c9af64185b6873d504ea4be47fa15b16510f440fbe7
Opcode Fuzzy Hash: 39450d0df1485fa3ef09718af920c941e2695d691bb511e483a7fe1fdea23f32
Instruction Fuzzy Hash: 7E01F573E62336A3D22157949C0AF6B6954AF00BA1B02801EFE49FB2C0EB24DD0081F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DC699E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00DC6ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00DC69AB
GetLastError.KERNEL32(?,00DC6ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00DC69B5
GetExitCodeThread.KERNEL32(00000001,00000000,?,00DC6ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00DC69F4
GetLastError.KERNEL32(?,00DC6ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00DC69FE

Strings

Failed to get cache thread exit code., xrefs: 00DC6A2F
c:\agent\_work\138\s\src\burn\user\core.cpp, xrefs: 00DC69DC, 00DC6A25
Failed to wait for cache thread to terminate., xrefs: 00DC69E6

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\138\s\src\burn\user\core.cpp
API String ID: 3686190907-1666294930
Opcode ID: 02cc805ab74f2c6108169746a8cb54c68de35f6134096ed4fd0473c45604abb0
Instruction ID: 5beecf722c81e75160997f8b9f0c35761caaa15b0c485df9a25ce6aeb7c1c20b
Opcode Fuzzy Hash: 02cc805ab74f2c6108169746a8cb54c68de35f6134096ed4fd0473c45604abb0
Instruction Fuzzy Hash: 49111B7064030AFBEB009F65DD06F7E7AA8AF00754F10806AB945FA1A0EB75DE50AA74

Uniqueness

Uniqueness Score: -1.00%

Function 00DCAB80 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00DB5501,000000FF,00DB54BD,00DC7802,00DB5435,00000000,?), ref: 00DCAC71
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00DB5501,000000FF,00DB54BD,00DC7802,00DB5435,00000000,?), ref: 00DCACB5

Part of subcall function 00DC925F: _memcmp.LIBVCRUNTIME ref: 00DC92ED
Part of subcall function 00DC925F: _memcmp.LIBVCRUNTIME ref: 00DC9327

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DCAC47, 00DCAC95, 00DCACD9
Failed to verify expected payload against actual certificate chain., xrefs: 00DCACF9
Failed authenticode verification of payload: %ls, xrefs: 00DCAC52
0, xrefs: 00DCABED
Failed to get signer chain from authenticode certificate., xrefs: 00DCACE3
Failed to get provider state from authenticode certificate., xrefs: 00DCAC9F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 3428363238-2467084736
Opcode ID: f610ad5a7ba69adf07f659d44a74dc61f05abd20bea048adfcf37fadf4884114
Instruction ID: 8fcac8b4a94836baf65caa7253c9733766110926e55e8ebc18f123b5b6a30603
Opcode Fuzzy Hash: f610ad5a7ba69adf07f659d44a74dc61f05abd20bea048adfcf37fadf4884114
Instruction Fuzzy Hash: 7C419376D0032AABDB109F99C945BEEBAB8EF04314F11422EF845BB281D7749D008BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF728 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DCF73D
LeaveCriticalSection.KERNEL32(?), ref: 00DCF84A

Strings

user is active, cannot change user state., xrefs: 00DCF757
UX requested unknown container with id: %ls, xrefs: 00DCF809
UX requested unknown payload with id: %ls, xrefs: 00DCF7A9
Failed to set source path for container., xrefs: 00DCF82F
Failed to set source path for payload., xrefs: 00DCF7D9
UX denied while trying to set source on embedded payload: %ls, xrefs: 00DCF7BF

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: user is active, cannot change user state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: fce3a4dfe86ed31b8b79710c85a8aa35f22896b19d901563c8a20f2578dc8819
Instruction ID: 8df7004643282e7b01f6efaf57f413823384815beb2873b9011de50b99361c13
Opcode Fuzzy Hash: fce3a4dfe86ed31b8b79710c85a8aa35f22896b19d901563c8a20f2578dc8819
Instruction Fuzzy Hash: 8931D4B2A00316ABCB219B94D84AEEA77B9DF54720719813AF805E7381DB65ED4086B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB72B1 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00DB72C4

Strings

Failed to format escape sequence., xrefs: 00DB735E
Failed to append characters., xrefs: 00DB7350
Failed to copy string., xrefs: 00DB7378
Failed to allocate buffer for escaped string., xrefs: 00DB72DB
[]{}, xrefs: 00DB72EE
[\%c], xrefs: 00DB7323
Failed to append escape sequence., xrefs: 00DB7357

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 2f94c131fad34fba066c271928ceeb292dfd82a49125e4d9117790a172f97d8e
Instruction ID: 51fa5123c8b180b0ae87553985ad49153530a692c3836c3fdd0b7ec66b8b779f
Opcode Fuzzy Hash: 2f94c131fad34fba066c271928ceeb292dfd82a49125e4d9117790a172f97d8e
Instruction Fuzzy Hash: 0021F233908218FBDB2166A08C46FFE76AADB40721F214112FE13B6241DA759E05E2B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD5A68 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00DFB4F0,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,00DD665C,?,00000001,?,00000000), ref: 00DD5AD1

Strings

feclient.dll, xrefs: 00DD5AC7, 00DD5BEF
Failed grow array of ordered patches., xrefs: 00DD5B6A
Failed to copy target product code., xrefs: 00DD5C02
Failed to plan action for target product., xrefs: 00DD5B7C
Failed to insert execute action., xrefs: 00DD5B26

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: d1380dff7dc51575862cacdfff471dc8667d78e10aa796d9f9ed9d63a4da7f77
Instruction ID: 134005024a4e7cb4afcc70f651e5386a46b3651640784bded7adc8007971c2fc
Opcode Fuzzy Hash: d1380dff7dc51575862cacdfff471dc8667d78e10aa796d9f9ed9d63a4da7f77
Instruction Fuzzy Hash: 2B8124B560471ADFCB14CF58D880EAA77A5FF08324B16866AEC159B356D730EC51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD90BC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00DC70FA,000000B8,0000001C,00000100), ref: 00DD90E7
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00DFB4A8,000000FF,?,?,?,00DC70FA,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00DD9171

Strings

comres.dll, xrefs: 00DD91F3
BA aborted detect forward compatible bundle., xrefs: 00DD91DB
Failed to initialize update bundle., xrefs: 00DD9214
c:\agent\_work\138\s\src\burn\user\detect.cpp, xrefs: 00DD91D1

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\138\s\src\burn\user\detect.cpp$comres.dll
API String ID: 1825529933-2620696206
Opcode ID: c811955a91d2a6b2a8116f271dbba8e31dd32787f1457a57944d88988329e3b0
Instruction ID: 7f7dee4a305be94a5efa7155f7550688b92f8497ab4111a33a55cf17156617d3
Opcode Fuzzy Hash: c811955a91d2a6b2a8116f271dbba8e31dd32787f1457a57944d88988329e3b0
Instruction Fuzzy Hash: B051B070600306BBDF159F64CC95FAABB6AFF05310F14465AF9149A295C772E860DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD3C1 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,00DFB4F0,?,00000001,000000FF,?,?,00000000,00000000,00000001,00000000,?,00DC74BE), ref: 00DCD4F7

Strings

Failed to elevate., xrefs: 00DCD4D9
Failed to connect to elevated child process., xrefs: 00DCD4E0
c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00DCD3F5
UX aborted elevation requirement., xrefs: 00DCD3FF
Failed to create pipe and cache pipe., xrefs: 00DCD447
Failed to create pipe name and client token., xrefs: 00DCD42B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 2962429428-1175272905
Opcode ID: eff5d80fb17aca9356509c772dfe52053ae0b933ae94bccce5ba3f8c9196f6b8
Instruction ID: 4d2bbc098eadf20a90070c8f8a67e82b967a81371b9bc961b58870d6ad77934a
Opcode Fuzzy Hash: eff5d80fb17aca9356509c772dfe52053ae0b933ae94bccce5ba3f8c9196f6b8
Instruction Fuzzy Hash: 40310C32A49727BFE71966609C46FAAB65EDB00730F10412AFB05BB1C1DB71BD4082F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9891 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000001,00000001,crypt32.dll,00000000,00000001,00DFB4F0,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00DF9969
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,crypt32.dll,00000000,00000001,00DFB4F0,00000000,00000001,00000000,00020019), ref: 00DF99A4
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00DF99C0
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00DF99CD
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00DF99DA

Part of subcall function 00DF1499: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00DF9956,00000001), ref: 00DF14B1

Strings

crypt32.dll, xrefs: 00DF994D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID: crypt32.dll
API String ID: 796878624-1661610138
Opcode ID: 9292da29e3bf7b6e41e064f086d5fdfd1e376bab7976f904bd4a7b82d4d63f67
Instruction ID: 10128cb8f19300e8171409d40da1617a26d8f7fdda08687d4ee208f19c5838ef
Opcode Fuzzy Hash: 9292da29e3bf7b6e41e064f086d5fdfd1e376bab7976f904bd4a7b82d4d63f67
Instruction Fuzzy Hash: 274128B6C0022DFFDF11AF958D91AEDFA79EF04750F17816AEA04B6121D3714F50AAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF093D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00E1C6EC,00000000,?,?,?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?), ref: 00DF094D
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00E1C6E4,?,00DC427F,00000000,Setup), ref: 00DF09F1
GetLastError.KERNEL32(?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?,?,?), ref: 00DF0A01
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?), ref: 00DF0A3B

Part of subcall function 00DB2EE7: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00DB3031

LeaveCriticalSection.KERNEL32(00E1C6EC,?,?,00E1C6E4,?,00DC427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DB5572,?), ref: 00DF0A94

Strings

c:\agent\_work\138\s\src\libs\dutil\logutil.cpp, xrefs: 00DF0A20

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: c:\agent\_work\138\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-1566132964
Opcode ID: 72a6102454c71661f1d6d1ddc8326d6e24829a54604e1d185d12ecf983d37d70
Instruction ID: 228adb4369f5e95c51acad0d6d31a4191f45c4cc7e3f9b8f9f9891fe1f9ec163
Opcode Fuzzy Hash: 72a6102454c71661f1d6d1ddc8326d6e24829a54604e1d185d12ecf983d37d70
Instruction Fuzzy Hash: 6F315171A4132DEFDB119FB59C46ABA3A68EB00B54B16C126FA01F7162D730CD409BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF1A42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 00DF1A7E
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00DF1AE0
lstrlenW.KERNEL32(?), ref: 00DF1AEC
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00DF1B2F

Strings

BundleUpgradeCode, xrefs: 00DF1A4B
c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF1B57

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-4149154654
Opcode ID: 95e7558d58d3c6ae7bf6445a0e6f0a7dc272416dea60de96d33b0b7a5fcfb0d0
Instruction ID: ea167049e759a4cbfe9124b7ce7bfbee14728e08c366b7ae612b37638219fcfb
Opcode Fuzzy Hash: 95e7558d58d3c6ae7bf6445a0e6f0a7dc272416dea60de96d33b0b7a5fcfb0d0
Instruction Fuzzy Hash: AA315F7690022AEBCB119F9888859BEBBB9EF45750F068155FA01BB210D730ED119BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD1EB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00DCAD19,00000001,00000000,00000000), ref: 00DCD277
GetLastError.KERNEL32(?,?,?,00DB54DE,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DCD283

Part of subcall function 00DCCECF: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE), ref: 00DCCEE1
Part of subcall function 00DCCECF: GetLastError.KERNEL32(?,?,00DCD2F3,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE,?,?,?), ref: 00DCCEEB

CloseHandle.KERNEL32(00000000,00000000,?,?,00DCC779,?,?,?,?,?,00DB54DE,?,?,?,?), ref: 00DCD304

Strings

c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00DCD2A7
Failed to create elevated cache thread., xrefs: 00DCD2B1
Failed to pump messages in child process., xrefs: 00DCD2DB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 3606931770-2430441278
Opcode ID: 76d7a14baa2d1853b94c0116c233839f68d5102f81e0464638123371b8c97045
Instruction ID: 284b64c752f5252408cc3aa64f452545558d3a68a583af0f562a4abefa0ec901
Opcode Fuzzy Hash: 76d7a14baa2d1853b94c0116c233839f68d5102f81e0464638123371b8c97045
Instruction Fuzzy Hash: 2641D7B6D01219AF8B01DFA8D8819EEBBF5FF48310B10412AF919E7340E770A9418FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB73DE Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00DB59A1,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00DB73F0
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00DB59A1,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00DB74CF

Strings

Failed to get unformatted string., xrefs: 00DB7460
Failed to get value as string for variable: %ls, xrefs: 00DB74BE
*****, xrefs: 00DB748B, 00DB7498
Failed to format value '%ls' of variable: %ls, xrefs: 00DB7499
Failed to get variable: %ls, xrefs: 00DB7431

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 85dd27dff602ef55fb2ae2769735e236ec73a0f97432653add21c8e9bd870b4e
Instruction ID: 472e8cb9b9e5697a0a712fc7a102e2992d2c584bef8794ee11e3c3f6e9777ba3
Opcode Fuzzy Hash: 85dd27dff602ef55fb2ae2769735e236ec73a0f97432653add21c8e9bd870b4e
Instruction Fuzzy Hash: 3631C03290961AFFCF215B50CC05BEEBE25EF90322F118125F905A6190D731EA60DBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3770 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DF3786
SysAllocString.OLEAUT32(?), ref: 00DF37A2
VariantClear.OLEAUT32(?), ref: 00DF3829
SysFreeString.OLEAUT32(00000000), ref: 00DF3834

Strings

`Dv, xrefs: 00DF3834
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF37B9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-795300160
Opcode ID: bc1717272658dfd50dd1228b1dc33391b07463d1f339e6b61996ff9b02dd2ee7
Instruction ID: 662c4da2122fe6b8574bcf70bf83d17c83efff0f14085159bf84a72f6d2d38cd
Opcode Fuzzy Hash: bc1717272658dfd50dd1228b1dc33391b07463d1f339e6b61996ff9b02dd2ee7
Instruction Fuzzy Hash: C1216575900219EBCB119B54C849EBE7BB9AF44755F1B8158FA02E7210D735DE41CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE901D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00DE9074
ext-ms-, xrefs: 00DE9088

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 9cc3908eaedbc2acf5b5e98d184af08e081eb0a00cc5e8581a9009101e20a896
Instruction ID: 18f3c504956debf39a2314a8242d7f6b65daea5b9bcc61871971d4903773c853
Opcode Fuzzy Hash: 9cc3908eaedbc2acf5b5e98d184af08e081eb0a00cc5e8581a9009101e20a896
Instruction Fuzzy Hash: 9921A572A02360ABCB31AA27DC50B6AB7589B41770F694215FD55B7290E771ED00C6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC8DCA Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 00DC8E15
GetLastError.KERNEL32 ref: 00DC8E1F
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00DC8E7F

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC8E43
Failed to allocate administrator SID., xrefs: 00DC8DFB
Failed to initialize ACL., xrefs: 00DC8E4D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 669721577-337914901
Opcode ID: f1481df3af5ec737a3125821f905a469573f73ff5713dd3a27969ac68f9059d4
Instruction ID: b3ff975850a41e63ce56fe3464326e3e2d46d2b02a37691d0e70eda680a5ea52
Opcode Fuzzy Hash: f1481df3af5ec737a3125821f905a469573f73ff5713dd3a27969ac68f9059d4
Instruction Fuzzy Hash: A021BB72E40315B7D7215B999C45FAFB76CEB40B60F158529BA04F7280DA719E00A7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB429E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00DC409C,00000001,feclient.dll,?,00000000,?,?,?,00DB4B92), ref: 00DB42D9
GetLastError.KERNEL32(?,?,00DC409C,00000001,feclient.dll,?,00000000,?,?,?,00DB4B92,?,?,00DFB478,?,00000001), ref: 00DB42E5
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00DC409C,00000001,feclient.dll,?,00000000,?,?,?,00DB4B92,?), ref: 00DB4320
GetLastError.KERNEL32(?,?,00DC409C,00000001,feclient.dll,?,00000000,?,?,?,00DB4B92,?,?,00DFB478,?,00000001), ref: 00DB432A

Strings

c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp, xrefs: 00DB434E
crypt32.dll, xrefs: 00DB42A2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp$crypt32.dll
API String ID: 152501406-1703428526
Opcode ID: 7258b329a43894a0258f7466c05a2fcc1727100bcf84a316effef41805fcac2e
Instruction ID: afac884753de2792309c7f7356d1e5a84a3f4e17ad0f98722322e02c3c03fc98
Opcode Fuzzy Hash: 7258b329a43894a0258f7466c05a2fcc1727100bcf84a316effef41805fcac2e
Instruction Fuzzy Hash: 3111DA77D41736EB9721D6998C44AEFB6989F40BA071E4126FE02F7311E724DC0096F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0A4B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00DD0A9B
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00DD0ABA
GetLastError.KERNEL32 ref: 00DD0AC4

Strings

Failed to write during cabinet extraction., xrefs: 00DD0AF2
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0AE8
Unexpected call to CabWrite()., xrefs: 00DD0A7E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 1970631241-3024265679
Opcode ID: 1415e472b28555e7a5ba823cee9a7acdb23e5c7421935ce669f55e0a75e54981
Instruction ID: c72f62fd71704ae7be45033c202dc936f3b6ec454998979470e5e11405a7af6e
Opcode Fuzzy Hash: 1415e472b28555e7a5ba823cee9a7acdb23e5c7421935ce669f55e0a75e54981
Instruction Fuzzy Hash: F1219D76640305EBCB00DF6DD884EAA3BA9EF88724F15415AFA14DB396E771DA00DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9B90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9BA9
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00DBA97A,00000100,000002C0,000002C0,00000100), ref: 00DB9BBE
GetLastError.KERNEL32(?,00DBA97A,00000100,000002C0,000002C0,00000100), ref: 00DB9BCB

Strings

Failed to set variable., xrefs: 00DB9C30
Failed to format variable string., xrefs: 00DB9BB4
Failed while searching directory search: %ls, for path: %ls, xrefs: 00DB9C0B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: aa72cf374db7ab3d6b1c3c84dc86e5155a33d4253ab31cbb547e2fb3d80c3c9f
Instruction ID: e2dfa5fd2def30b4b91c9a4128a9d35682cfd76700eba286a66971b284d15543
Opcode Fuzzy Hash: aa72cf374db7ab3d6b1c3c84dc86e5155a33d4253ab31cbb547e2fb3d80c3c9f
Instruction Fuzzy Hash: D0112433D04129FBCB225A64DC62FEEBAA9EF00720F218215FE03E6290D7319D0092F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0B12 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00DD0B7F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DD0B91
SetFileTime.KERNEL32(?,?,?,?), ref: 00DD0BA4
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00DD0774,?,?), ref: 00DD0BB3

Strings

Invalid operation for this state., xrefs: 00DD0B58
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD0B4E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 609741386-470522311
Opcode ID: dd8d3d1abd2e8dcf88e3e7618cec15db3b276b43203629f1dd47527e1f07811f
Instruction ID: 6f59e5545a8e48a0ff63297016038389c5ca1868a63a34f2452d3bb81d4d7d3a
Opcode Fuzzy Hash: dd8d3d1abd2e8dcf88e3e7618cec15db3b276b43203629f1dd47527e1f07811f
Instruction Fuzzy Hash: 5C21F37280431AEBC7108F68CC08AFA7BACFE44724B058257F860E66D0D774E911CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DE89DA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DE89A2: _free.LIBCMT ref: 00DE89C7

_free.LIBCMT ref: 00DE8A28

Part of subcall function 00DE604F: HeapFree.KERNEL32(00000000,00000000,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?), ref: 00DE6065
Part of subcall function 00DE604F: GetLastError.KERNEL32(?,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?,?), ref: 00DE6077

_free.LIBCMT ref: 00DE8A33
_free.LIBCMT ref: 00DE8A3E
_free.LIBCMT ref: 00DE8A92
_free.LIBCMT ref: 00DE8A9D
_free.LIBCMT ref: 00DE8AA8
_free.LIBCMT ref: 00DE8AB3

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 168201354b2e5533fa0f7f046aa2c7ffc8fc0175796946e774c258da5b176dd2
Instruction ID: 6d82c7b39517425d82f97d3ec943815c0346481fe59bd0fd91cd282dee6b5965
Opcode Fuzzy Hash: 168201354b2e5533fa0f7f046aa2c7ffc8fc0175796946e774c258da5b176dd2
Instruction Fuzzy Hash: AA113A71941B94AED630BBB2CC07FDB779CEF40700F404C15B29EA6053DA69B5069A72

Uniqueness

Uniqueness Score: -1.00%

Function 00DC46BB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

_memcpy_s.LIBCMT ref: 00DC470C
_memcpy_s.LIBCMT ref: 00DC471F
_memcpy_s.LIBCMT ref: 00DC473A

Strings

Failed to allocate memory for message., xrefs: 00DC46F5
crypt32.dll, xrefs: 00DC4716, 00DC4735
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC46EB

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\138\s\src\burn\user\pipe.cpp$crypt32.dll
API String ID: 886498622-4121836808
Opcode ID: 69ce84d305ae06e28929c65004981132f662fb26c38ec6b0b339b9b49e7ab548
Instruction ID: d8866a17d6e122816ec40fc6673b6aecd15418ed4ecda14955a60d732b581961
Opcode Fuzzy Hash: 69ce84d305ae06e28929c65004981132f662fb26c38ec6b0b339b9b49e7ab548
Instruction Fuzzy Hash: 35114FB650020EABDB01DF94DD81DEB77ACEF45710B04451AFA11DB181E771DA6487F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9AFF Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00DB9B76

Strings

Failed to select condition node., xrefs: 00DB9B2D
Condition, xrefs: 00DB9B11
`Dv, xrefs: 00DB9B76
Failed to get Condition inner text., xrefs: 00DB9B46
Failed to copy condition string from BSTR, xrefs: 00DB9B60

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`Dv
API String ID: 3341692771-1896785106
Opcode ID: d6ff496b3aa96fd1d8c357c5a680191ad67af4017107232ca64c9147590db395
Instruction ID: 3cea8be819a625e09cf62624226d4b99ab68405b2193cf2bdcb16d0deba5b467
Opcode Fuzzy Hash: d6ff496b3aa96fd1d8c357c5a680191ad67af4017107232ca64c9147590db395
Instruction Fuzzy Hash: A211823194026CFBDB159790EC55FFDFA69DF00710F118155FA02B6151D771AE1096B8

Uniqueness

Uniqueness Score: -1.00%

Function 00DB6851 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00DB688A
GetLastError.KERNEL32 ref: 00DB6894

Strings

c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB68B8
Failed to set variant value., xrefs: 00DB68DE
Failed to get temp path., xrefs: 00DB68C2
4#v, xrefs: 00DB688A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: 4#v$Failed to get temp path.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 1238063741-1557516241
Opcode ID: b9fcdb5306269bb7976c3467914013dbe55221f79b320908e54609c743b28d35
Instruction ID: 8a29abcc75efc3380b0d22c2b51f685395739dd53ca01b09c332e0cd5bedc103
Opcode Fuzzy Hash: b9fcdb5306269bb7976c3467914013dbe55221f79b320908e54609c743b28d35
Instruction Fuzzy Hash: A401D676E41338ABD710AB549C06FFA73A89B00710F158166BE15FB2C1DA64EE0846F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0E3A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,00DB62F5,00000000), ref: 00DF0E4C
GetProcAddress.KERNEL32(00000000), ref: 00DF0E53
GetLastError.KERNEL32(?,?,?,00DB62F5,00000000), ref: 00DF0E72

Strings

c:\agent\_work\138\s\src\libs\dutil\procutil.cpp, xrefs: 00DF0E93
kernel32, xrefs: 00DF0E46
IsWow64Process2, xrefs: 00DF0E3F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process2$c:\agent\_work\138\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-2089608604
Opcode ID: 0ddee463360c079887b49417c404b6e0d220a85622f75df28bedb1b9e9a6c03b
Instruction ID: f54596a8c536bddf37098b1bb84077011fc7e8b65076e2a6d64f5abeb4324d01
Opcode Fuzzy Hash: 0ddee463360c079887b49417c404b6e0d220a85622f75df28bedb1b9e9a6c03b
Instruction Fuzzy Hash: 41F09636E0133AAB87215BD6CC09ABF7D58DF01BA4B068515BE05F7241EB64DE00C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DEC6A2 Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00DE5C49,00000000,00000000), ref: 00DEC6EA
__fassign.LIBCMT ref: 00DEC8C9
__fassign.LIBCMT ref: 00DEC8E6
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DEC92E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DEC96E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DECA1A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: e28265a4a8187f51e7ee11ec673b36d500eff2e765de82a4144621bf51928d9d
Instruction ID: 0481b60b55a6fd47ff5a4f367b10b5e02ff9637346c9defdd4a5b2483e6e0c36
Opcode Fuzzy Hash: e28265a4a8187f51e7ee11ec673b36d500eff2e765de82a4144621bf51928d9d
Instruction Fuzzy Hash: A2D19771D102989FCB15DFA9D8809EDBBB5FF49310F28516AE855FB342D730AA06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DC8C8C Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00DC8CF8

Strings

Failed to calculate cache path., xrefs: 00DC8CB5
Failed to get %hs package cache root directory., xrefs: 00DC8D58
per-machine, xrefs: 00DC8D49, 00DC8D89
Failed to get old %hs package cache root directory., xrefs: 00DC8D98
per-user, xrefs: 00DC8D52, 00DC8D57, 00DC8D92, 00DC8D97

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: b952fac03e7c7fb6cd45a8635b3418c28c9f9f8994437d28b68fa6470efcade4
Instruction ID: 49f87b2036e8d538ca78f2ec4c1829cb13908dd4e7b4ee938a10d26d1ed7031a
Opcode Fuzzy Hash: b952fac03e7c7fb6cd45a8635b3418c28c9f9f8994437d28b68fa6470efcade4
Instruction Fuzzy Hash: 0A31C57294022ABFEB12A6A48D42FBF666CDF21710F25442DFD02FB181DA75DD5063B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCE8BB Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00DCE8EA
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00DCE8F9
SetWindowLongW.USER32(?,000000EB,?), ref: 00DCE90D
DefWindowProcW.USER32(?,?,?,?), ref: 00DCE91D
GetWindowLongW.USER32(?,000000EB), ref: 00DCE937
PostQuitMessage.USER32(00000000), ref: 00DCE996

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 447ea34d3f02a185f2b21e26848814644fe59d5774e327166b2bb9e0212d544f
Instruction ID: 1ffdf0e308a726cca867ccd0b98dd812ade8436d11d1f3ba89a2f04b179355a4
Opcode Fuzzy Hash: 447ea34d3f02a185f2b21e26848814644fe59d5774e327166b2bb9e0212d544f
Instruction Fuzzy Hash: 69218E7610420ABFDF115F68DC49F6A3BA9EF49320F548218F90A9B2A1CB31DD10DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DCC779 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 00DCC7C1
CloseHandle.KERNEL32(?), ref: 00DCC7C9

Strings

c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00DCC968
Unexpected elevated message sent to child process, msg: %u, xrefs: 00DCC974
Failed to save state., xrefs: 00DCC841

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 4207627910-1950014664
Opcode ID: 7776d6c970e35ebb0d8975c057951d120075b261b16fc3a8d0f65308ae3310e4
Instruction ID: 20279062f174f3496e3e01ddc2db831738f9d99d1ba407b3416f49c34b8119ae
Opcode Fuzzy Hash: 7776d6c970e35ebb0d8975c057951d120075b261b16fc3a8d0f65308ae3310e4
Instruction Fuzzy Hash: 3661C43A110606EFCB225F84CD01D65BBA2FF083247118559FAAE5B632C732E821EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DF7EFB Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

SysFreeString.OLEAUT32(00000000), ref: 00DF8058
SysFreeString.OLEAUT32(00000000), ref: 00DF8063
SysFreeString.OLEAUT32(00000000), ref: 00DF806E

Strings

`Dv, xrefs: 00DF804D
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF7F2E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-2207397114
Opcode ID: 995500642499d8b4b3d82e86d3ca716a0773175ead611817c49241eb41ac243a
Instruction ID: 122074a93d8c2fda943fcaedd44c411d518df667169372b32c7a2032c09c9bf2
Opcode Fuzzy Hash: 995500642499d8b4b3d82e86d3ca716a0773175ead611817c49241eb41ac243a
Instruction Fuzzy Hash: 3B516331A0122AEFCB11DBA4C845EBEB7B8EF40750F568158EA01AB150DF71EE05DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF16C7 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00DF16EF
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00DC70CF,00000100,000000B0,00000088,00000410,000002C0), ref: 00DF1726
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00DF1818

Strings

BundleUpgradeCode, xrefs: 00DF16CE
c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF1769

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-4149154654
Opcode ID: e085724903dca720df4fae8294f61f2fb446a510e4263059f9c0bf3d609fabff
Instruction ID: b86a78e9358ee6edd743de203f937e7bcb1b1eb976076576aef89502c121fb4e
Opcode Fuzzy Hash: e085724903dca720df4fae8294f61f2fb446a510e4263059f9c0bf3d609fabff
Instruction Fuzzy Hash: 35419439E0021EFBCB259F95C9459BE77B9EF04750F1A8169EE05AB210D630DD01DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF675D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF4D47: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00DC8758,00000000,00000000,00000000,00000000,00000000), ref: 00DF4D5F
Part of subcall function 00DF4D47: GetLastError.KERNEL32(?,?,?,00DC8758,00000000,00000000,00000000,00000000,00000000), ref: 00DF4D69

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00DF6017,?,?,?,?,?,?,?,00010000,?), ref: 00DF67C6
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00DF6017,?,?,?,?), ref: 00DF6818
GetLastError.KERNEL32(?,00DF6017,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00DF685E
GetLastError.KERNEL32(?,00DF6017,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00DF6884

Strings

c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF68A8

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-3549464317
Opcode ID: e7496664e55f0853ee0cdb3740b366a40974f29ea790ba87fd98952b5d5f6819
Instruction ID: 7dafe05bd7d0acbf321542bc926df8f8ad2f00b866b41693ad681803b66c43ef
Opcode Fuzzy Hash: e7496664e55f0853ee0cdb3740b366a40974f29ea790ba87fd98952b5d5f6819
Instruction Fuzzy Hash: 84417C7290021DFFEB218F94CD44BFA7BA8EF047A4F1A8129BE04A6590D734DD50DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2559 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,00DF0406,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DF0406,00DD1188,?,00000000), ref: 00DB259F
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DF0406,00DD1188,?,00000000,0000FDE9,?,00DD1188), ref: 00DB25AB

Part of subcall function 00DB3C9A: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA2
Part of subcall function 00DB3C9A: HeapSize.KERNEL32(00000000,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA9

Strings

c:\agent\_work\138\s\src\libs\dutil\strutil.cpp, xrefs: 00DB25CF

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\138\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-1498286024
Opcode ID: 50944266450986ad77f5e894c3c167ab5bca9cc1dc7acbb2d3d61685da038bcc
Instruction ID: afe11367038289b42f4abdb8097117103337a3d4614d71a6946486010352aaaf
Opcode Fuzzy Hash: 50944266450986ad77f5e894c3c167ab5bca9cc1dc7acbb2d3d61685da038bcc
Instruction Fuzzy Hash: 5731957220031AEFE7119E65CCD0AF637D9EB553A4B15822AF9539B2A0EB61DC409670

Uniqueness

Uniqueness Score: -1.00%

Function 00DF462D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00DF477B,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DCA040,00000001), ref: 00DF464B
GetLastError.KERNEL32(00000002,?,00DF477B,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DCA040,00000001,000007D0,00000001,00000001,00000003), ref: 00DF465A
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,00DF477B,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DCA040,00000001), ref: 00DF46F3
GetLastError.KERNEL32(?,00DF477B,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DCA040,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 00DF46FD

Part of subcall function 00DF488B: FindFirstFileW.KERNEL32(00DD907E,?,00000100,00000000,00000000), ref: 00DF48C6
Part of subcall function 00DF488B: FindClose.KERNEL32(00000000), ref: 00DF48D2

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF471C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-3168567549
Opcode ID: 7952b6bb6781b49b8798f7df7c55738383ae3064c04de39df7b01ebed1d1de5a
Instruction ID: 19c4ff569ad97aae40834a926c01263e810bfedf8fbc564aa483c5b728f3f5c9
Opcode Fuzzy Hash: 7952b6bb6781b49b8798f7df7c55738383ae3064c04de39df7b01ebed1d1de5a
Instruction Fuzzy Hash: 00312636600329E7DB212E549C40BBB76A5EF427A0F1BC026FE44DB260D770CD8186F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAB54 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00DDABC3

Strings

Failed to extract all payloads from container: %ls, xrefs: 00DDAC07
Failed to open container: %ls., xrefs: 00DDAB95
Failed to extract payload: %ls from container: %ls, xrefs: 00DDAC4C
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00DDAC58

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: 5759d7c1bdb38e497f1cbcccdb7f1e28aad90da764e1d566788e2d07be2bbc75
Instruction ID: 53a95de0b113129a4526f91952f552d032ca42602820ba2e12db20e3fa292f38
Opcode Fuzzy Hash: 5759d7c1bdb38e497f1cbcccdb7f1e28aad90da764e1d566788e2d07be2bbc75
Instruction Fuzzy Hash: 8531B432D00219EBCF219BD8CC45E9E7769EF04320F158112F911A7291E775EA65D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF7DF8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

SysFreeString.OLEAUT32(00000000), ref: 00DF7EDB
SysFreeString.OLEAUT32(?), ref: 00DF7EE6
SysFreeString.OLEAUT32(00000000), ref: 00DF7EF1

Strings

`Dv, xrefs: 00DF7ED0
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF7E25

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-2207397114
Opcode ID: 5ddcd13b499eecc092ecbcc520ac6e874ada4dd6272bf0d2a9c60d529481ca35
Instruction ID: cc74387ae21934cfdd8695b96b396b9565d17590ccd03d6c9eff86f4b59dd097
Opcode Fuzzy Hash: 5ddcd13b499eecc092ecbcc520ac6e874ada4dd6272bf0d2a9c60d529481ca35
Instruction Fuzzy Hash: 8531633690562EEBCB119AA5CC45FFEBB78AF00710F168196FA00AB150D770DE04DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBF0A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,00DC06D8,00000001,00000001,00000001,00DC06D8,00000000), ref: 00DBF11C
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,00DC06D8,00000001,00000001,00000001,00DC06D8,00000000,00000001,00000000,?,00DC06D8,00000001), ref: 00DBF139

Strings

Failed to format key for update registration., xrefs: 00DBF0D2
Failed to remove update registration key: %ls, xrefs: 00DBF164
PackageVersion, xrefs: 00DBF0FD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 469f1f1d24284e940c35d9d9931ef5f0ca080959d0520b9e358841ca50db6a9c
Instruction ID: b9a208d3c2a1b9e143a9c12bfc6467ab14a1f5f21b16aa2068e200ec6b93a532
Opcode Fuzzy Hash: 469f1f1d24284e940c35d9d9931ef5f0ca080959d0520b9e358841ca50db6a9c
Instruction Fuzzy Hash: B0219332D00329FBCB11ABA9CC05EEEBEB8EF40764F148675B916F2191D7315A41DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF478A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF488B: FindFirstFileW.KERNEL32(00DD907E,?,00000100,00000000,00000000), ref: 00DF48C6
Part of subcall function 00DF488B: FindClose.KERNEL32(00000000), ref: 00DF48D2

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00DF487D

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

Part of subcall function 00DF16C7: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00DF16EF
Part of subcall function 00DF16C7: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00DC70CF,00000100,000000B0,00000088,00000410,000002C0), ref: 00DF1726

Strings

PendingFileRenameOperations, xrefs: 00DF47E8
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00DF47BC
\, xrefs: 00DF4806
crypt32.dll, xrefs: 00DF47B5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: 27e2fe720303a610fbf6214fea032f66f1112c0b5cfb2704b4fb3827bd1d9f21
Instruction ID: 56b7d4f553c73ebd401da1217768f0b8c70208d68d695df65b21044b4c1e9376
Opcode Fuzzy Hash: 27e2fe720303a610fbf6214fea032f66f1112c0b5cfb2704b4fb3827bd1d9f21
Instruction Fuzzy Hash: A4315C31A0025DEADF21AF95C8419BFB7B5EF40BA0F5AC06AE615A7151E3319E80CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF445C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00DB4E38,00000000,?,?,00000000,?,00DF4577,00000000,00DB4E38,00000000,00000000,?,00DC85D8,?,?), ref: 00DF4476
GetLastError.KERNEL32(?,00DF4577,00000000,00DB4E38,00000000,00000000,?,00DC85D8,?,?,00000001,00000003,000007D0,?,?,?), ref: 00DF4484
CopyFileW.KERNEL32(00000000,00DB4E38,00000000,00DB4E38,00000000,?,00DF4577,00000000,00DB4E38,00000000,00000000,?,00DC85D8,?,?,00000001), ref: 00DF44F6
GetLastError.KERNEL32(?,00DF4577,00000000,00DB4E38,00000000,00000000,?,00DC85D8,?,?,00000001,00000003,000007D0,?,?,?), ref: 00DF4500

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF451F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-3168567549
Opcode ID: 630a460ca15e95381155488f9d6e20ccbd66df523542647361d1ce26a2bdfea3
Instruction ID: c5cf881611301108cb2fd0c7a545e403e30a0c85f0ce1e883660cffbd85ee704
Opcode Fuzzy Hash: 630a460ca15e95381155488f9d6e20ccbd66df523542647361d1ce26a2bdfea3
Instruction Fuzzy Hash: 5D21FB36701339979F202EA58C50B7B7658EF54BA0B1AC426FF44EF360D660CE4192F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBEFBC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DBEFF7

Part of subcall function 00DF459D: SetFileAttributesW.KERNEL32(00DD907E,00000080,00000000,00DD907E,000000FF,00000000,?,?,00DD907E), ref: 00DF45CC
Part of subcall function 00DF459D: GetLastError.KERNEL32(?,?,00DD907E), ref: 00DF45D6

Part of subcall function 00DB3D32: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,00DBF042,00000001,00000000,00000095,00000001,00DC06E7,00000095,00000000,swidtag,00000001), ref: 00DB3D4F

Strings

Failed to format tag folder path., xrefs: 00DBF064
Failed to allocate regid file path., xrefs: 00DBF056
Failed to allocate regid folder path., xrefs: 00DBF05D
swidtag, xrefs: 00DBF006

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: bfa180a74238434e0f84f6d4d8ec50e5214b354fbee9e3b1ead67db634e75581
Instruction ID: 98231ffbe200ceb43f72449012311f2b9038f677a576d0e0c8bf7f433888f2db
Opcode Fuzzy Hash: bfa180a74238434e0f84f6d4d8ec50e5214b354fbee9e3b1ead67db634e75581
Instruction Fuzzy Hash: 05213E32D00218FBCB15AFA9CC42BEDBBB5EF44710F14C1B6F515AA1A2D7719A409BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD8C03 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00DD8C87
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00DBF86F,00000001,00000100,000001B4,00000000), ref: 00DD8CD5

Strings

Failed to open uninstall registry key., xrefs: 00DD8C4A
Failed to enumerate uninstall key for related bundles., xrefs: 00DD8CE4
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00DD8C24

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: d974b0c5b9f6e626e7fc51ef01c6b3109688b7314a78e30bc8823b1c682f1095
Instruction ID: be8b4fb5e639df0a802ab67605be5bb5cdd1d89e65439249c8cff1bdd2ed35cd
Opcode Fuzzy Hash: d974b0c5b9f6e626e7fc51ef01c6b3109688b7314a78e30bc8823b1c682f1095
Instruction Fuzzy Hash: 1321B532911218FFDB125B98CD45FAEBA79EF00720F154166F511B62A0CB755E90E6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD046 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DDD0DB
ReleaseMutex.KERNEL32(?), ref: 00DDD109
SetEvent.KERNEL32(?), ref: 00DDD112

Strings

c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp, xrefs: 00DDD080
Failed to allocate buffer., xrefs: 00DDD08A

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp
API String ID: 944053411-3611595887
Opcode ID: 934c9175bf932b577448347fa11ebdb5645897916e7551c68f14f1abd907dde6
Instruction ID: aed073a04517741c2d9c621ca4dd9753846b90209b767bd0cb9f6648afb06a51
Opcode Fuzzy Hash: 934c9175bf932b577448347fa11ebdb5645897916e7551c68f14f1abd907dde6
Instruction Fuzzy Hash: A221BF7460030AEFDB109F28C845AA9BBF5FF48324F148629F965E7351C771A990CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB571D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00DB6640,00DB6640,?,00DB56B3,?,?,00000000), ref: 00DB5759
GetLastError.KERNEL32(?,00DB56B3,?,?,00000000,?,?,00DB6640,?,00DB7FF2,?,?,?,?,?), ref: 00DB5788

Strings

version.dll, xrefs: 00DB574B
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB57AC
Failed to compare strings., xrefs: 00DB57B6

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\138\s\src\burn\user\variable.cpp$version.dll
API String ID: 1733990998-3062438852
Opcode ID: 9ee383368319375f5e8778421cd0c44866abe641a5d75df1278d4da3776f58d6
Instruction ID: 7b6e07b3368fe365b93b39e6121fd4aeac86f57c354f41eabc9171b066ac5bc3
Opcode Fuzzy Hash: 9ee383368319375f5e8778421cd0c44866abe641a5d75df1278d4da3776f58d6
Instruction Fuzzy Hash: DE21F937750619EBC7108F98ED45BA9BBA4EF45770B350215F916EB3C4DA70DD0186B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF5D19 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00DD698D,00000000,?), ref: 00DF5D2F
GetLastError.KERNEL32(?,?,00DD698D,00000000,?,?,?,?,?,?,?,?,?,00DD6D9D,?,?), ref: 00DF5D3D

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00DD698D,00000000,?), ref: 00DF5D77
GetLastError.KERNEL32(?,?,00DD698D,00000000,?,?,?,?,?,?,?,?,?,00DD6D9D,?,?), ref: 00DF5D81

Strings

c:\agent\_work\138\s\src\libs\dutil\svcutil.cpp, xrefs: 00DF5D60, 00DF5DA2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\138\s\src\libs\dutil\svcutil.cpp
API String ID: 355237494-3858792903
Opcode ID: 1ecdfd00c7c8b0c36b63d5658f0f5d417b088f3000d57ae0944f338007131256
Instruction ID: d4869bf1be2369620f6ee3ecedd1bf6b192c871bb3b8688ab9b1fcb5d541abe0
Opcode Fuzzy Hash: 1ecdfd00c7c8b0c36b63d5658f0f5d417b088f3000d57ae0944f338007131256
Instruction Fuzzy Hash: C021A136902A39B7D7215695AC0DAFB6969EF42BA0F17C011BF05EB254DA60CE00D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF36C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00DF36D7
VariantInit.OLEAUT32(?), ref: 00DF36E3
VariantClear.OLEAUT32(?), ref: 00DF3757
SysFreeString.OLEAUT32(00000000), ref: 00DF3762

Part of subcall function 00DF390F: SysAllocString.OLEAUT32(?), ref: 00DF3924

Strings

`Dv, xrefs: 00DF3762

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `Dv
API String ID: 347726874-3059127152
Opcode ID: 0592c5077284244abbcb925c77acbdbdc76dda709850d332db634f6f04764eff
Instruction ID: 9b8af41ad018e09e3025100747823eb591ddd118e0f8f007bddfc7ae7f707218
Opcode Fuzzy Hash: 0592c5077284244abbcb925c77acbdbdc76dda709850d332db634f6f04764eff
Instruction Fuzzy Hash: 6F211DB5901219EBCB14EFA4C848EBEBBB8AF45715F168159EA01D7220D730EE45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB98EF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00DB997E

Strings

Failed to find variable., xrefs: 00DB996B
Failed to read next symbol., xrefs: 00DB999A
c:\agent\_work\138\s\src\burn\user\condition.cpp, xrefs: 00DB9920, 00DB9961
Failed to parse condition '%ls' at position: %u, xrefs: 00DB9930

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\138\s\src\burn\user\condition.cpp
API String ID: 2001391462-796209
Opcode ID: b07ed0673f89da54b58d40e813f3475fc4de98e54588971522e254051f1b5007
Instruction ID: 38efeb99a6e2ee9a65e1466bd9cfece8875d9caa3a0cd6134a8b4f4406b7f653
Opcode Fuzzy Hash: b07ed0673f89da54b58d40e813f3475fc4de98e54588971522e254051f1b5007
Instruction Fuzzy Hash: B9112732580254FADF613E688C5ADEBBE15EF15710F054015FB02AE196CBA2C910DAF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4AEC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00DFB4F0,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00DC5412), ref: 00DC4B38

Strings

Failed to allocate message to write., xrefs: 00DC4B17
Failed to write message type to pipe., xrefs: 00DC4B7A
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00DC4B70

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 3934441357-1028276228
Opcode ID: 218302ba9513fba5e5036079b0ddea4781beb39b198645bb69a663bf0e080d00
Instruction ID: 18a1095a6cc435b62c163d66cd46415fbaf6f1fdded8678f3d443e680f4c30d8
Opcode Fuzzy Hash: 218302ba9513fba5e5036079b0ddea4781beb39b198645bb69a663bf0e080d00
Instruction Fuzzy Hash: 6E118CB294022ABACB119F95DD05FEE7ABAEB40760F154119F901B7280D630DE40D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9ECB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00DB9EED

Strings

Failed to set variable., xrefs: 00DB9F4C
Failed get file version., xrefs: 00DB9F2D
Failed to format path string., xrefs: 00DB9EF8
File search: %ls, did not find path: %ls, xrefs: 00DB9F58

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: a0a51a1c74a7315061db34ee8d52489c48a8a33f88b654fcec7d5d321be43501
Instruction ID: f442e2bc596ff5fede7245d4f07265b31644817fabaa33aa8258bd9d5cf6f9cd
Opcode Fuzzy Hash: a0a51a1c74a7315061db34ee8d52489c48a8a33f88b654fcec7d5d321be43501
Instruction Fuzzy Hash: F211B132D0415CFFCF026B94CC42CFEFB69EF04320B118166FA01A6221D6718E50AAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC81FD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00DC8DF5,0000001A,?,?,00000000,00000000), ref: 00DC8246
GetLastError.KERNEL32(?,?,00DC8DF5,0000001A,?,?,00000000,00000000,?,?,?), ref: 00DC8250

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00DC8224, 00DC8274
Failed to create well known SID., xrefs: 00DC827E
Failed to allocate memory for well known SID., xrefs: 00DC822E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 2186923214-2819944635
Opcode ID: e3384361630d8763ec790a99659408b37bd299edd011c47e982c23a61581a3c0
Instruction ID: 8537ce170fa0d63243c4d7d85791cc357e090bff0147848664dc6c8221e444a5
Opcode Fuzzy Hash: e3384361630d8763ec790a99659408b37bd299edd011c47e982c23a61581a3c0
Instruction Fuzzy Hash: CC014C37601726B7D62066955C0EF6F9A6CDF41B60F11401AFD05FF180EE60CD4091F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDDB65 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00DDDB93
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DDDBBD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00DDDD8B,00000000,?,?,?,00000000,00000000), ref: 00DDDBC5

Strings

Failed while waiting for download., xrefs: 00DDDBF3
c:\agent\_work\138\s\src\burn\user\bitsuser.cpp, xrefs: 00DDDBE9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\138\s\src\burn\user\bitsuser.cpp
API String ID: 435350009-500302221
Opcode ID: 6c202806bee772de3d1301fd77076aebc76e5905e1e998c37c1ae72998d5e2e1
Instruction ID: ebbfacfe3864ced4a96a93c048dde0ccdc541cf04d68517a173d1db19f5db99e
Opcode Fuzzy Hash: 6c202806bee772de3d1301fd77076aebc76e5905e1e998c37c1ae72998d5e2e1
Instruction Fuzzy Hash: 8F01E573A45335BBDB205AA89C09EEF7AADDB04764F024127FA05F6380DAA49E40C1F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF40E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00DF4134
GetLastError.KERNEL32 ref: 00DF413E
CloseHandle.KERNEL32(?), ref: 00DF4171

Strings

<, xrefs: 00DF4126
c:\agent\_work\138\s\src\libs\dutil\shelutil.cpp, xrefs: 00DF415F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$c:\agent\_work\138\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-455212561
Opcode ID: 6b9781f8f5a0fa16779d0e1e92489f9591a87ca8dc49b972c7eaba7c7b02b4fa
Instruction ID: e1c4dd251611834bb38eded2ae66fff96e1a9c4bbfa7883807cccbadb0a97d5a
Opcode Fuzzy Hash: 6b9781f8f5a0fa16779d0e1e92489f9591a87ca8dc49b972c7eaba7c7b02b4fa
Instruction Fuzzy Hash: 6721A5B5E11329EBCB10CFA9D944ADEBBF8AB18750F11801AE915F7340D7749A40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB5F95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00DB5FC3
GetLastError.KERNEL32 ref: 00DB5FCD

Strings

Failed to get computer name., xrefs: 00DB5FFB
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB5FF1
Failed to set variant value., xrefs: 00DB6014

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 3560734967-458607650
Opcode ID: d3f5428a6f3dd318ce437ca3cb149f3878f7b2d7c28db50fc66b3a4fe6743d78
Instruction ID: 2d305c6793798e03272c974cc52afa8faa6f715528af9519eb64bbd2156770c1
Opcode Fuzzy Hash: d3f5428a6f3dd318ce437ca3cb149f3878f7b2d7c28db50fc66b3a4fe6743d78
Instruction Fuzzy Hash: 4901A932E5062CABD7119B959C05BEEB7E8AF08760F414416FA01FB240DA74EE0486F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB5EFD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00DB5F0F

Part of subcall function 00DF0F42: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00DB5F1B,00000000), ref: 00DF0F57
Part of subcall function 00DF0F42: GetProcAddress.KERNEL32(00000000), ref: 00DF0F5E
Part of subcall function 00DF0F42: GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0F79

Part of subcall function 00DF4191: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00DF41BE

Strings

Failed to get shell folder., xrefs: 00DB5F43
Failed to get 64-bit folder., xrefs: 00DB5F59
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00DB5F39
Failed to set variant value., xrefs: 00DB5F73

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 2084161155-466890970
Opcode ID: 6031d220681ddcf2e3fd9ca58c45a3b91869eadeb9e640d61774f695af3d8c30
Instruction ID: 87fb769ffb78ec813dac8fa16fc7aee6402fa3dcb6c53b7d62d7e6471c38f98c
Opcode Fuzzy Hash: 6031d220681ddcf2e3fd9ca58c45a3b91869eadeb9e640d61774f695af3d8c30
Instruction Fuzzy Hash: 6F01C43194472DFADF126BA0DC06FFEBA69DF00711F118191F901B6185CB70EA4097B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF459D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF488B: FindFirstFileW.KERNEL32(00DD907E,?,00000100,00000000,00000000), ref: 00DF48C6
Part of subcall function 00DF488B: FindClose.KERNEL32(00000000), ref: 00DF48D2

SetFileAttributesW.KERNEL32(00DD907E,00000080,00000000,00DD907E,000000FF,00000000,?,?,00DD907E), ref: 00DF45CC
GetLastError.KERNEL32(?,?,00DD907E), ref: 00DF45D6
DeleteFileW.KERNEL32(00DD907E,00000000,00DD907E,000000FF,00000000,?,?,00DD907E), ref: 00DF45F6
GetLastError.KERNEL32(?,?,00DD907E), ref: 00DF4600

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF461B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-3168567549
Opcode ID: dcacd989b3056f85a979630519a08196909129265398c245eed7a144f27b60e0
Instruction ID: bfaf70c00ca6a2c7f34ae6ad4aad87a3e1b1d6306c7fb99f7cc1b97d515fa04e
Opcode Fuzzy Hash: dcacd989b3056f85a979630519a08196909129265398c245eed7a144f27b60e0
Instruction Fuzzy Hash: 5C019232A0173AB7EB315B65CC05ABB7D68AF01BB1F06C211BE45EA290DB20CE0085F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD7D5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DDD7EA
LeaveCriticalSection.KERNEL32(?), ref: 00DDD82F
SetEvent.KERNEL32(?,?,?,?), ref: 00DDD843

Strings

Failed to get state during job modification., xrefs: 00DDD803
Failure while sending progress during BITS job modification., xrefs: 00DDD81E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: d8e2eb511a5bac5213845b0d7bca8b2c5ea5d8db7650abf9a78c699a1b438923
Instruction ID: d3724c848aa32bbbc356efb67b67760d1049887aeef435d7408c63b6f1153869
Opcode Fuzzy Hash: d8e2eb511a5bac5213845b0d7bca8b2c5ea5d8db7650abf9a78c699a1b438923
Instruction Fuzzy Hash: 20019A72A01725AFCB22AB55C859EAEBBA9FF08334B00411AE405E7350DB70F945DAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD5BD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,00DDDD15,?,?,?,?,?,00000000,00000000,?), ref: 00DDD5D7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00DDDD15,?,?,?,?,?,00000000,00000000,?), ref: 00DDD5E2
GetLastError.KERNEL32(?,00DDDD15,?,?,?,?,?,00000000,00000000,?), ref: 00DDD5EF

Strings

Failed to create BITS job complete event., xrefs: 00DDD61D
c:\agent\_work\138\s\src\burn\user\bitsuser.cpp, xrefs: 00DDD613

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\138\s\src\burn\user\bitsuser.cpp
API String ID: 3069647169-77904838
Opcode ID: 75e1c82d1650f2d61afd46785feb6b08830bb291c79b62a3ee5bc088def94011
Instruction ID: 3e51bca37cf21af52035f5e434befe633a55e3affec566ac0b2225e409e5d72b
Opcode Fuzzy Hash: 75e1c82d1650f2d61afd46785feb6b08830bb291c79b62a3ee5bc088def94011
Instruction Fuzzy Hash: FF0171B6941726ABC7209B5AD805A96BF98FF49760B018117FD18E7740E7B0D850CBF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDDA47 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00DDDBB3), ref: 00DDDA5B
LeaveCriticalSection.KERNEL32(00000008,?,00DDDBB3), ref: 00DDDAA0
SetEvent.KERNEL32(?,?,00DDDBB3), ref: 00DDDAB4

Strings

Failure while sending progress., xrefs: 00DDDA8F
Failed to get BITS job state., xrefs: 00DDDA74

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 04640745c7328ed80bfd0eeb30c16f8e91b8241a7ddcdcc86c6e5492579dc063
Instruction ID: 44dc0cf47193c765892e696eec62ee9076cf1abd64099fa60354f1ddd10d7b82
Opcode Fuzzy Hash: 04640745c7328ed80bfd0eeb30c16f8e91b8241a7ddcdcc86c6e5492579dc063
Instruction Fuzzy Hash: 8F01F172A00726BBCB129B15C8499AEBBA9FF14320B008157E505E3300CB70ED44CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF2124 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00DF214F
GetLastError.KERNEL32(?,00DB4A5C,00000001,?,?,00DB45D9,?,?,?,?,00DB54DE,?,?,?,?), ref: 00DF215E

Strings

srclient.dll, xrefs: 00DF212D
c:\agent\_work\138\s\src\libs\dutil\srputil.cpp, xrefs: 00DF217F
SRSetRestorePointW, xrefs: 00DF2144

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\138\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-976246835
Opcode ID: 4854863ebe2c34f7f8dc6377dc5201c29773b40cb8e5cb002ac19e5b4146b974
Instruction ID: 4d9b433a6782039460e32f094fca982e94ae0e7b4efd37b5980400948f379ee7
Opcode Fuzzy Hash: 4854863ebe2c34f7f8dc6377dc5201c29773b40cb8e5cb002ac19e5b4146b974
Instruction Fuzzy Hash: BA018676B8173AA7D3212BA5AC067BA39609B017A4F17C122AF05FA291D761CC4486F9

Uniqueness

Uniqueness Score: -1.00%

Function 00DE4545 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00DE453A,?,?,00DE4502,00000000,80004004,?), ref: 00DE455A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DE456D
FreeLibrary.KERNEL32(00000000,?,?,00DE453A,?,?,00DE4502,00000000,80004004,?), ref: 00DE4590

Strings

mscoree.dll, xrefs: 00DE4553
CorExitProcess, xrefs: 00DE4565

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0a4580e74a141eaf4aea29a5e6be95f89eedaf0cebfecf1b5f70ebbd31b99d39
Instruction ID: 32105463e041b1fff0b8556c0376ba9aee34f7441d00cd16b8249c3fdd2174a7
Opcode Fuzzy Hash: 0a4580e74a141eaf4aea29a5e6be95f89eedaf0cebfecf1b5f70ebbd31b99d39
Instruction Fuzzy Hash: 4BF08231A00358FBDB11AB52DC09BED7B78EF48762F0441A6FD04E1260DB714F00DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE48C7 Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DE4935
_free.LIBCMT ref: 00DE4955
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DE49B6
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DE49C8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DE49D5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: 678ac616d894de7cc99694eb072723e5225e566b2491dbc6dda50ea386938ff5
Instruction ID: ae1fc42608b1c1a87e1d3a92cc10fce778771009bba1e07f6b789e2424af0b8b
Opcode Fuzzy Hash: 678ac616d894de7cc99694eb072723e5225e566b2491dbc6dda50ea386938ff5
Instruction Fuzzy Hash: A741A436A012149FCB10EFBAC881A5EB7E6EF88714B1945ADE555FB342D731ED01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB22E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB2326
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB2332

Part of subcall function 00DB3C9A: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA2
Part of subcall function 00DB3C9A: HeapSize.KERNEL32(00000000,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA9

Strings

c:\agent\_work\138\s\src\libs\dutil\strutil.cpp, xrefs: 00DB2356

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\138\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-1498286024
Opcode ID: f7e84fa54e174e4469f715bea5c4c0bdf9ffbd84b5d2b6d81b235b0fc69f51bb
Instruction ID: 3fa8d0a6fcff943e9c064c1d0cfb1593cd27defc9769ef053320137c320d4680
Opcode Fuzzy Hash: f7e84fa54e174e4469f715bea5c4c0bdf9ffbd84b5d2b6d81b235b0fc69f51bb
Instruction Fuzzy Hash: 7731C033610326EBD7208E65CC84AFE3AD5AF15770B154229FC56AB3A0EB29CC4097F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8AD7 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00DB8C96,00DB97E5,?,00DB97E5,?,?,00DB97E5,?,?), ref: 00DB8AF7
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00DB8C96,00DB97E5,?,00DB97E5,?,?,00DB97E5,?,?), ref: 00DB8AFF
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00DB8C96,00DB97E5,?,00DB97E5,?), ref: 00DB8B4E
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00DB8C96,00DB97E5,?,00DB97E5,?), ref: 00DB8BB0
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00DB8C96,00DB97E5,?,00DB97E5,?), ref: 00DB8BDD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 977261f90c01e9070907ac235373bd4fa0e062ffdc58f0566380b8fd3d258573
Instruction ID: dbe4fa70902731d7ece891c4be52b3f9e510946e2769cc78e5c162619e563a96
Opcode Fuzzy Hash: 977261f90c01e9070907ac235373bd4fa0e062ffdc58f0566380b8fd3d258573
Instruction Fuzzy Hash: 213132B2A01258FFCF158E68CC849EE3F6EEB49390F148415F95A97210CA75D990EB74

Uniqueness

Uniqueness Score: -1.00%

Function 00DB7565 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DB5435,WixBundleOriginalSource,?,?,00DCA611,840F01E8,WixBundleOriginalSource,?,00E1BB6C,?,00000000,00DB54BD,00000001,?,?,00DB54BD), ref: 00DB7571
LeaveCriticalSection.KERNEL32(00DB5435,00DB5435,00000000,00000000,?,?,00DCA611,840F01E8,WixBundleOriginalSource,?,00E1BB6C,?,00000000,00DB54BD,00000001,?), ref: 00DB75D8

Strings

Failed to get value as string for variable: %ls, xrefs: 00DB75C7
Failed to get value of variable: %ls, xrefs: 00DB75AB
WixBundleOriginalSource, xrefs: 00DB756D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 5aba751ff82ad52155bd00ea809cd612961c828af10a659298afa8361791f029
Instruction ID: 0f78b8d1d3f2ba170927e7da7edf2eb5142e617fdd25a12edd58f1cd06589db7
Opcode Fuzzy Hash: 5aba751ff82ad52155bd00ea809cd612961c828af10a659298afa8361791f029
Instruction Fuzzy Hash: D6015A72904228EBCF215B54CC09FEE7AA4EF54324F018121BD06AA260DB36DE20DAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDCF3F Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,00DDCF37,00000000), ref: 00DDCF5A
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00DDCF37,00000000), ref: 00DDCF66
CloseHandle.KERNEL32(00DFB508,00000000,?,00000000,?,00DDCF37,00000000), ref: 00DDCF73
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00DDCF37,00000000), ref: 00DDCF80
UnmapViewOfFile.KERNEL32(00DFB4D8,00000000,?,00DDCF37,00000000), ref: 00DDCF8F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 4abd369e7a0b97cdacbdfc31600455ef87730bec51bf7a8240462921fc04f68f
Instruction ID: 5ecea58e443fd7142635101ff7b25bd687b721eafd90a33005d20a3e7c7d9ca5
Opcode Fuzzy Hash: 4abd369e7a0b97cdacbdfc31600455ef87730bec51bf7a8240462921fc04f68f
Instruction Fuzzy Hash: EA011D72416B16DFCB306F66DC8085AFBEAEF50711719D93FE29A52A20C771A840DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DE8939 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DE8951

Part of subcall function 00DE604F: HeapFree.KERNEL32(00000000,00000000,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?), ref: 00DE6065
Part of subcall function 00DE604F: GetLastError.KERNEL32(?,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?,?), ref: 00DE6077

_free.LIBCMT ref: 00DE8963
_free.LIBCMT ref: 00DE8975
_free.LIBCMT ref: 00DE8987
_free.LIBCMT ref: 00DE8999

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6603b74c7811eddc0178be3a03fbc43e2325051a109c48887de35290e96f5f3a
Instruction ID: 5ab9f5852835eb6fd29951964e1f15fe510d8423a25e95a2de04c8f83fd09cac
Opcode Fuzzy Hash: 6603b74c7811eddc0178be3a03fbc43e2325051a109c48887de35290e96f5f3a
Instruction Fuzzy Hash: BEF01232904294ABC630FF67E981C6A73D9EB84B507586906F14CE7552CB34FC809A71

Uniqueness

Uniqueness Score: -1.00%

Function 00DF8AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00DF8BFD
GetLastError.KERNEL32 ref: 00DF8C07

Strings

c:\agent\_work\138\s\src\libs\dutil\timeutil.cpp, xrefs: 00DF8C2B
clbcatq.dll, xrefs: 00DF8B0E, 00DF8B19

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\138\s\src\libs\dutil\timeutil.cpp$clbcatq.dll
API String ID: 2781989572-1116151388
Opcode ID: 823895936cd4430eb9ff4b7502a48e6e99e8aad63075c7ee6985c877122953e5
Instruction ID: b228e83b967994eae3aece59fd28a48e67b1f88089ba93184248d63f290692c6
Opcode Fuzzy Hash: 823895936cd4430eb9ff4b7502a48e6e99e8aad63075c7ee6985c877122953e5
Instruction Fuzzy Hash: 6541C6B5E00319AAD724AFB88C45EBF7678EF51754F0AC019A601B7184DD30CE419372

Uniqueness

Uniqueness Score: -1.00%

Function 00DE3D6F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe, xrefs: 00DE3DAD, 00DE3DB4, 00DE3DE8

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\is-CLJ4H.tmp\dotnet60desktop.exe
API String ID: 0-108117504
Opcode ID: d2e3ad36a2d9856fe7b4714f39d0fce9cbfb6321626c906490eff295d5b1f7dd
Instruction ID: f208d72d3760963f3b1f834b6dc80363666523614dba2f1d7ccb1ef9e6b61c72
Opcode Fuzzy Hash: d2e3ad36a2d9856fe7b4714f39d0fce9cbfb6321626c906490eff295d5b1f7dd
Instruction Fuzzy Hash: 19417571A04694AFCB21EF9BDC899BEBBB8EB85710B644166F405E7211E7708F41CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3B3F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 00DF3B59
SysAllocString.OLEAUT32(?), ref: 00DF3B69
VariantClear.OLEAUT32(?), ref: 00DF3C48

Strings

c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF3B81

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-3319182157
Opcode ID: 8e0ec14f4bbf88de778ff36f65409ae68bbba198fe8be81de36b3653243f9e91
Instruction ID: 5d25e006f2a2c6d09c77a6aeea8ac65516ec751cea898f9c6f7491b8f498b22e
Opcode Fuzzy Hash: 8e0ec14f4bbf88de778ff36f65409ae68bbba198fe8be81de36b3653243f9e91
Instruction Fuzzy Hash: E5415575900269ABCB119FA5C888EBEBBB8AF05710F1781A5FD11EB215D634DE00CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF131B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00DD8C68), ref: 00DF1376
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DD8C68,00000000), ref: 00DF1394
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00DD8C68,00000000,00000000,00000000), ref: 00DF13EA

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF13BA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3069916640
Opcode ID: cf30f3c34946902e82681689eab11cd9906065a871cf419d6d2ef9e98bbff0be
Instruction ID: 358d0ced2f9293cbe9eb9a8b920cae763d6fd92e19a57803f4477efc509e9aca
Opcode Fuzzy Hash: cf30f3c34946902e82681689eab11cd9906065a871cf419d6d2ef9e98bbff0be
Instruction Fuzzy Hash: C73194BA90112DFBEB218A95CC80DBFB6ADEF44790F168065FE01BB110D7318E409AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9736 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF9213: lstrlenW.KERNEL32(00000100,?,?,?,00DF95B3,000002C0,00000100,00000100,00000100,?,?,?,00DD7BE4,?,?,000001BC), ref: 00DF9238

RegCloseKey.ADVAPI32(00000000,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00DF981B
RegCloseKey.ADVAPI32(00000001,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00DF9835

Part of subcall function 00DF10B8: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00DC069E,?,00000000,00020006), ref: 00DF10DD

Part of subcall function 00DF199A: RegSetValueExW.ADVAPI32(00020006,00E00FB8,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DBF3CC,00000000,?,00020006), ref: 00DF19CD

Part of subcall function 00DF199A: RegDeleteValueW.ADVAPI32(00020006,00E00FB8,00000000,?,?,00DBF3CC,00000000,?,00020006,?,00E00FB8,00020006,00000000,?,?,?), ref: 00DF19FD

Part of subcall function 00DF194C: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00DBF324,00E00FB8,Resume,00000005,?,00000000,00000000,00000000), ref: 00DF1961

Strings

crypt32.dll, xrefs: 00DF9744
%ls\%ls, xrefs: 00DF9797

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls$crypt32.dll
API String ID: 3924016894-1754266218
Opcode ID: e5a84088d0b4b9138f50c7f2c97154bcc8c8d3a6bf407140309c9cce4ca27b6f
Instruction ID: e93a05e9ade00ce4bb69d27098cbd65f691ab1f7f0528606e6ebaf01f148be98
Opcode Fuzzy Hash: e5a84088d0b4b9138f50c7f2c97154bcc8c8d3a6bf407140309c9cce4ca27b6f
Instruction Fuzzy Hash: 3E31F772C0022EFB8F129F95CC51DEEFAB9EF05750B1A8166EA11B6121D7318E54DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD8968 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00DD8CA4,00000000,00000000), ref: 00DD8A25

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 00DD8A0B
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00DD8994
Failed to ensure there is space for related bundles., xrefs: 00DD89D8

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 457f4ffbba33b9968ec636f22fa0187cd43d6d55ae24a1430df8ca35ead6de3b
Instruction ID: 7d950bed385a85d8eeb4e80ac13cd3fe0a7e59b0492bf39bb7120f30a18a7096
Opcode Fuzzy Hash: 457f4ffbba33b9968ec636f22fa0187cd43d6d55ae24a1430df8ca35ead6de3b
Instruction Fuzzy Hash: 32216A7294021AFBDB239A80CC06FBEBA68EF00711F155057F900B6251DB71DA60FBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3BDC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,00DB146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DB13B0), ref: 00DB3BFA
HeapReAlloc.KERNEL32(00000000,?,00DB146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DB13B0,000001C7,00000100,?,80004005,00000000), ref: 00DB3C01

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

Part of subcall function 00DB3C9A: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA2
Part of subcall function 00DB3C9A: HeapSize.KERNEL32(00000000,?,00DB2300,000001C7,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3CA9

_memcpy_s.LIBCMT ref: 00DB3C4D

Strings

c:\agent\_work\138\s\src\libs\dutil\memutil.cpp, xrefs: 00DB3C8E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\138\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-517705587
Opcode ID: 24eb4730ae83ca6050540336de8ede6c7d83674673827deb9778574b14f6ef4f
Instruction ID: 58ff74a72059d9d2a4322bb5465b204f18a14a9ec91a906f796f2c9112c47bc0
Opcode Fuzzy Hash: 24eb4730ae83ca6050540336de8ede6c7d83674673827deb9778574b14f6ef4f
Instruction Fuzzy Hash: 3F11E131601619EBCB226EA8DC48DEE3E59DB40720B198211F916AB251D731CF25B7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF8D26 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DF8D6A
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DF8D92
GetLastError.KERNEL32 ref: 00DF8D9C

Strings

c:\agent\_work\138\s\src\libs\dutil\inetutil.cpp, xrefs: 00DF8DBD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\138\s\src\libs\dutil\inetutil.cpp
API String ID: 1528435940-2698868727
Opcode ID: 1502eec6952f971fce05d0fcd97039e63c3f9d79b20b56969821a3a168ae5538
Instruction ID: f9b811c04db69bb5f6087e66a581317385af3532f8ec42ca3157fbb810010dd5
Opcode Fuzzy Hash: 1502eec6952f971fce05d0fcd97039e63c3f9d79b20b56969821a3a168ae5538
Instruction Fuzzy Hash: 1F119673E01229ABD7209BA9CC05BFFB7A89F15760F068015AE45FB280DB209D0496F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF0B7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00DD1188,00000000,00000000,?,?,?,00DF042A,00DD1188,00DD1188,?,00000000,0000FDE9,?,00DD1188,8007139F,Invalid operation for this state.), ref: 00DF0B8E
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,00DF042A,00DD1188,00DD1188,?,00000000,0000FDE9,?,00DD1188,8007139F), ref: 00DF0BCA
GetLastError.KERNEL32(?,?,00DF042A,00DD1188,00DD1188,?,00000000,0000FDE9,?,00DD1188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00DF0BD4

Strings

c:\agent\_work\138\s\src\libs\dutil\logutil.cpp, xrefs: 00DF0C05

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\138\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-1566132964
Opcode ID: 7a49cdfcf6adacb8a587aae86a0bf1767f42bb1099fe748afde4baa516aacd9f
Instruction ID: cde5c19d9069843a64acd0f6a32106718e26dcd32d5aeffe9071a0ae8fbface2
Opcode Fuzzy Hash: 7a49cdfcf6adacb8a587aae86a0bf1767f42bb1099fe748afde4baa516aacd9f
Instruction Fuzzy Hash: 8C118672A01329EB87109B6ACC45DBB7E6CEB44BA5B16C315FE05E7241D760DD40C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00DB52B7,00000000,?), ref: 00DB1244
GetLastError.KERNEL32(?,?,?,00DB52B7,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DB124E

Strings

ignored , xrefs: 00DB1213
c:\agent\_work\138\s\src\libs\dutil\apputil.cpp, xrefs: 00DB126F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\138\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-3560123233
Opcode ID: a07fa0b4aa9c1e8e13a0be6db92eb5e5b48aa9b076e80fbbfc2b6bb847d2e58f
Instruction ID: f480749130c6905cf211fd1ab01d285208b85bb3fc5203a7c59d43e4e4a5abf6
Opcode Fuzzy Hash: a07fa0b4aa9c1e8e13a0be6db92eb5e5b48aa9b076e80fbbfc2b6bb847d2e58f
Instruction Fuzzy Hash: E711517A901229EB8B11EB95C816DEEBBB8EF41B60B414156FD06E7351D730DE00DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF023C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,00DF090E,?,?,?,?,00000001), ref: 00DF025B
GetLastError.KERNEL32(?,00DF090E,?,?,?,?,00000001,?,00DB568C,?,?,00000000,?,?,00DB540D,00000002), ref: 00DF0267
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,00DF090E,?,?,?,?,00000001,?,00DB568C,?,?), ref: 00DF02D0

Strings

c:\agent\_work\138\s\src\libs\dutil\logutil.cpp, xrefs: 00DF0286

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\138\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-1566132964
Opcode ID: 6c2e9386784aa4943f366a1f7e564faff0913138b2aab32a718e22b4282276e1
Instruction ID: b6c2f043ab6791eae4816e55c9ba7f325b13b7792749950cda941dd25f5bcef0
Opcode Fuzzy Hash: 6c2e9386784aa4943f366a1f7e564faff0913138b2aab32a718e22b4282276e1
Instruction Fuzzy Hash: 3311B232601229EBDF219F90CC09EFE7E69EF55760F028019FE05A7162D7308E50D6B4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDCFA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,762330D0,?,?,00DDD1D5,00000000,00000000,00000000,00000000), ref: 00DDCFB0
ReleaseMutex.KERNEL32(?,?,00DDD1D5,00000000,00000000,00000000,00000000), ref: 00DDD037

Part of subcall function 00DB3A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A2B
Part of subcall function 00DB3A1A: RtlAllocateHeap.NTDLL(00000000,?,00DB23A7,?,00000001,80004005,8007139F,?,?,00DF0687,8007139F,?,00000000,00000000,8007139F), ref: 00DB3A32

Strings

c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp, xrefs: 00DDCFF5
Failed to allocate memory for message data, xrefs: 00DDCFFF

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\138\s\src\burn\user\netfxchainer.cpp
API String ID: 2993511968-41198472
Opcode ID: 7ed9320f2c446eaff9643f67d4b6d07bf5bfad16c1bc2b58eca582a2070d51ba
Instruction ID: 4c99b84a710883c00aa4252e8ee5200813af9e84e0c705c67b1b5ea06da1c7e7
Opcode Fuzzy Hash: 7ed9320f2c446eaff9643f67d4b6d07bf5bfad16c1bc2b58eca582a2070d51ba
Instruction Fuzzy Hash: B9118F71200315EFCB159F28D845EAABBA5FF49720F144166F9189B351C772AC61CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF51E2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00DC0545,00000000,?,00DBF589,00DFB4F0,00000080,002E0032,00000000), ref: 00DF51FA
GetLastError.KERNEL32(?,00DBF589,00DFB4F0,00000080,002E0032,00000000,?,00DC0545,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00DF5207
CloseHandle.KERNEL32(00000000,00000000,00DFB4F0,00DBF589,?,00DBF589,00DFB4F0,00000080,002E0032,00000000,?,00DC0545,crypt32.dll,00000094), ref: 00DF525B

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF522B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-3168567549
Opcode ID: 5b649df8b05fab32500794837637bafbccba3f459b53f1d85fcd9ba7941f3f3e
Instruction ID: 4d5b7e00944e4bf4f9069afc4a40f99311121b15a20eafb489d5b2dad752f97e
Opcode Fuzzy Hash: 5b649df8b05fab32500794837637bafbccba3f459b53f1d85fcd9ba7941f3f3e
Instruction Fuzzy Hash: 11018837641A2967D7211E99AC05F7B3A24AB41B70F0A8311FF25BB1D4DB209C1197B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DC07A3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00DC0813

Strings

Failed to update resume mode., xrefs: 00DC07E4
Failed to open registration key., xrefs: 00DC07CA
Failed to update name and publisher., xrefs: 00DC07FD

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 5272c95918693e82b553a8b88dcbe89127272068203b3c4eb6499aa8d94d0c5e
Instruction ID: 541ea25ef69a64fd5d62d1ed0980d442c33ae6a1c98baafafb23f92baf5e96b0
Opcode Fuzzy Hash: 5272c95918693e82b553a8b88dcbe89127272068203b3c4eb6499aa8d94d0c5e
Instruction Fuzzy Hash: EE01D832900629F7CB125790CC02FEE7A65EF40B54F208055F601B7190D7B19E00A7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4DB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00DD8AC5,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00DF4DE6
GetLastError.KERNEL32(?,00DD8AC5,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,userVersion,000002C0,000000B0), ref: 00DF4DF3

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF4DC7, 00DF4E17

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-3168567549
Opcode ID: ac8ca75f54181f12aa8f5fd4ec55b05cc10cd04ff682fba8d57ab1fca5362077
Instruction ID: 641c2da8c570f16601d607303af303d78ec80f4f5ed809257803adfc0b7431cb
Opcode Fuzzy Hash: ac8ca75f54181f12aa8f5fd4ec55b05cc10cd04ff682fba8d57ab1fca5362077
Instruction Fuzzy Hash: 3D01D632A81339B7E33216A49C1AFBB6928FB11BB0F02C111FF55BB2C0D6644D4092F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD6A65 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(00DD6979,00000001,?,00000001,00000000,?,?,?,?,?,?,00DD6979,00000000), ref: 00DD6A8D
GetLastError.KERNEL32(?,?,?,?,?,?,00DD6979,00000000), ref: 00DD6A97

Strings

c:\agent\_work\138\s\src\burn\user\msuuser.cpp, xrefs: 00DD6ABB
Failed to stop wusa service., xrefs: 00DD6AC5

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\138\s\src\burn\user\msuuser.cpp
API String ID: 4114567744-1257665305
Opcode ID: 7a87cdfddda1ec36254a78fb0b6e050cdd8d26ede1573b1f658b4a26252b4377
Instruction ID: fca896cb9bc2ede489e7b603f4dfc64e1d54123d46946fd87722dd91d7d59a31
Opcode Fuzzy Hash: 7a87cdfddda1ec36254a78fb0b6e050cdd8d26ede1573b1f658b4a26252b4377
Instruction Fuzzy Hash: AA01DB33A44338A7D7209BA59C05AAF7BA4EF48760F018027F905FB380EE24DD4486F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3D96 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00DF3DDB
SysFreeString.OLEAUT32(00000000), ref: 00DF3E0E

Strings

`Dv, xrefs: 00DF3E0E
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF3DAC, 00DF3DF2

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$AllocFree
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-795300160
Opcode ID: e8d29afcb017d8c88ff9d636aeb87175c0b58adecaec54db7ac2935bc212137a
Instruction ID: d88210bf22b3c17609dc9c88692ac1cc244826e9545979720842b59a4848edb1
Opcode Fuzzy Hash: e8d29afcb017d8c88ff9d636aeb87175c0b58adecaec54db7ac2935bc212137a
Instruction Fuzzy Hash: BB01AD31740319ABDB201A698C05EBA36A8EF45B60F07803AFF14EB381C774CE0096B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF3E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00DF3E61
SysFreeString.OLEAUT32(00000000), ref: 00DF3E94

Strings

`Dv, xrefs: 00DF3E94
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF3E32, 00DF3E78

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$AllocFree
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-795300160
Opcode ID: 65da81f5318ab792881faa1d6811476f3574d5a3349eece950db9065d60d30d7
Instruction ID: 3b554607a041c2e8b03f70202946fa85714d9858402de3ac5d916ee740435ebe
Opcode Fuzzy Hash: 65da81f5318ab792881faa1d6811476f3574d5a3349eece950db9065d60d30d7
Instruction Fuzzy Hash: 6301A231A80319B7D7205A549C09EBB76E8EF45B60F078129FE15E7340C764CE0097B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF6CAA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00DF6D09

Part of subcall function 00DF8AF0: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00DF8BFD
Part of subcall function 00DF8AF0: GetLastError.KERNEL32 ref: 00DF8C07

Strings

`Dv, xrefs: 00DF6D09
clbcatq.dll, xrefs: 00DF6CD6
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF6CF7

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp$clbcatq.dll
API String ID: 211557998-432936240
Opcode ID: 522641c6347b177479cd5d6f3d48c83431eae8f4a48e5fbde56e12df19b6b9ea
Instruction ID: 3bf09e942d197409a5ccbb95e7f593481aac9a3219abbf142ff007c7696fa484
Opcode Fuzzy Hash: 522641c6347b177479cd5d6f3d48c83431eae8f4a48e5fbde56e12df19b6b9ea
Instruction Fuzzy Hash: 36018F71A00219FB8B205F85DC418AAFBB8EB14764B1AC17AEB84A7500C771DE10D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCEC27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00DCEC4F
GetLastError.KERNEL32 ref: 00DCEC59

Strings

Failed to post elevate message., xrefs: 00DCEC87
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCEC7D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-2699502814
Opcode ID: fa3980abf7d053742aefd6714204826f683e13e4787a9fc1dccbd700ce2dcc10
Instruction ID: e539bc451993793a3e1e7d0d4da8fdca7a3104b630d8daa3ecc25e0e80212f8f
Opcode Fuzzy Hash: fa3980abf7d053742aefd6714204826f683e13e4787a9fc1dccbd700ce2dcc10
Instruction Fuzzy Hash: 0BF09677644336ABC3205A989D09FA77B94AF00B71B198229BE18BB2D1D725DC0187F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD975 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00DBD99C
FreeLibrary.KERNEL32(?,?,00DB495B,00000000,?,?,00DB5506,?,?), ref: 00DBD9AB
GetLastError.KERNEL32(?,00DB495B,00000000,?,?,00DB5506,?,?), ref: 00DBD9B5

Strings

BootstrapperApplicationDestroy, xrefs: 00DBD994

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: b4798207899c4f0b7793d4637af9d2933941e971001474beb81b40ba5e93be20
Instruction ID: dfd75b42fc55ebc4414c0bd625220c9cfa2c860d4f55884821ddb2a21b46e6e4
Opcode Fuzzy Hash: b4798207899c4f0b7793d4637af9d2933941e971001474beb81b40ba5e93be20
Instruction Fuzzy Hash: A9F06232600726EBC7245F65D804B66F7A9FF00B72B19C22AE81AD6520DB31EC50CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF366A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00DF367F
SysFreeString.OLEAUT32(00000000), ref: 00DF36AF

Strings

`Dv, xrefs: 00DF36AF
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF3693

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$AllocFree
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-795300160
Opcode ID: 66a36de760d9fe41b9604d0705dc51bb651188cddb6c9801bf99ec100c395abd
Instruction ID: 2dd46d58fdf7a3abb3e13a8ed7961d063ae1a839a95b725491965b19b2bca447
Opcode Fuzzy Hash: 66a36de760d9fe41b9604d0705dc51bb651188cddb6c9801bf99ec100c395abd
Instruction Fuzzy Hash: C7F09A31641218E7C7212E149C08FBA77A6AB84B61F1B8029FE08AB310C7708E209AF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF390F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00DF3924
SysFreeString.OLEAUT32(00000000), ref: 00DF3954

Strings

`Dv, xrefs: 00DF3954
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00DF393B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: String$AllocFree
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-795300160
Opcode ID: 8163918cf5470111e8d18d1a36bcbd3f50de1f814c4a8dc51eb0e9a9345020be
Instruction ID: d66ca648361614640ccb0ffe3327a04e27f690f28aa38915131bee2ae3df4463
Opcode Fuzzy Hash: 8163918cf5470111e8d18d1a36bcbd3f50de1f814c4a8dc51eb0e9a9345020be
Instruction Fuzzy Hash: 46F09031240359E7CB224E489C08EBA77E8AB44B70F17801AFE15A721087F0CE50DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF231 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00DCF246
GetLastError.KERNEL32 ref: 00DCF250

Strings

Failed to post plan message., xrefs: 00DCF27E
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCF274

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-3584526468
Opcode ID: acfcf751e6ef6c5837df86354eca7ef6fdad30a20507ad5bf6d835f60797589a
Instruction ID: 876aa85183dd317a05ba4939596b3656a2df5f58d171f13ea89237cdc68c2ade
Opcode Fuzzy Hash: acfcf751e6ef6c5837df86354eca7ef6fdad30a20507ad5bf6d835f60797589a
Instruction Fuzzy Hash: F5F0823764533567C22027D5AC0AE9BBE85AF05BB0B028125BD08EB291DA119C0081F9

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF33F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00DCF354
GetLastError.KERNEL32 ref: 00DCF35E

Strings

Failed to post shutdown message., xrefs: 00DCF38C
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCF382

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-83663741
Opcode ID: 274142ed1492b4a02f64ee7d8361f2c3bfa8ea1af0c75d4b51fa5d8272342be5
Instruction ID: 385159005f1cbd880a469fab26d868e920d672b188fc8250c8235687c82f7e65
Opcode Fuzzy Hash: 274142ed1492b4a02f64ee7d8361f2c3bfa8ea1af0c75d4b51fa5d8272342be5
Instruction Fuzzy Hash: 16F0A737A41335B7C2201B959C09F9B7E48AF01BB0B068036FE08FB291EA109C0086F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DD0678 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00DFB468,00000000,?,00DD15CD,?,00000000,?,00DBC33B,?,00DB547D,?,00DC759E,?,?,00DB547D,?), ref: 00DD0682
GetLastError.KERNEL32(?,00DD15CD,?,00000000,?,00DBC33B,?,00DB547D,?,00DC759E,?,?,00DB547D,?,00DB54BD,00000001), ref: 00DD068C

Strings

c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00DD06B0
Failed to set begin operation event., xrefs: 00DD06BA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 3848097054-2744104430
Opcode ID: e1e193b34d9de3767ad1bd7946389ad0a86cd89576ea05fb417057bd64aeaa6d
Instruction ID: 59393d66996ce6ceeca33f4466dd181601412e6769652a7612a918bb4f735ce1
Opcode Fuzzy Hash: e1e193b34d9de3767ad1bd7946389ad0a86cd89576ea05fb417057bd64aeaa6d
Instruction Fuzzy Hash: 45F0A73795173567832036949C0AB9B7E48CE80BB1B054127FD44FB341EB51DC5042F9

Uniqueness

Uniqueness Score: -1.00%

Function 00DCEBBE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00DCEBD3
GetLastError.KERNEL32 ref: 00DCEBDD

Strings

Failed to post detect message., xrefs: 00DCEC0B
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCEC01

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-1752364159
Opcode ID: 2904afba084e1c07727bb9c07e267ad38486b4283c5778dd2ecb9b8e6b500266
Instruction ID: b7a547ca8ed3bd02f0b1014a3b8dd3f937c3ff76a449a076f85a50015fc46b56
Opcode Fuzzy Hash: 2904afba084e1c07727bb9c07e267ad38486b4283c5778dd2ecb9b8e6b500266
Instruction Fuzzy Hash: 23F0A737641335A7D6201699AC09F97BF94EF00BB0B028025FD09FB291D6109C00C1F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DCEB2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00DCEB42
GetLastError.KERNEL32 ref: 00DCEB4C

Strings

Failed to post apply message., xrefs: 00DCEB7A
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00DCEB70

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-874079251
Opcode ID: 18ad3835f9fd3e74f27c79492b17f425ebb6161c89ba87284f0e843ba35ff6f2
Instruction ID: ae18ad1f1509b4389f265bc292337837a299afe61fe357429643396c261baea9
Opcode Fuzzy Hash: 18ad3835f9fd3e74f27c79492b17f425ebb6161c89ba87284f0e843ba35ff6f2
Instruction Fuzzy Hash: 7EF0A737A4133967D63116D5AC09EAB7F89EF00FB0B068125FD09FB2D1D6209C0086F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DE6782 Relevance: 6.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DE6809

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9f1acedcc75d6c98e611d18592d038f462777dbcf9999752fc6943b18af49599
Instruction ID: c5809bd9b0301c727b0ee4a1f213fd6c9de64a6e1ee07ca093fdd77b3150fe8d
Opcode Fuzzy Hash: 9f1acedcc75d6c98e611d18592d038f462777dbcf9999752fc6943b18af49599
Instruction Fuzzy Hash: ACB13832D002C59FDB11EF2AC8817BEBBE5EF65390F18816AE455AB242D634DD41CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF62CD Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00DF639A
lstrlenW.KERNEL32(00000000), ref: 00DF63B2

Strings

c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF643B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-3549464317
Opcode ID: 2b5c4b773eff56b7fdbede9ab7cdfa895a880ffa10e7757186966b1cf353cffa
Instruction ID: 29f175f0c02ef0a19526e370f6e650df512613cb355288e45d93a7474e42324d
Opcode Fuzzy Hash: 2b5c4b773eff56b7fdbede9ab7cdfa895a880ffa10e7757186966b1cf353cffa
Instruction Fuzzy Hash: 3851507290022DABDB219FA588849BEBBB9EF48750B1A8125EE05B7610D770DD40DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB501C Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,00DB55CA,?,?,?,?,?,?), ref: 00DB5076
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,00DB55CA,?,?,?,?,?,?), ref: 00DB508A
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00DB55CA,?,?), ref: 00DB5179
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00DB55CA,?,?), ref: 00DB5180

Part of subcall function 00DB115F: LocalFree.KERNEL32(?,?,00DB5033,?,00000000,?,00DB55CA,?,?,?,?,?,?), ref: 00DB1169

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: c02c2ec68baef3028733f19667570b2377a54f596b21803acd03b023b9a1564e
Instruction ID: 76d07d7b06632253bc757d640ccebf76fbdf8cd7ca77848f2119e780d92691d5
Opcode Fuzzy Hash: c02c2ec68baef3028733f19667570b2377a54f596b21803acd03b023b9a1564e
Instruction Fuzzy Hash: 4F41D8B1500B05EADA20EBB5D849FEB73ECAF04391F480829B26BD7155EF34E5448B74

Uniqueness

Uniqueness Score: -1.00%

Function 00DF646D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DF63D8,00000000,00000000,00000001), ref: 00DF64EC
GetLastError.KERNEL32(?,?,00DF63D8,00000000,00000000,00000001), ref: 00DF653B

Strings

$s, xrefs: 00DF64D0
c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp, xrefs: 00DF6510, 00DF655F

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast
String ID: $s$c:\agent\_work\138\s\src\libs\dutil\dlutil.cpp
API String ID: 1452528299-1058686523
Opcode ID: 681bfcd355bedcb94514392b1864835d4928ce1d7afa4c6b5566fc010341ddfe
Instruction ID: ca54fa74f750c87b317aa304967ff44c40b2bb25b3cc8c212cb3fbab4241f7e9
Opcode Fuzzy Hash: 681bfcd355bedcb94514392b1864835d4928ce1d7afa4c6b5566fc010341ddfe
Instruction Fuzzy Hash: 7131C47790432EEB9B219EA59C44EBB7678AF00764B1B8225FE11B7754E730CD0097B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5B8D Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00DE13F9,00000000,80004004,00000100,?,00DE1731,00000000,80004004,00000000,00000000), ref: 00DE5B92
_free.LIBCMT ref: 00DE5BEF
_free.LIBCMT ref: 00DE5C25
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00DE1731,00000000,80004004,00000000,00000000), ref: 00DE5C30

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5c2fe9f1ff63afcd38f0a1a285fa6e284db4deb9c70eb39b3749b93dbfb8947a
Instruction ID: 576e278d8aef7187d1e222e766451defaf0a1f3452a1b4be7ab879fdf09aa534
Opcode Fuzzy Hash: 5c2fe9f1ff63afcd38f0a1a285fa6e284db4deb9c70eb39b3749b93dbfb8947a
Instruction Fuzzy Hash: 0811E731205AC86ACE107B77BC91E7B326DD7C53FCB780224F630961E6EE208C045134

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5CE4 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,00DE3B0A,00DB3D1D,80004005,00000000,?,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7), ref: 00DE5CE9
_free.LIBCMT ref: 00DE5D46
_free.LIBCMT ref: 00DE5D7C
SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00DE5D87

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 51eed21584aa5bba617d2100835c70de810fa85721c72eb0d080a8cdac38e28f
Instruction ID: 614a28668f4c7759f5ed5ef5eb6383d3adb15250591abd33e13b5e4aab68e43c
Opcode Fuzzy Hash: 51eed21584aa5bba617d2100835c70de810fa85721c72eb0d080a8cdac38e28f
Instruction Fuzzy Hash: 4811E931245A847EDA217B77BC89E6B366EDBC57F8B684224F134D61E6EE21CC049234

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4D04 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00DBF9F9: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00DB4D23,?,?,00000001), ref: 00DBFA49

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00DB4D8A

Strings

Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00DB4D74
Unable to get resume command line from the registry, xrefs: 00DB4D29
Failed to get current process path., xrefs: 00DB4D48

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: c9195e023e082e454e2184a6e194f534eb6b14b88dbf92ce83965174fd0139ba
Instruction ID: ba79d3909abb9c19b783fddbe86307cc67d1139c3a981410d3663d07e0f440cf
Opcode Fuzzy Hash: c9195e023e082e454e2184a6e194f534eb6b14b88dbf92ce83965174fd0139ba
Instruction Fuzzy Hash: C6115431D0111CFB8F12AB95DC018FDBBB8DF50710B158156FA12B6212DB319B559B70

Uniqueness

Uniqueness Score: -1.00%

Function 00DB74E5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DB74F1
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00DB7558

Strings

Failed to get value of variable: %ls, xrefs: 00DB752B
Failed to get value as numeric for variable: %ls, xrefs: 00DB7547

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: fd58ee51b177c65131c880ee09a5796b1316c731a7dded54a7a2be056b3b3581
Instruction ID: 6ce6e6a746e245fa0c5564803a9b0a987b7a42531962779bc546d3df415d4795
Opcode Fuzzy Hash: fd58ee51b177c65131c880ee09a5796b1316c731a7dded54a7a2be056b3b3581
Instruction Fuzzy Hash: 3D017172944228FFCF219B54CC05BEE3AA5EF50765F018111FD06A6261C336DE20DAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB7654 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DB7660
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00DB76C7

Strings

Failed to get value of variable: %ls, xrefs: 00DB769A
Failed to get value as version for variable: %ls, xrefs: 00DB76B6

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 303457596be6f3f636c115b3b5e2aad48e95ccf8e2c3870e6751bc412ad59bcb
Instruction ID: f8447e97dbc401862ac621199624f9c24935a47fcde5cdf36a39955a5f6e0de7
Opcode Fuzzy Hash: 303457596be6f3f636c115b3b5e2aad48e95ccf8e2c3870e6751bc412ad59bcb
Instruction Fuzzy Hash: D8015E72944528FBCF119B58CD05BEE7F64AF50324F018151FD05A6261C736DA209AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD552 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00DC7027,000000B8,00000000,?,00000000,7694B390), ref: 00DBD561
LeaveCriticalSection.KERNEL32(000000D0,?,00DC7027,000000B8,00000000,?,00000000,7694B390), ref: 00DBD584

Strings

user active cannot be changed because it was already in that state., xrefs: 00DBD5A7
c:\agent\_work\138\s\src\burn\user\userexperience.cpp, xrefs: 00DBD59D

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: user active cannot be changed because it was already in that state.$c:\agent\_work\138\s\src\burn\user\userexperience.cpp
API String ID: 3168844106-656309086
Opcode ID: b07518a120685e021ff847d37c22da65c14abad2fc0fe6da2552e6a4c63dac45
Instruction ID: c1374df803316c3be14cd78a0e273b161c355df22e153232ee889bf676e78219
Opcode Fuzzy Hash: b07518a120685e021ff847d37c22da65c14abad2fc0fe6da2552e6a4c63dac45
Instruction Fuzzy Hash: 8BF0AF36304705AB97219EAADC849E773EDFF99329700843AF506D7280EA71E80586B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB75E5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00DB994D,00000000,?,00000000,00000000,00000000,?,00DB978E,00000000,?,00000000,00000000), ref: 00DB75F1
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00DB994D,00000000,?,00000000,00000000,00000000,?,00DB978E,00000000,?,00000000), ref: 00DB7647

Strings

Failed to get value of variable: %ls, xrefs: 00DB7617
Failed to copy value of variable: %ls, xrefs: 00DB7636

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 488f55f276f962b39cf90844bb1322e68243168647359b0938b142c31abe8727
Instruction ID: e61df7d608c2519290d8970ca1e42c72e4dd4b591543c4c128d5dd44e10d85b3
Opcode Fuzzy Hash: 488f55f276f962b39cf90844bb1322e68243168647359b0938b142c31abe8727
Instruction Fuzzy Hash: 8BF0647290462CFBCF126B58CD0AAEE7F29EF50364F018110FE05A6261C3369A209AB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DEEC86 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DED875,00000000,00000001,00000000,00000000,?,00DECA79,00000000,00DE5C49,00000000), ref: 00DEEC9D
GetLastError.KERNEL32(?,00DED875,00000000,00000001,00000000,00000000,?,00DECA79,00000000,00DE5C49,00000000,00000000,00000000,?,00DECFCD,00000000), ref: 00DEECA9

Part of subcall function 00DEEC6F: CloseHandle.KERNEL32(FFFFFFFE,00DEECB9,?,00DED875,00000000,00000001,00000000,00000000,?,00DECA79,00000000,00DE5C49,00000000,00000000,00000000), ref: 00DEEC7F

___initconout.LIBCMT ref: 00DEECB9

Part of subcall function 00DEEC31: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DEEC60,00DED862,00000000,?,00DECA79,00000000,00DE5C49,00000000,00000000), ref: 00DEEC44

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DED875,00000000,00000001,00000000,00000000,?,00DECA79,00000000,00DE5C49,00000000,00000000), ref: 00DEECCE

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: da9b6a8377fd2e473e97921b11f5f2e1442fc5266885f01eb8f36a20567c5fce
Instruction ID: 24aee1eaf876c431ac6d816d4220d91980abdb06ffd776c5e9cd41481e32dd69
Opcode Fuzzy Hash: da9b6a8377fd2e473e97921b11f5f2e1442fc5266885f01eb8f36a20567c5fce
Instruction Fuzzy Hash: 4BF0AC36501259BBCF222F96EC0599E7F66FB097B5B158011FA1D95220C732C821EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE4BF0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DE4BF9

Part of subcall function 00DE604F: HeapFree.KERNEL32(00000000,00000000,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?), ref: 00DE6065
Part of subcall function 00DE604F: GetLastError.KERNEL32(?,?,00DE89CC,?,00000000,?,00000000,?,00DE89F3,?,00000007,?,?,00DE8E6D,?,?), ref: 00DE6077

_free.LIBCMT ref: 00DE4C0C
_free.LIBCMT ref: 00DE4C1D
_free.LIBCMT ref: 00DE4C2E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ce3d3397752aded57e9263dec262cc916570b36df4be76e680bda92d44224482
Instruction ID: 652714dc1db409795b018fe54bf236ea0d609e5e9ed29e145ea310daf62a8bff
Opcode Fuzzy Hash: ce3d3397752aded57e9263dec262cc916570b36df4be76e680bda92d44224482
Instruction Fuzzy Hash: ACE046708C49709F86323F5BFC214D93A26E794B81331A006F028B2232C739412ADAF2

Uniqueness

Uniqueness Score: -1.00%

Function 00DF112A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00DF12A5

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF1292

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-3069916640
Opcode ID: 08aa6d2b59774c4f5e4adf366b8f8ed56ee9bc225e3f5d00eff7ecd9507aea3e
Instruction ID: 81fb0639fe0b064ec7a0ef259da99ab39c58c68f2fcd83f5dd8856b4a5cb813e
Opcode Fuzzy Hash: 08aa6d2b59774c4f5e4adf366b8f8ed56ee9bc225e3f5d00eff7ecd9507aea3e
Instruction Fuzzy Hash: 8C41A33AD0022DEBDF214AD8CC06BBE76B1AB40760F1AC125EB15EB150D735CD50ABB8

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4BD7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,00000101), ref: 00DF4D38

Strings

PendingFileRenameOperations, xrefs: 00DF4C28, 00DF4D10
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00DF4BE8

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 3d7d38cba9a61699360deeefbc80183c60f12f7c4a6423adaa77070cafbeb364
Instruction ID: 1fb0cb17fdae37b0f0ede86afc09adf793cacabea678739f81eb85987dbf0e6b
Opcode Fuzzy Hash: 3d7d38cba9a61699360deeefbc80183c60f12f7c4a6423adaa77070cafbeb364
Instruction Fuzzy Hash: DB417F71E0121DEBCB21DF95C9419BFBBB9EB44710F2A8069E601A7251EB309E41DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DF1571 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00DF15E7
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00DF161F

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF165B

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-3069916640
Opcode ID: 177edb79ed3feb3eb7176ce4e248fd8f3994b711f5ccac33c010f958c44f7941
Instruction ID: 9eaed22aea3ebe3b4afcd4a9cbf62d217dbb38ddee3c21e3edb82f6f6fb136f6
Opcode Fuzzy Hash: 177edb79ed3feb3eb7176ce4e248fd8f3994b711f5ccac33c010f958c44f7941
Instruction Fuzzy Hash: A041823AD0012EFBDB10DF94C8819BEBBB9EF00354F1A8169EA15E7250D7319E119BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE09C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DE09F3
__IsNonwritableInCurrentImage.LIBCMT ref: 00DE0AAC

Strings

csm, xrefs: 00DE0A96

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 7d12ae30b3adf22cd8f8a4ca59bfd8d9697a365c5863f8d15e5a82a2ac348dc9
Instruction ID: a77b6f8788293fbc925c20daff6af4d53542a27b927ab642f1de1488544980fa
Opcode Fuzzy Hash: 7d12ae30b3adf22cd8f8a4ca59bfd8d9697a365c5863f8d15e5a82a2ac348dc9
Instruction Fuzzy Hash: 0B416534A0034D9FCB10EF9AC844A9EBFB5FF45314F188165E815AB352D7B1AA95CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9322 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF9213: lstrlenW.KERNEL32(00000100,?,?,?,00DF95B3,000002C0,00000100,00000100,00000100,?,?,?,00DD7BE4,?,?,000001BC), ref: 00DF9238

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00DFB4F0,wininet.dll,?), ref: 00DF9422
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00DFB4F0,wininet.dll,?), ref: 00DF942F

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

Part of subcall function 00DF131B: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00DD8C68), ref: 00DF1376
Part of subcall function 00DF131B: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DD8C68,00000000), ref: 00DF1394

Strings

wininet.dll, xrefs: 00DF9397, 00DF93E4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: bbfb666ebd0f729d5aa8d1b3ec516b64871b56f873582876dbf12f141495b72c
Instruction ID: 6eeb7223965e242ab8c236689828a7e404bcb0206f8f047f893042af1ceb713f
Opcode Fuzzy Hash: bbfb666ebd0f729d5aa8d1b3ec516b64871b56f873582876dbf12f141495b72c
Instruction Fuzzy Hash: 9F313B32C0012EFFCF11AFA4C9909BEFAB5EF04314B168169EA01B6121D7319E51ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3B16 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00DB3B79

Strings

crypt32.dll, xrefs: 00DB3B36, 00DB3B75, 00DB3B77
wininet.dll, xrefs: 00DB3B37

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 39ffa86aa758ca96ac80bca0cde021d7e7403628b06e64b8df67a1e9bd647b60
Instruction ID: 030f785f94ab153865f0c5c997124662c4edcf8fb446882793b9a1238fd11d44
Opcode Fuzzy Hash: 39ffa86aa758ca96ac80bca0cde021d7e7403628b06e64b8df67a1e9bd647b60
Instruction Fuzzy Hash: BD115E71600219ABCF08DF19CDD59DF7F69EF84394B14802AFD0A4B315D630EA109AF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC3B19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00DC4029,feclient.dll,?,00000000,?,?,?,00DB4B92), ref: 00DC3BBA

Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00DF15E7
Part of subcall function 00DF1571: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00DF161F

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00DC3B30
Logging, xrefs: 00DC3B47

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 9985774c682c1807756f0bd76083dc02a28f541cbb4f06bf8515efdd3e2c7dcc
Instruction ID: 8518f3cf0fa79ca0307d98425151ea7e232db80e7a02795285aeb8a6ce344799
Opcode Fuzzy Hash: 9985774c682c1807756f0bd76083dc02a28f541cbb4f06bf8515efdd3e2c7dcc
Instruction Fuzzy Hash: A511267650031BABEB249650CD46FFA77B5AB00B10FA88059E902A7080D7709F829674

Uniqueness

Uniqueness Score: -1.00%

Function 00DF199A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,00E00FB8,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DBF3CC,00000000,?,00020006), ref: 00DF19CD
RegDeleteValueW.ADVAPI32(00020006,00E00FB8,00000000,?,?,00DBF3CC,00000000,?,00020006,?,00E00FB8,00020006,00000000,?,?,?), ref: 00DF19FD

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00DF1A31

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-3069916640
Opcode ID: 59cfb119e77086736f99497d65f457312fddbc383be9ae06aea8e9c6759de0db
Instruction ID: 6e130dacbca859d314647913399629cabe652cdff0ad9c0bb01525d9d4c019de
Opcode Fuzzy Hash: 59cfb119e77086736f99497d65f457312fddbc383be9ae06aea8e9c6759de0db
Instruction Fuzzy Hash: 8311023E94227EF7DB214A908C05BBE7A65EB00B60F1BC121BF51BA090E671CD519BF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBDE44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,00DD74FE,00000000,IGNOREDEPENDENCIES,00000000,?,00DFB508), ref: 00DBDE95

Strings

IGNOREDEPENDENCIES, xrefs: 00DBDE4C
Failed to copy the property value., xrefs: 00DBDEC9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 0a0c60f3790c768e96db0604c3554f29e07c42d614503190d0c0e927fb452501
Instruction ID: ac4880f5bff704933b906346af0dc6c60390cb531fe717af0d38cf3a44fb609e
Opcode Fuzzy Hash: 0a0c60f3790c768e96db0604c3554f29e07c42d614503190d0c0e927fb452501
Instruction Fuzzy Hash: 0E119132200215EFDB104B99CC85FEAB797AF24321F254175FA5A9F2A1EB71E850C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,00DC70CF,00000000,00DC70CF,00000000,00000000,00DC70CF,00000000,00000000,00000000,?,00DB244B,00000000,00000000), ref: 00DB15BC
GetLastError.KERNEL32(?,00DB244B,00000000,00000000,00DC70CF,00000200,?,00DF56D5,00000000,00DC70CF,00000000,00DC70CF,00000000,00000000,00000000), ref: 00DB15C6

Strings

c:\agent\_work\138\s\src\libs\dutil\strutil.cpp, xrefs: 00DB15EA

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\138\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-1498286024
Opcode ID: 5fc7b1b2a511dac2c5f603eacdd28b71b08b7fed4d6385ef797d30da48589502
Instruction ID: 6978751189fd7b547c20482d0ba4c51329c385a1091c929948ed8c0551dc1365
Opcode Fuzzy Hash: 5fc7b1b2a511dac2c5f603eacdd28b71b08b7fed4d6385ef797d30da48589502
Instruction Fuzzy Hash: FB01F937900235E78B318A958C54ED77BB8EF85770B454111FE16DB240C620DC10C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC582C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00DC5849
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00DC58A2

Strings

Failed to initialize COM on cache thread., xrefs: 00DC585E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: a0a249c942fc9ea19dd04d561c4918876f8178c41559ae9f05b1f8d63faa9756
Instruction ID: c825a4598d87f10661b1138f035459f608967e070c3b83f9ebffeb7089de5fc5
Opcode Fuzzy Hash: a0a249c942fc9ea19dd04d561c4918876f8178c41559ae9f05b1f8d63faa9756
Instruction Fuzzy Hash: 40016D72600619FFCB059F95D884DEABBACFF08364B10812AF609D7221DB71AD508BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF5A5B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00DC8E75,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00DF5A8A
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DC8E75,?), ref: 00DF5AA5

Strings

c:\agent\_work\138\s\src\libs\dutil\aclutil.cpp, xrefs: 00DF5AC9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\138\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-245660080
Opcode ID: b71cfeb028caec3ec5e9bf129614f0ed9f9a0d573e0a4a421798744bfa71072c
Instruction ID: ecff18c7ca1b3553de8974bb68861936bb9f22e9b6612f3cb13864a23329bd16
Opcode Fuzzy Hash: b71cfeb028caec3ec5e9bf129614f0ed9f9a0d573e0a4a421798744bfa71072c
Instruction Fuzzy Hash: FC017037801629FBCF229E95EC05AEE7A75EF44760F068211BF15A6114C6319D20D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4061 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF1436: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00E1BB7C,00000000,?,00DF5BF9,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00DF144A

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00DF3F01,?), ref: 00DF40D2

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00DF407C
EnableLUA, xrefs: 00DF40A4

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 622af14819462111c2fa984d95fb5df3279759cc4a793c052a8c4c3f593152e7
Instruction ID: 5afb6b971aae0c3e85c8bfdbdb816a1ec96bfe71c492a594e0c71534f594a432
Opcode Fuzzy Hash: 622af14819462111c2fa984d95fb5df3279759cc4a793c052a8c4c3f593152e7
Instruction Fuzzy Hash: 54018F3291022CFBD7209BA4C906BFEFAB8DB04721F268164AB00B3191DB745E94D7F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF6D18 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00DF6D7D

Strings

`Dv, xrefs: 00DF6D7D
c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp, xrefs: 00DF6D39

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: FreeString
String ID: `Dv$c:\agent\_work\138\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-2207397114
Opcode ID: d343aa2d3f5168b6afe5db83550b8fbbe7c8849998ea56044671ab0a0ec79382
Instruction ID: d6612714ad3841c183b7a1ee2e726f3565d8ffdc120ca722008b20fe603a0417
Opcode Fuzzy Hash: d343aa2d3f5168b6afe5db83550b8fbbe7c8849998ea56044671ab0a0ec79382
Instruction Fuzzy Hash: A7016932A0061CF6CB225A95EC06BBEB6B8DB40B60F2AC215FA01B6550C775CE01E6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB65CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00DB65E1

Part of subcall function 00DF0F42: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00DB5F1B,00000000), ref: 00DF0F57
Part of subcall function 00DF0F42: GetProcAddress.KERNEL32(00000000), ref: 00DF0F5E
Part of subcall function 00DF0F42: GetLastError.KERNEL32(?,?,?,?,00DB5F1B,00000000), ref: 00DF0F79

Part of subcall function 00DB5D4F: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00DB5DD5

Strings

Failed to get 64-bit folder., xrefs: 00DB6604
Failed to set variant value., xrefs: 00DB661E

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: b9d88b2e2536e9898ba5058d2760f4218195f4e9c34a5fd7232804afa8146bac
Instruction ID: 2c22f64620a29af8436c12f158098531f3b1d55c45d63002fab1ac30a3203031
Opcode Fuzzy Hash: b9d88b2e2536e9898ba5058d2760f4218195f4e9c34a5fd7232804afa8146bac
Instruction Fuzzy Hash: 73018132D10228FBCB12AB90DD06EEEBB69DF04B21F118196B901B6151D775EF409AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDE0EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00DDEA12

Part of subcall function 00DE0BE1: RaiseException.KERNEL32(?,?,?,00DDEA34,?,00000000,00000000,?,?,?,?,?,00DDEA34,?,00E18400), ref: 00DE0C41

__CxxThrowException@8.LIBVCRUNTIME ref: 00DDEA2F

Strings

Unknown exception, xrefs: 00DDEA3C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7ec5a6dd0e18c4dfc22efd79e79cc1fd825aeedefb11130150480eddee72701d
Instruction ID: cbc31d4738aa323f440b3b53e3bfbff13834bea474fb3c60120eaa2831e05904
Opcode Fuzzy Hash: 7ec5a6dd0e18c4dfc22efd79e79cc1fd825aeedefb11130150480eddee72701d
Instruction Fuzzy Hash: F5F0FC3490030D778B10BB79DC5699D776CAF00710B644662B918D9691EFB0D956C5F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DF4E3D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,762334C0,?,?,?,00DBBADD,?,?,?,00000000,00000000), ref: 00DF4E55
GetLastError.KERNEL32(?,?,?,00DBBADD,?,?,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DF4E5F

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00DF4E83

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-3168567549
Opcode ID: 0acf09f1e78481aa66aaf53bbfa7fa73bc0dc0a2a79b622c849a09dd05a14267
Instruction ID: 413319e2885eac59321045302ac7cb421475a9e41b8126f12e5b8649f1b4dae5
Opcode Fuzzy Hash: 0acf09f1e78481aa66aaf53bbfa7fa73bc0dc0a2a79b622c849a09dd05a14267
Instruction Fuzzy Hash: 3AF04FB6A0123AAB97108B85D8059ABFBA8FF04B64B02C116BD55A7350E770AD00C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DF41F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00DB54DE,?,00000000,00DB54DE,?,?,?), ref: 00DF4217
CoCreateInstance.OLE32(00000000,00000000,00000001,00E17B6C,?), ref: 00DF422F

Strings

Microsoft.Update.AutoUpdate, xrefs: 00DF4212

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 5142c5fc190802f40e2eceeb9c1253a44cd692adb92e81f9e4ac0a9fdf09b038
Instruction ID: e8cd8fba878be44c22de3bc6fe9f51a0a34037c7853471a8aa401b88185d8ca2
Opcode Fuzzy Hash: 5142c5fc190802f40e2eceeb9c1253a44cd692adb92e81f9e4ac0a9fdf09b038
Instruction Fuzzy Hash: 9FF03A71A50308BFEB00DFA8DC05EFFB7F9EB08B10F414026BA01F6250D670AA448672

Uniqueness

Uniqueness Score: -1.00%

Function 00DB62DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 00DB62E9

Part of subcall function 00DF0E3A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,00DB62F5,00000000), ref: 00DF0E4C
Part of subcall function 00DF0E3A: GetProcAddress.KERNEL32(00000000), ref: 00DF0E53
Part of subcall function 00DF0E3A: GetLastError.KERNEL32(?,?,?,00DB62F5,00000000), ref: 00DF0E72

Strings

Failed to get native machine value., xrefs: 00DB62FB
Failed to set variant value., xrefs: 00DB631C

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get native machine value.$Failed to set variant value.
API String ID: 896058289-851826934
Opcode ID: 2a0fc6e20353c5b9a001e3d8137e2c6ed2288055d19b71ecf5d3ebbfe976b901
Instruction ID: 23535421f5341881e12bc8c4e10410ba09846931d4310f82d4ba9514add84455
Opcode Fuzzy Hash: 2a0fc6e20353c5b9a001e3d8137e2c6ed2288055d19b71ecf5d3ebbfe976b901
Instruction Fuzzy Hash: B1F0A072940238F7CB126A9AED16EFE7E9CDB00764B56C016FA05E7340DB28DE0082F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DF12D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00DF12F4

Strings

RegDeleteKeyExW, xrefs: 00DF12E9
AdvApi32.dll, xrefs: 00DF12D9

Memory Dump Source

Source File: 00000008.00000002.2711952450.0000000000DB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000008.00000002.2711924504.0000000000DB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2711992523.0000000000DFB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712024790.0000000000E1B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2712063829.0000000000E1E000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_db0000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 5bcc7bd87423a018df7f73d8df833f43d6bab7cc3f3140d638cde3c0a7547039
Instruction ID: 17b82f3fd9c8ef9980edc54b358e42de39fb97e90bcff90e5d42d80ca2eb811e
Opcode Fuzzy Hash: 5bcc7bd87423a018df7f73d8df833f43d6bab7cc3f3140d638cde3c0a7547039
Instruction Fuzzy Hash: C3E0B630A813259FC3215F2ABC096D53AD0E711756B169126E510F62A1D7F158888FA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dotnet60desktop.exePID: 6884, Parent PID: 5024COMMON

Executed Functions

Function 00B21070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B234EF: GetModuleFileNameW.KERNEL32(?,00000000,00000104,00000000,00000104,?,00000000,00000000,?,00B4AD90,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?), ref: 00B23510

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00B210F6

Part of subcall function 00B21173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00B2111A,cabinet.dll,00000009,?,?,00000000), ref: 00B21184
Part of subcall function 00B21173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00B2111A,cabinet.dll,00000009,?,?,00000000), ref: 00B2118F
Part of subcall function 00B21173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B2119D
Part of subcall function 00B21173: GetLastError.KERNEL32(?,?,?,?,?,00B2111A,cabinet.dll,00000009,?,?,00000000), ref: 00B211B8
Part of subcall function 00B21173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00B211C0
Part of subcall function 00B21173: GetLastError.KERNEL32(?,?,?,?,?,00B2111A,cabinet.dll,00000009,?,?,00000000), ref: 00B211D5

CloseHandle.KERNEL32(?,?,?,?,00B6B4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00B21131

Strings

clbcatq.dll, xrefs: 00B210BC
version.dll, xrefs: 00B210A7
msasn1.dll, xrefs: 00B210C3
crypt32.dll, xrefs: 00B210CA
msi.dll, xrefs: 00B210A0
feclient.dll, xrefs: 00B210D1
wininet.dll, xrefs: 00B210AE
cabinet.dll, xrefs: 00B21099
comres.dll, xrefs: 00B210B5

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 523a43063a78e076eeb90736e3f5efc7993347a94e8b9ddec22874deed84ca00
Instruction ID: 6fdb5026f47398c6cf143f65e41c7ffa5e8989dcb7d31df0c0e59368b19a5226
Opcode Fuzzy Hash: 523a43063a78e076eeb90736e3f5efc7993347a94e8b9ddec22874deed84ca00
Instruction Fuzzy Hash: DC218D72900228ABCB109FA8EC45FEFBBF8EF08714F104595EA24F7291DB7459448BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00B602DD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B8C6EC,00000000,?,?,?,?,00B41188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00B6030B
GetCurrentProcessId.KERNEL32(00000000,?,00B41188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00B6031B
GetCurrentThreadId.KERNEL32 ref: 00B60324
GetLocalTime.KERNEL32(8007139F,?,00B41188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00B6033A
LeaveCriticalSection.KERNEL32(00B8C6EC,00B41188,?,00000000,0000FDE9,?,00B41188,8007139F,Invalid operation for this state.,c:\agent\_work\138\s\src\burn\user\cabextract.cpp,000001C7,8007139F), ref: 00B60431

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00B603D7

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 5e18a4e6384b87c2f13544b08953f2005dcaf90d5282946bc514d7a98e4785d0
Instruction ID: da4d3aee114169ec5782994b760f1b1019604d31b0ead97dc867c3da26d9bbe3
Opcode Fuzzy Hash: 5e18a4e6384b87c2f13544b08953f2005dcaf90d5282946bc514d7a98e4785d0
Instruction Fuzzy Hash: 65415272A10115ABDF21AFA6DC44ABF77F8FB08741F1041A5F601E7260DB388D41DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A096 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to copy working folder., xrefs: 00B3A0F1
Failed create working folder., xrefs: 00B3A0C9
Failed to calculate working folder to ensure it exists., xrefs: 00B3A0B3

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 548a383aee061bcc6d9cb6c90760cfc25e4b61677539ee8761fb4edd773249c7
Instruction ID: ad354138d644ccbdb2d7dc71b11332279cc0384a90776cffa17e9483e42f5065
Opcode Fuzzy Hash: 548a383aee061bcc6d9cb6c90760cfc25e4b61677539ee8761fb4edd773249c7
Instruction Fuzzy Hash: CC01BC32900669FB8F32AB55ED02C9F7BF9DE90B60F3081D1F804B6160DF318E40A692

Uniqueness

Uniqueness Score: -1.00%

Function 00B54503 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00B54502,00000000,80004004,?,00000000,?,00B51731), ref: 00B54525
TerminateProcess.KERNEL32(00000000,?,00B54502,00000000,80004004,?,00000000,?,00B51731), ref: 00B5452C
ExitProcess.KERNEL32 ref: 00B5453E

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2efc6666233ec77cbfc618ee8b599bc742d5c229bc05254127470e5f0d90c8aa
Instruction ID: 95d2bb07f0207aa24e2a6c46a06c3ddf317745a401a06d1bd7a4bb1de6bfefdb
Opcode Fuzzy Hash: 2efc6666233ec77cbfc618ee8b599bc742d5c229bc05254127470e5f0d90c8aa
Instruction Fuzzy Hash: 67E01231041548AFCB116F54E819A483BB8EB60742B404490FA09CA121DB79EDC6CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00B6488B Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,?,?,00000000,?), ref: 00B648C6
FindClose.KERNEL32(00000000), ref: 00B648D2

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f178ad180b9e01ac63a85adb635d7d36454ff813e2526d27e7b2f455f3b3679b
Instruction ID: eb6b68c0263c04e7396fd135e73f0fe1731480c3971f9472e837fdfd0e6b616a
Opcode Fuzzy Hash: f178ad180b9e01ac63a85adb635d7d36454ff813e2526d27e7b2f455f3b3679b
Instruction Fuzzy Hash: 5001D635600608ABCB10EF65DD89DABB3FCEBC5315F4000A5E514E3180CB389E498750

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B54B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00B2B5C2
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B610
GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00B2B616
ReadFile.KERNELBASE(00000000,00B244EB,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B65E
GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00B2B664
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B6C1
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B6C7
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B710
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B716
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B787
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B78D
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B7D6
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B7DC
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B825
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B82B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B877
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B87D

Part of subcall function 00B23A1A: GetProcessHeap.KERNEL32(?,000001C7,?,00B223A7,?,00000001,80004005,8007139F,?,?,00B60687,8007139F,?,00000000,00000000,8007139F), ref: 00B23A2B
Part of subcall function 00B23A1A: RtlAllocateHeap.NTDLL(00000000,?,00B223A7,?,00000001,80004005,8007139F,?,?,00B60687,8007139F,?,00000000,00000000,8007139F), ref: 00B23A32

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B8D0
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B932
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B9BC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00B2B9C6

Strings

Failed to find valid DOS image header in buffer., xrefs: 00B2BCAB
Failed to read signature size., xrefs: 00B2B856
Failed to seek past optional headers., xrefs: 00B2B8AB
Failed to read complete image section header, index: %u, xrefs: 00B2BC35
Failed to read complete section info., xrefs: 00B2BA85
PE Header from file didn't match PE Header in memory., xrefs: 00B2BBD1
(, xrefs: 00B2B8DD
Failed to get total size of bundle., xrefs: 00B2BAE3
Failed to read section info, unsupported version: %08x, xrefs: 00B2BAB5
.wix, xrefs: 00B2B8F0
Failed to allocate memory for container sizes., xrefs: 00B2BB93
burn, xrefs: 00B2B8F8
Failed to seek to start of file., xrefs: 00B2B641
Failed to read signature offset., xrefs: 00B2B807
Failed to read section info, data to short: %u, xrefs: 00B2B96A
4, xrefs: 00B2B944
c:\agent\_work\138\s\src\burn\user\section.cpp, xrefs: 00B2B5E3, 00B2B637, 00B2B685, 00B2B6E8, 00B2B737, 00B2B7AE, 00B2B7FD, 00B2B84C, 00B2B8A1, 00B2B958, 00B2B998, 00B2B9EA, 00B2BA4F, 00B2BA79, 00B2BAA0, 00B2BB87, 00B2BBC7, 00B2BBE6, 00B2BC23, 00B2BC61, 00B2BC84, 00B2BC9F
Failed to find valid NT image header in buffer., xrefs: 00B2BC90
Failed to allocate buffer for section info., xrefs: 00B2B9A4
Failed to open handle to user process path., xrefs: 00B2B5ED
Failed to read image section header, index: %u, xrefs: 00B2BC6C
Failed to seek to section info., xrefs: 00B2B7B8, 00B2B9F4
Failed to find Burn section., xrefs: 00B2BBF2
Failed to read NT header., xrefs: 00B2B741
Failed to read section info., xrefs: 00B2BA59
PE, xrefs: 00B2B758
Failed to read DOS header., xrefs: 00B2B68F
Failed to seek to NT header., xrefs: 00B2B6F2

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\138\s\src\burn\user\section.cpp
API String ID: 3411815225-3112695413
Opcode ID: 5eabd605236d4eb9b76d2baa8b380cc3b03e79de07351a624841ed9d2df74477
Instruction ID: b302d9812ec9dd9d2168eb707172994a648cdb912bb607b89b097ff6e4f6d73d
Opcode Fuzzy Hash: 5eabd605236d4eb9b76d2baa8b380cc3b03e79de07351a624841ed9d2df74477
Instruction Fuzzy Hash: 8E12B376940236EBDB309A55AC46FAA7BE4EF05B10F0141E5F90CBF291DF799D408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3554D Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 228
filepipesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,7694B390,?,00B245B7,?,00B6B4F0), ref: 00B3556E
GetCurrentProcessId.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B35579
SetNamedPipeHandleState.KERNELBASE(?,000000FF,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B355B0
ConnectNamedPipe.KERNELBASE(?,00000000,?,00B245B7,?,00B6B4F0), ref: 00B355C5
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B355CF
Sleep.KERNELBASE(00000064,?,00B245B7,?,00B6B4F0), ref: 00B35604
SetNamedPipeHandleState.KERNELBASE(?,00000000,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B35627
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B35642
WriteFile.KERNEL32(?,00B245B7,00B6B4F0,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B3565D
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B35678
ReadFile.KERNELBASE(?,00000000,00000004,00000000,00000000,?,00B245B7,?,00B6B4F0), ref: 00B35693
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B356EE
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B35722
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B35756
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B3578A
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B357BB
GetLastError.KERNEL32(?,00B245B7,?,00B6B4F0), ref: 00B357EC

Strings

Failed to write secret length to pipe., xrefs: 00B357B4
Failed to write our process id to pipe., xrefs: 00B3574C
Failed to reset pipe to blocking., xrefs: 00B357E5
Failed to write secret to pipe., xrefs: 00B35780
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00B356DA, 00B3570E, 00B35742, 00B35776, 00B357AA, 00B357DB, 00B3580C
crypt32.dll, xrefs: 00B35640
Failed to read ACK from pipe., xrefs: 00B35718
Failed to set pipe to non-blocking., xrefs: 00B35816
Failed to wait for child to connect to pipe., xrefs: 00B356E4

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\138\s\src\burn\user\pipe.cpp$crypt32.dll
API String ID: 2944378912-629510435
Opcode ID: b37a339addc75471f0974c7da246dd752e5c0bd89f0de15dd7db3cdab139808f
Instruction ID: f689b18ea90849a9c08ad33a34d9aa3fa36785bb710292200a30da180192aa9e
Opcode Fuzzy Hash: b37a339addc75471f0974c7da246dd752e5c0bd89f0de15dd7db3cdab139808f
Instruction Fuzzy Hash: 6761A377D90739E7D7309AA48C4ABAAB6E8AF00B51F2241A5FD14FB190DB749D0087E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B257E2 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,00B2A97A,00000100,000002C0,000002C0,00000100), ref: 00B25807
lstrlenW.KERNEL32(000002C0,?,00B2A97A,00000100,000002C0,000002C0,00000100), ref: 00B25811
_wcschr.LIBVCRUNTIME ref: 00B25A16
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,00B2A97A,00000100,000002C0,000002C0,00000100), ref: 00B25CB9

Strings

Failed to format placeholder string., xrefs: 00B25AC6
Failed to reallocate variable array., xrefs: 00B25A9B
Failed to allocate string., xrefs: 00B25C30
Failed to allocate variable array., xrefs: 00B25AF4
Failed to set variable value., xrefs: 00B25AD0
Failed to append string., xrefs: 00B2588D
Failed to allocate record., xrefs: 00B25A7A
Failed to allocate buffer for format string., xrefs: 00B2582F
Failed to get formatted length., xrefs: 00B25C01
c:\agent\_work\138\s\src\burn\user\variable.cpp, xrefs: 00B25A6D, 00B25A8E, 00B25AE7, 00B25B39, 00B25BC5, 00B25BF7, 00B25C73
Failed to set record string., xrefs: 00B25BCF
[%d], xrefs: 00B259D1
Failed to format record., xrefs: 00B25C7D
Failed to determine variable visibility: '%ls'., xrefs: 00B25AA9
Failed to set record format string., xrefs: 00B25B43
Failed to append placeholder., xrefs: 00B25ABC
Failed to copy string., xrefs: 00B25C9D
Failed to get variable name., xrefs: 00B25AFB
*****, xrefs: 00B25988

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\138\s\src\burn\user\variable.cpp
API String ID: 1026845265-2015882285
Opcode ID: 91577d445b29fc25ac2a40ba2ce40b9e982d1b37d2b36b212d796b41dc7bbaa2
Instruction ID: 3bd67749489e129ee0fc596ec6087cf5962ef25895f469372418a0d1b076a29a
Opcode Fuzzy Hash: 91577d445b29fc25ac2a40ba2ce40b9e982d1b37d2b36b212d796b41dc7bbaa2
Instruction Fuzzy Hash: A7F1A471D01639FBDB219F64A845EAF7BF4EF04B10F1581E5F909AB240E7789E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2520D Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B2528F

Part of subcall function 00B60912: InitializeCriticalSection.KERNEL32(00B8C6EC,?,00B2529B,00000000,?,?,?,?,?,?), ref: 00B60929

Part of subcall function 00B21206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00B252B7,00000000,?), ref: 00B21244
Part of subcall function 00B21206: GetLastError.KERNEL32(?,?,?,00B252B7,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00B2124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00B252FD

Part of subcall function 00B612D3: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00B612F4

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00B2538F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00B25399
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B25606

Strings

Failed to get OS info., xrefs: 00B253C7
3.14.0.5722, xrefs: 00B253FC
Failed to initialize COM., xrefs: 00B25309
Failed to initialize user state., xrefs: 00B252E4
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00B253BD
Failed to initialize Cryputil., xrefs: 00B2531E
Failed to run RunOnce mode., xrefs: 00B25494
Failed to run untrusted mode., xrefs: 00B2552E
Failed to parse command line., xrefs: 00B252BD
Failed to initialize XML util., xrefs: 00B25371
Invalid run mode., xrefs: 00B25471
Failed to initialize Regutil., xrefs: 00B25341
Failed to run per-machine mode., xrefs: 00B254E4
Failed to run per-user mode., xrefs: 00B2550C
Failed to initialize Wiutil., xrefs: 00B25359
Failed to run embedded mode., xrefs: 00B254BC
Failed to initialize core., xrefs: 00B2543B

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.14.0.5722$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 3262001429-872186229
Opcode ID: 3a40ef91c7ed78fe89c61b065043ab184c10bac3835c3b8b6d42f1d38ea63417
Instruction ID: 47a17e2dd4e60d57f02e0f922a48965e766d8d538fc20395450f24656e89e634
Opcode Fuzzy Hash: 3a40ef91c7ed78fe89c61b065043ab184c10bac3835c3b8b6d42f1d38ea63417
Instruction Fuzzy Hash: 5FB1D172D41A389BDB32AF64AC86BEE76F8AF14710F0401D5F90DF6251DB749E808E91

Uniqueness

Uniqueness Score: -1.00%

Function 00B37523 Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get unique temporary folder for bootstrapper application., xrefs: 00B377C7
Failed to overwrite the %ls built-in variable., xrefs: 00B376B4
Failed to load catalog files., xrefs: 00B37808
Failed to initialize internal cache functionality., xrefs: 00B37798
Failed to open manifest stream., xrefs: 00B375A4
WixBundleSourceProcessPath, xrefs: 00B376F1
WixBundleOriginalSource, xrefs: 00B37752
Failed to get source process folder from path., xrefs: 00B3771E
Failed to extract bootstrapper application payloads., xrefs: 00B377E8
Failed to initialize variables., xrefs: 00B3756A
WixBundleElevated, xrefs: 00B3769E, 00B376AF
WixBundleUILevel, xrefs: 00B376CF, 00B376E0
Failed to get manifest stream from container., xrefs: 00B375C5
Failed to set original source variable., xrefs: 00B37763
Failed to load manifest., xrefs: 00B375E1
Failed to set source process folder variable., xrefs: 00B3773E
Failed to parse command line., xrefs: 00B37660
Failed to open attached UX container., xrefs: 00B37587
Failed to set source process path variable., xrefs: 00B37702
WixBundleSourceProcessFolder, xrefs: 00B3772D

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: eb0b3be73e11e549e9958cac57f6f00496307bbc20c5f514a161b8d5796aecd0
Instruction ID: f69cd0dc3d06e704b9abe4f4c4844825c84377d8469c88bf33884a12e6de2ae3
Opcode Fuzzy Hash: eb0b3be73e11e549e9958cac57f6f00496307bbc20c5f514a161b8d5796aecd0
Instruction Fuzzy Hash: F2A177B2984625BBDB229AA4DC85EEEB7ECBB14700F2041A6F519F7150DB70AD44C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B386B8 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00B24E38,?,?,00000000,00B24E38,00000000), ref: 00B386FB
GetLastError.KERNEL32 ref: 00B38708

Part of subcall function 00B64322: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00B643B8

SetFilePointerEx.KERNEL32(00000000,00B6B4A8,00000000,00000000,00000000,?,00000000,00B6B4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B387B5
GetLastError.KERNEL32 ref: 00B387BF
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00B6B4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B388EA

Strings

Failed to update signature offset., xrefs: 00B38809
c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00B3872C, 00B387E3, 00B3884A, 00B388B9
Failed to seek to beginning of user file: %ls, xrefs: 00B38761
Failed to zero out original data offset., xrefs: 00B388DC
msi.dll, xrefs: 00B387FC
Failed to seek to original data in exe burn section header., xrefs: 00B388C3
Failed to create user file at path: %ls, xrefs: 00B38739
cabinet.dll, xrefs: 00B38863
Failed to seek to checksum in exe header., xrefs: 00B387ED
Failed to copy user from: %ls to: %ls, xrefs: 00B38790
Failed to seek to signature table in exe header., xrefs: 00B38854

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy user from: %ls to: %ls$Failed to create user file at path: %ls$Failed to seek to beginning of user file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\138\s\src\burn\user\cache.cpp$cabinet.dll$msi.dll
API String ID: 3608016165-3615985753
Opcode ID: d3f2ee4b14af928936513c23f7d129da5886e7a0a04bfda1582148d2c499854c
Instruction ID: b42cb361ceba767dfe4820ea9cc234eea89487ebbcf909a84ba3e04f9970f432
Opcode Fuzzy Hash: d3f2ee4b14af928936513c23f7d129da5886e7a0a04bfda1582148d2c499854c
Instruction Fuzzy Hash: 6651C772941735BBDB225B649C46F7F7AE8EF04B10F2141A5FE14FB190EE549C0096E2

Uniqueness

Uniqueness Score: -1.00%

Function 00B276D4 Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00B37564,00B25435,00000000,00B254BD), ref: 00B276F4

Strings

WixBundleProviderKey, xrefs: 00B27F6E
0, xrefs: 00B2770B
WixBundleForcedRestartPackage, xrefs: 00B27F04
InstallerVersion, xrefs: 00B278DB
WixBundleTag, xrefs: 00B27F9E
WixBundleAction, xrefs: 00B27E5E
#, xrefs: 00B27773
WixBundleActiveParent, xrefs: 00B27F52
WixBundleSourceProcessPath, xrefs: 00B27F7E
LogonUser, xrefs: 00B2792A
', xrefs: 00B2795D
WixBundleElevated, xrefs: 00B27F36
Failed to add built-in variable: %ls., xrefs: 00B28009
WixBundleExecutePackageAction, xrefs: 00B27EE8
WixBundleUILevel, xrefs: 00B27FAE
InstallerName, xrefs: 00B278BA
Date, xrefs: 00B27818
WixBundleVersion, xrefs: 00B27FBE
$, xrefs: 00B27E31
WixBundleExecutePackageCacheFolder, xrefs: 00B27ECC
WixBundleInstalled, xrefs: 00B27F1A
WixBundleSourceProcessFolder, xrefs: 00B27F8E

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 3099a8b20a5afea68478610671c7efd8d2ae26acef1bf4107d1906ee0eb2d38f
Instruction ID: c8ece8c3179f9cf10c05bb18195b4915fed26966eba0d8bdedc2fbe38c320de7
Opcode Fuzzy Hash: 3099a8b20a5afea68478610671c7efd8d2ae26acef1bf4107d1906ee0eb2d38f
Instruction Fuzzy Hash: 714246B2C116689FDB65CF5AD9887D9FBF4BB48304F5081EED24CA6210C7B40B888F49

Uniqueness

Uniqueness Score: -1.00%

Function 00B382A6 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000000,?), ref: 00B382FC

Part of subcall function 00B60C8F: OpenProcessToken.ADVAPI32(?,00000008,?,?,00000000,?,?,?,?,00B38308,00000000), ref: 00B60CAD
Part of subcall function 00B60C8F: GetLastError.KERNEL32(?,?,?,?,00B38308,00000000), ref: 00B60CB7
Part of subcall function 00B60C8F: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00B38308,00000000), ref: 00B60D41

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00B38322
GetLastError.KERNEL32 ref: 00B3832C
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00B383A9
GetLastError.KERNEL32 ref: 00B383B3
UuidCreate.RPCRT4(?), ref: 00B383F2

Strings

c:\agent\_work\138\s\src\burn\user\cache.cpp, xrefs: 00B38350, 00B383D7, 00B38428
%ls%ls\, xrefs: 00B38444
Failed to create working folder guid., xrefs: 00B383FF
Failed to get windows path for working folder., xrefs: 00B3835A
Failed to append bundle id on to temp path for working folder., xrefs: 00B3845C
4#v, xrefs: 00B383A9
Failed to convert working folder guid into string., xrefs: 00B38432
Temp\, xrefs: 00B38381
Failed to ensure windows path for working folder ended in backslash., xrefs: 00B38377
Failed to copy working folder path., xrefs: 00B38477
Failed to get temp path for working folder., xrefs: 00B383E1
Failed to concat Temp directory on windows path for working folder., xrefs: 00B38399

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\138\s\src\burn\user\cache.cpp
API String ID: 2898636500-1839125748
Opcode ID: 5769d54e3dd8df99d6e6be13e0047799b41a93de19dd86ea50bf0f11a612366b
Instruction ID: 7dcfefbe083fa5da0ad7098d9c560d402dbfea66fc0496f84d0b630e9d27a34d
Opcode Fuzzy Hash: 5769d54e3dd8df99d6e6be13e0047799b41a93de19dd86ea50bf0f11a612366b
Instruction Fuzzy Hash: 7A41F972A85325B7CB2096B49C4AF9B76E89B04B10F2181E1B918F7290EE789D4487D6

Uniqueness

Uniqueness Score: -1.00%

Function 00B43959 Relevance: 28.6, APIs: 1, Strings: 15, Instructions: 577COMMON

Download Yara Rule

Strings

Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 00B439F9
msasn1.dll, xrefs: 00B43AB2, 00B43BBC, 00B43E8A, 00B43FC5
UX aborted detect compatible MSI package., xrefs: 00B43BDF
c:\agent\_work\138\s\src\burn\user\msiuser.cpp, xrefs: 00B43AD1, 00B43BD5, 00B44006, 00B4401D
Failed to enum related products., xrefs: 00B43F97
Failed to query feature state., xrefs: 00B43FF4
Failed to get product information for ProductCode: %ls, xrefs: 00B43AFB
UX aborted detect related MSI package., xrefs: 00B43ADB
VersionString, xrefs: 00B439B4, 00B43B30, 00B43C8B, 00B43CC2
UX aborted detect., xrefs: 00B44027
Failed to copy the installed ProductCode to the package., xrefs: 00B43BFF
Invalid state value., xrefs: 00B44010
Failed to get version for product in user unmanaged context: %ls, xrefs: 00B43F6B
Language, xrefs: 00B43D97
Failed to get version for product in machine context: %ls, xrefs: 00B43F8D

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to copy the installed ProductCode to the package.$Failed to enum related products.$Failed to get product information for ProductCode: %ls$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$Failed to query feature state.$Invalid state value.$Language$UX aborted detect compatible MSI package.$UX aborted detect related MSI package.$UX aborted detect.$VersionString$c:\agent\_work\138\s\src\burn\user\msiuser.cpp$msasn1.dll
API String ID: 1659193697-1043868639
Opcode ID: 95176b4043d85bb42f11a1bf6735ab0872a65cc26f991c6a93f855995b607f8c
Instruction ID: 1292dc92e1c10ce0b0419ce7cd89bbeddc22273aaa993f5f8582eea1191a48e8
Opcode Fuzzy Hash: 95176b4043d85bb42f11a1bf6735ab0872a65cc26f991c6a93f855995b607f8c
Instruction Fuzzy Hash: CD227C31900214EFDF219FA4C885FAEBBF5FF44B00F1841A9E919AB256D7319B54EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B24361 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00B252DE,?,?,00000000,?,?), ref: 00B2438D
InitializeCriticalSection.KERNEL32(000000D0,?,?,00B252DE,?,?,00000000,?,?), ref: 00B24396
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00B252DE,?,?,00000000,?,?), ref: 00B243DC
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00B252DE,?,?,00000000,?,?), ref: 00B243E6
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00B252DE,?,?,00000000,?,?), ref: 00B243FA
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00B252DE,?,?,00000000,?,?), ref: 00B2440A
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00B252DE,?,?,00000000,?,?), ref: 00B2445A
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00B252DE,?,?,00000000,?,?), ref: 00B24464
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00B252DE,?,?,00000000,?,?), ref: 00B24478
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00B252DE,?,?,00000000,?,?), ref: 00B24488

Strings

Failed to parse file handle: '%ls', xrefs: 00B2450A
burn.filehandle.self, xrefs: 00B24455, 00B2445D, 00B24462, 00B24463, 00B24483, 00B24553
burn.filehandle.attached, xrefs: 00B243D7, 00B243DF, 00B243E4, 00B243E5, 00B24405, 00B24527
Missing required parameter for switch: %ls, xrefs: 00B2452C
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00B2451D, 00B24549
Failed to initialize user section., xrefs: 00B244F1

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\138\s\src\burn\user\user.cpp
API String ID: 3039292287-4238739692
Opcode ID: 0e172867a47ce919b308a322f1ad10333dd24356662ab80c1a40f499cd50d70c
Instruction ID: b03e41802419e9fe79839d527b905e81e6abb0538ba08a9a21d7c0288a254001
Opcode Fuzzy Hash: 0e172867a47ce919b308a322f1ad10333dd24356662ab80c1a40f499cd50d70c
Instruction Fuzzy Hash: BA51D871A40625BFC724AB68EC86F5A77F8EF11720F004195F619EB2E0DB74A950CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E720 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00B3E766
RegisterClassW.USER32(?), ref: 00B3E792
GetLastError.KERNEL32 ref: 00B3E79D
CreateWindowExW.USER32(00000080,00B7A23C,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00B3E804
GetLastError.KERNEL32 ref: 00B3E80E
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00B3E8AC

Strings

Failed to register window., xrefs: 00B3E7CB
Failed to create window., xrefs: 00B3E83C
WixBurnMessageWindow, xrefs: 00B3E78B, 00B3E8A7
Unexpected return value from message pump., xrefs: 00B3E897
c:\agent\_work\138\s\src\burn\user\uithread.cpp, xrefs: 00B3E7C1, 00B3E832

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\138\s\src\burn\user\uithread.cpp
API String ID: 213125376-2797729333
Opcode ID: 94a007922b878fc99d55d009901a2982c93a06dcc344a8e9df244ca4fd15f12e
Instruction ID: d5f8a3597ac3b8e8a7b1e44fcb9d2ac394675d57b9f6d6465634df73fe2e5629
Opcode Fuzzy Hash: 94a007922b878fc99d55d009901a2982c93a06dcc344a8e9df244ca4fd15f12e
Instruction Fuzzy Hash: 68419472E00215EBDB109B909C45ADEBFF4EF05750F2041A6F929FB2D0EB75E9408BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B634D0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00B63A7E,00000000,?,00000000), ref: 00B634EA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00B4BE27,?,00B2547D,?,00000000,?), ref: 00B634F6
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00B63536
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B63542
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00B6354D
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B63557
CoCreateInstance.OLE32(00B8C7A0,00000000,00000001,00B6B878,?,?,?,?,?,?,?,?,?,?,?,00B4BE27), ref: 00B63592
ExitProcess.KERNEL32 ref: 00B63641

Strings

Wow64DisableWow64FsRedirection, xrefs: 00B6353C
kernel32.dll, xrefs: 00B634DA
c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp, xrefs: 00B6351A
IsWow64Process, xrefs: 00B63530
Wow64EnableWow64FsRedirection, xrefs: 00B63544
Wow64RevertWow64FsRedirection, xrefs: 00B6354F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\138\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-566418578
Opcode ID: 5058f6898618ddae1a0059feb2f01de990fbf72b481bdc14d01af4087a27a48a
Instruction ID: 51ca51ea894c862eab5d9eb6eb8bf42a5cc554c4a98d461b817d9d2941609671
Opcode Fuzzy Hash: 5058f6898618ddae1a0059feb2f01de990fbf72b481bdc14d01af4087a27a48a
Instruction Fuzzy Hash: D641A336E01215ABDB209BA8C854F6E7BF4EF14B10F1145E9E902EB390DB79DE40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C343 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00B4AB8D,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,?,?,00B4AB8D), ref: 00B2C38A
GetLastError.KERNEL32(?,00B4AB8D), ref: 00B2C39B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00000000,?,?,00B4AB8D), ref: 00B2C3EA
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00B4AB8D), ref: 00B2C3F0
DuplicateHandle.KERNELBASE(00000000,?,00B4AB8D), ref: 00B2C3F3
GetLastError.KERNEL32(?,00B4AB8D), ref: 00B2C3FD
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00B4AB8D), ref: 00B2C44F
GetLastError.KERNEL32(?,00B4AB8D), ref: 00B2C459

Strings

Failed to open file: %ls, xrefs: 00B2C3CC
Failed to move file pointer to container offset., xrefs: 00B2C487
c:\agent\_work\138\s\src\burn\user\container.cpp, xrefs: 00B2C3BF, 00B2C421, 00B2C47D
Failed to duplicate handle to container: %ls, xrefs: 00B2C42E
Failed to open container., xrefs: 00B2C4A5

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\138\s\src\burn\user\container.cpp
API String ID: 2619879409-3603540918
Opcode ID: 920041052b2308f61551fed25c6d64b9cfa0af265c0f207a6fe2e720c1504419
Instruction ID: e08e23ef18ffe80bf1648f3abe85fc93cc8a6b1f5ad1d5e128009034ba724269
Opcode Fuzzy Hash: 920041052b2308f61551fed25c6d64b9cfa0af265c0f207a6fe2e720c1504419
Instruction Fuzzy Hash: DF419536140211A7CB219E59BC55E2B3FF5EBC4720B2180A9FD2CDB391DB75C841D760

Uniqueness

Uniqueness Score: -1.00%

Function 00B600C9 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00B600F1
GetProcAddress.KERNEL32(SystemFunction041), ref: 00B60103
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00B60146
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00B6015A
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00B60192
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00B601A6

Strings

c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp, xrefs: 00B6017B
AdvApi32.dll, xrefs: 00B600D0
SystemFunction041, xrefs: 00B600F3
SystemFunction040, xrefs: 00B600E6
CryptProtectMemory, xrefs: 00B6013B
Crypt32.dll, xrefs: 00B60127
CryptUnprotectMemory, xrefs: 00B60187

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\138\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-403682633
Opcode ID: 8e30c168deb14cfb0467e98d59e6052bd6992abf6f524e07eeef73216a1b2fe8
Instruction ID: 44a3359de756a12db94068b27cdf99003c32195d9fe169e279cb6a0a84c69509
Opcode Fuzzy Hash: 8e30c168deb14cfb0467e98d59e6052bd6992abf6f524e07eeef73216a1b2fe8
Instruction Fuzzy Hash: 0D2124B6A91721A7C7217B56BD09B176ED0EB11B94F0151B1FD00BB2B1FB798C40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B28091 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00B280AE
LeaveCriticalSection.KERNEL32(?), ref: 00B282D6

Strings

Failed to write included flag., xrefs: 00B282C4
Failed to get numeric., xrefs: 00B282A8
Failed to write variable value type., xrefs: 00B282B6
Failed to write variable value as number., xrefs: 00B28280
Failed to write variable value as string., xrefs: 00B2829A
Unsupported variable type., xrefs: 00B28293
Failed to get version., xrefs: 00B28287
Failed to get string., xrefs: 00B282A1
Failed to write literal flag., xrefs: 00B282AF
feclient.dll, xrefs: 00B28189, 00B281DF, 00B28220
Failed to write variable count., xrefs: 00B280C9
Failed to write variable name., xrefs: 00B282BD

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 21e0eb64d6f5f0510bd59ca38c353d686f9a726e5b09f887f5e2a866cf3d44fb
Instruction ID: 86b692c439e6f21395dfca618a3716b522741cd65c9219bc04277f3b4143835f
Opcode Fuzzy Hash: 21e0eb64d6f5f0510bd59ca38c353d686f9a726e5b09f887f5e2a866cf3d44fb
Instruction Fuzzy Hash: E9718232D02A2AEBCF129EA4E941BAEBBE5FF05351F1142E1E908B7150CB74DD149B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B415F7 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,0000001C,?,00000000,00000000,00000000,00000000,?,00B2C49F,00000000,00B4AB8D,?,00B4AB8D), ref: 00B4162E
GetLastError.KERNEL32(?,00B2C49F,00000000,00B4AB8D,?,00B4AB8D), ref: 00B41637

Strings

Failed to create operation complete event., xrefs: 00B416AB
Failed to create begin operation event., xrefs: 00B41665
Failed to wait for operation complete., xrefs: 00B4170A
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B4165B, 00B416A1, 00B416ED
Failed to create extraction thread., xrefs: 00B416F7
Failed to copy file name., xrefs: 00B41619

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 545576003-1614736502
Opcode ID: 4358a28d2a5bc8aceee213042e7a4fb2116165fb46524240a4ccf4fd44d9b3dd
Instruction ID: 2d4eb1fd1d817c767da1d74f68e7964795b4bd79061a47c65760624e01ac1759
Opcode Fuzzy Hash: 4358a28d2a5bc8aceee213042e7a4fb2116165fb46524240a4ccf4fd44d9b3dd
Instruction Fuzzy Hash: F221F9B3E4173677D23116685C45E2B6DECEF00BA0B0286A2FD18FB580EB64DD8056E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B40785 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00B407B5
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00B407CD
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00B407D2
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00B407D5
GetLastError.KERNEL32(?,?), ref: 00B407DF
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00B4084E
GetLastError.KERNEL32(?,?), ref: 00B4085B

Strings

Failed to add virtual file pointer for cab container., xrefs: 00B40834
<the>.cab, xrefs: 00B407AE
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B40803, 00B4087F
Failed to duplicate handle to cab container., xrefs: 00B4080D
Failed to open cabinet file: %hs, xrefs: 00B4088C

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 3030546534-4070612573
Opcode ID: 99be2fdae98ea3885a489a803068bea92e2790e7298324b940f08afce864e743
Instruction ID: 8f1c3f1b0a67c20e74dc8b899e297aba70464e7b65e1abde575ac674b0242d00
Opcode Fuzzy Hash: 99be2fdae98ea3885a489a803068bea92e2790e7298324b940f08afce864e743
Instruction Fuzzy Hash: B8310972961235BBDB216B559D09F9F7FE8EF04760F0181A1FA08BB190D7749E009AE0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3400F Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B33B19: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00B34029,feclient.dll,?,00000000,?,?,?,00B24B92), ref: 00B33BBA

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00B24B92,?,?,00B6B478,?,00000001,00000000,00000000), ref: 00B340C0

Strings

clbcatq.dll, xrefs: 00B341FF
log, xrefs: 00B34067
Failed to get non-session specific TEMP folder., xrefs: 00B3416E
Failed to open log: %ls, xrefs: 00B34138
Failed to copy log extension to extension., xrefs: 00B3420B
msasn1.dll, xrefs: 00B341DC, 00B3421D
crypt32.dll, xrefs: 00B34066, 00B340CB, 00B340D3, 00B34136, 00B34178, 00B341BB, 00B341DA, 00B34218, 00B34242
feclient.dll, xrefs: 00B34023, 00B340D0
Failed to copy full log path to prefix., xrefs: 00B34229
Failed to get current directory., xrefs: 00B340A2
Failed to copy log path to prefix., xrefs: 00B341E8
Setup, xrefs: 00B3406D

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 861b7296293f0ab67176d14338c298506690f1392740c9f88a125f09f17283a1
Instruction ID: 12ad6052361bdf1066ee1db1e6bf31e847a1f4afe41320f409690cfd23383794
Opcode Fuzzy Hash: 861b7296293f0ab67176d14338c298506690f1392740c9f88a125f09f17283a1
Instruction Fuzzy Hash: EF61E271A10616BADB269B64CC82B7B7BE8EF10700F2485E5F915EB250EB70FD908790

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E9E2 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00B25506,?,?), ref: 00B3EA02
GetLastError.KERNEL32(?,00B25506,?,?), ref: 00B3EA0F
CreateThread.KERNELBASE(00000000,00000000,Function_0001E720,?,00000000,00000000), ref: 00B3EA68
GetLastError.KERNEL32(?,00B25506,?,?), ref: 00B3EA75
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00B25506,?,?), ref: 00B3EAB0
CloseHandle.KERNEL32(00000000,?,00B25506,?,?), ref: 00B3EACF
FindCloseChangeNotification.KERNELBASE(?,?,00B25506,?,?), ref: 00B3EADC

Strings

Failed to create initialization event., xrefs: 00B3EA3A
c:\agent\_work\138\s\src\burn\user\uithread.cpp, xrefs: 00B3EA30, 00B3EA96
Failed to create the UI thread., xrefs: 00B3EAA0

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseCreateErrorLast$ChangeEventFindHandleMultipleNotificationObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\138\s\src\burn\user\uithread.cpp
API String ID: 1372344712-616715975
Opcode ID: 3550006911dea621fee2f9b150f6c2ec0166db0448ac290a909ccf8bb91339ad
Instruction ID: cd91ce416fe11c1d41445f41937732851d8cb503060b171ffbececf8f89af033
Opcode Fuzzy Hash: 3550006911dea621fee2f9b150f6c2ec0166db0448ac290a909ccf8bb91339ad
Instruction Fuzzy Hash: CF319E76D01229BBD7109B999C85A9EBAF8FF04750F2140A6F924F72D0E674DE008AA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B4139A Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,76232F60,?,00000000), ref: 00B413BE
GetLastError.KERNEL32 ref: 00B413D1
GetExitCodeThread.KERNELBASE(?,00000000), ref: 00B41413
GetLastError.KERNEL32 ref: 00B41421
ResetEvent.KERNEL32(?), ref: 00B4145C
GetLastError.KERNEL32 ref: 00B41466

Strings

Failed to get extraction thread exit code., xrefs: 00B41452
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B413F8, 00B41448, 00B4148D
Failed to wait for operation complete event., xrefs: 00B41402
Failed to reset operation complete event., xrefs: 00B41497

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2979751695-2767648441
Opcode ID: 895a58f2e087f099c33f7066ff6aeff3e74d458af1847620db2325b4fcf5e558
Instruction ID: f41462e9c124b2ffbb8d8c26fc39b6bda9b3879eae27eb35b0f8992fee759f88
Opcode Fuzzy Hash: 895a58f2e087f099c33f7066ff6aeff3e74d458af1847620db2325b4fcf5e558
Instruction Fuzzy Hash: 3431A271A40315EBD7109F699D05BAE7BF4EB00711F1084A9F409EA2A0EB75DB80AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B339 Relevance: 16.3, APIs: 2, Strings: 7, Instructions: 552COMMON

Download Yara Rule

Strings

end cache package, xrefs: 00B4B743
layout bundle, xrefs: 00B4B48F
(, xrefs: 00B4B798
UX aborted cache., xrefs: 00B4B392
Failed to set syncpoint event., xrefs: 00B4B8CE
c:\agent\_work\138\s\src\burn\user\apply.cpp, xrefs: 00B4B388, 00B4B8C4
begin cache package, xrefs: 00B4B4F0

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID:
String ID: ($Failed to set syncpoint event.$UX aborted cache.$begin cache package$c:\agent\_work\138\s\src\burn\user\apply.cpp$end cache package$layout bundle
API String ID: 0-1622896092
Opcode ID: 13f48326e9b227d8f25a37b25503abd2bae9c22031d50e62154bcb109fb76f61
Instruction ID: e9a8ec0da72c3abf4cc9a3ea3c2ddc8f0fe12cd3aac4dc94120d4dc1846b7734
Opcode Fuzzy Hash: 13f48326e9b227d8f25a37b25503abd2bae9c22031d50e62154bcb109fb76f61
Instruction Fuzzy Hash: D122FA71901616EFCF15CF94C980EAEBBB5FF48710F218195FA14AB261D331EA61EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2481A Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00B2483F
GetCurrentThreadId.KERNEL32 ref: 00B24845
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B248D3

Strings

Failed to create user for UX., xrefs: 00B2485F
Failed to load UX., xrefs: 00B24888
Failed to start bootstrapper application., xrefs: 00B248A1
Unexpected return value from message pump., xrefs: 00B24929
wininet.dll, xrefs: 00B24872
c:\agent\_work\138\s\src\burn\user\user.cpp, xrefs: 00B2491F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\138\s\src\burn\user\user.cpp$wininet.dll
API String ID: 673430819-242469113
Opcode ID: 93aa606e8ecbd2445b6f636515afa848157a9cbb7f759396525daeec6bf825ae
Instruction ID: 50e0fef7f090882cf362732ca95655a2ba8e974bd7b986a47e29a31e4c922e05
Opcode Fuzzy Hash: 93aa606e8ecbd2445b6f636515afa848157a9cbb7f759396525daeec6bf825ae
Instruction Fuzzy Hash: E941F172A00225BFEB159BA4EC85EBFB7ECEF05714F1041A5F509EB690DB34AD4487A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B35143 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,00B6B4F0), ref: 00B3514C
GetProcessId.KERNELBASE(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00B351EA
CloseHandle.KERNEL32(00000000), ref: 00B35203

Strings

runas, xrefs: 00B351AA
-q -%ls %ls %ls %u, xrefs: 00B35171
Failed to launch elevated child process: %ls, xrefs: 00B351D7
open, xrefs: 00B351B4, 00B351C2
burn.elevated, xrefs: 00B3516C
Failed to allocate parameters for elevated process., xrefs: 00B35185

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 5b198b33477f3b52d08b89bc0f60b65d4c31c710fa23efd893190d9c910eff36
Instruction ID: fe900e299193023ea3e99b6c957d84bcd0f6db60e5a44018e58dc7e722d29ae6
Opcode Fuzzy Hash: 5b198b33477f3b52d08b89bc0f60b65d4c31c710fa23efd893190d9c910eff36
Instruction Fuzzy Hash: 39218B76D00619FFCF15AF94DC819AEBBF8EF05341F2080AAF529B2210CB359E509B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D764 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000008,00000000,?,00B24882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00B25506,?), ref: 00B2D775
GetLastError.KERNEL32(?,00B24882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00B25506,?,?), ref: 00B2D782
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00B2D7BA
GetLastError.KERNEL32(?,00B24882,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00B25506,?,?), ref: 00B2D7C6

Strings

Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00B2D7F1
Failed to create UX., xrefs: 00B2D80A
c:\agent\_work\138\s\src\burn\user\userexperience.cpp, xrefs: 00B2D7A3, 00B2D7E7
BootstrapperApplicationCreate, xrefs: 00B2D7B4
Failed to load UX DLL., xrefs: 00B2D7AD

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\138\s\src\burn\user\userexperience.cpp
API String ID: 1866314245-3647149291
Opcode ID: ef598f9329e63d44cfea62bf05fc88870054446a35744bdf8c9ebb69df58b523
Instruction ID: e13189d67c0cf195d943a6b42429051de1a9dda473eb638236f934be1fb0455f
Opcode Fuzzy Hash: ef598f9329e63d44cfea62bf05fc88870054446a35744bdf8c9ebb69df58b523
Instruction Fuzzy Hash: 8911C437A50732A7DB2166947C09F5B3AD4AF04B61F0181E6FE2CFF2A0EA68DC0046D0

Uniqueness

Uniqueness Score: -1.00%

Function 00B349A6 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00000008,?,00000000,?,00000000,00000000,?,00000000,?,?,00000000,00000001,00000000), ref: 00B349D1
GetLastError.KERNEL32 ref: 00B349DE
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,?,00000000), ref: 00B34A89
GetLastError.KERNEL32 ref: 00B34A93

Strings

Failed to read message from pipe., xrefs: 00B34A5E
Failed to read data for message., xrefs: 00B34AC1
c:\agent\_work\138\s\src\burn\user\pipe.cpp, xrefs: 00B34A3D, 00B34A54, 00B34AB7
Failed to allocate data for message., xrefs: 00B34A47

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\138\s\src\burn\user\pipe.cpp
API String ID: 1948546556-2975516947
Opcode ID: 167030dc9fba7abbe62fd3cd275d7c54be49a53a454823f4f7ee34938bbdfe87
Instruction ID: bffd0efb7a7e667d411773db9fef0ba4d7bf52c59ca783e1e590a7969f4fcdf0
Opcode Fuzzy Hash: 167030dc9fba7abbe62fd3cd275d7c54be49a53a454823f4f7ee34938bbdfe87
Instruction Fuzzy Hash: FC31B832D80329BBD7209AA5DC45B5EB6E8EF00751F21C1A5F855F6290D774AE4087D8

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F8A1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00B2F9D1
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00B2F9DE

Strings

Failed to read Resume value., xrefs: 00B2F967
Resume, xrefs: 00B2F945
Failed to open registration key., xrefs: 00B2F93A
Failed to format pending restart registry key to read., xrefs: 00B2F8D5
%ls.RebootRequired, xrefs: 00B2F8BE

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: eb380a48cae61459fc02be2715d5644043689347a3116a337db47fded062955c
Instruction ID: 2a05ce4356a811f50a66d4a761425d2150fc989b513a336ed7b6fbf736c16db0
Opcode Fuzzy Hash: eb380a48cae61459fc02be2715d5644043689347a3116a337db47fded062955c
Instruction Fuzzy Hash: 41410C3190412AFFDB119F98E881BBDBBF4EB04314F1585B6E919AB260C375DE81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B3699E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00B36ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00B369AB
GetLastError.KERNEL32(?,00B36ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00B369B5
GetExitCodeThread.KERNELBASE(00000001,00000000,?,00B36ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00B369F4
GetLastError.KERNEL32(?,00B36ED9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00B369FE

Strings

c:\agent\_work\138\s\src\burn\user\core.cpp, xrefs: 00B369DC, 00B36A25
Failed to get cache thread exit code., xrefs: 00B36A2F
Failed to wait for cache thread to terminate., xrefs: 00B369E6

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\138\s\src\burn\user\core.cpp
API String ID: 3686190907-1666294930
Opcode ID: e0facdfce61d96c7c74fdfa9516baaf049da5bee5be7a54285eff661ec56ac0e
Instruction ID: e4aec8f3900510b28772236ed4dac6da76c0d7e961dd9a9a08bdf0ecfa151cb4
Opcode Fuzzy Hash: e0facdfce61d96c7c74fdfa9516baaf049da5bee5be7a54285eff661ec56ac0e
Instruction Fuzzy Hash: 8011217064031AFBEB009F659D06B6E7BE4EF00754F20C1A5F519EA1A0EB79DE409B64

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D3C1 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,00B6B4F0,?,00000001,000000FF,?,?,00000000,00000000,00000001,00000000,?,00B374BE), ref: 00B3D4F7

Strings

UX aborted elevation requirement., xrefs: 00B3D3FF
Failed to create pipe and cache pipe., xrefs: 00B3D447
Failed to elevate., xrefs: 00B3D4D9
c:\agent\_work\138\s\src\burn\user\elevation.cpp, xrefs: 00B3D3F5
Failed to connect to elevated child process., xrefs: 00B3D4E0
Failed to create pipe name and client token., xrefs: 00B3D42B

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\138\s\src\burn\user\elevation.cpp
API String ID: 2962429428-1175272905
Opcode ID: 13de4f35d6555b55432e1e20738747576432f1ae4244d5b4e624dc2dbbc86fc2
Instruction ID: c7cd57e285b69262fb2a75d78a2d75e13ba4c024805ef00ff2abc83be4d321f2
Opcode Fuzzy Hash: 13de4f35d6555b55432e1e20738747576432f1ae4244d5b4e624dc2dbbc86fc2
Instruction Fuzzy Hash: 1A312A72A84621BAEB256664BC46FAA76DCDB00730F3081D5F918AA2D1DB75BD004294

Uniqueness

Uniqueness Score: -1.00%

Function 00B6093D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B8C6EC,00000000,?,?,?,00B3427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00B25572,?), ref: 00B6094D
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00B8C6E4,?,00B3427F,00000000,Setup), ref: 00B609F1
GetLastError.KERNEL32(?,00B3427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00B25572,?,?,?), ref: 00B60A01
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00B3427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00B25572,?), ref: 00B60A3B

Part of subcall function 00B22EE7: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00B23031

LeaveCriticalSection.KERNEL32(00B8C6EC,?,?,00B8C6E4,?,00B3427F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00B25572,?), ref: 00B60A94

Strings

c:\agent\_work\138\s\src\libs\dutil\logutil.cpp, xrefs: 00B60A20

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: c:\agent\_work\138\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-1566132964
Opcode ID: 4be923592b46ab97f2b41924faca90d30911826f35ef3b7b524fd4dbdd221736
Instruction ID: 3c0c56e46bce0f926d28f93682ba95b25b5d1e9ec06fa98d1a5a510d0e32a41f
Opcode Fuzzy Hash: 4be923592b46ab97f2b41924faca90d30911826f35ef3b7b524fd4dbdd221736
Instruction Fuzzy Hash: D0317F7195032AEBDB11BFE5AC46E6B3AE9EB00794B1441A6F900E71B0DB78CD40D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B273DE Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00B259A1,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00B273F0
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00B259A1,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00B274CF

Strings

Failed to format value '%ls' of variable: %ls, xrefs: 00B27499
Failed to get unformatted string., xrefs: 00B27460
Failed to get variable: %ls, xrefs: 00B27431
Failed to get value as string for variable: %ls, xrefs: 00B274BE
*****, xrefs: 00B2748B, 00B27498

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 5bc4e07add44311ce6870e2394f3cbbfb31e6ad4458be69991112444f2e1c556
Instruction ID: a71545a37182a9bda61e0219168af64a753a130aed643c13657d08698c973bd4
Opcode Fuzzy Hash: 5bc4e07add44311ce6870e2394f3cbbfb31e6ad4458be69991112444f2e1c556
Instruction Fuzzy Hash: 2231E432895536FBCF117B51EC09B9E7FE4EF10320F108295F81C662A0DB79AA509BC8

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E8BB Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00B3E8EA
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00B3E8F9
SetWindowLongW.USER32(?,000000EB,?), ref: 00B3E90D
DefWindowProcW.USER32(?,?,?,?), ref: 00B3E91D
GetWindowLongW.USER32(?,000000EB), ref: 00B3E937
PostQuitMessage.USER32(00000000), ref: 00B3E996

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 404ed5e04a9b36d628085bb671ac68cf777835580dbaf73da9620aaff683af76
Instruction ID: 25f6917a4b4c26696ad8d8a7c0adb58affebabb46ce1bde98ea88a57adcac815
Opcode Fuzzy Hash: 404ed5e04a9b36d628085bb671ac68cf777835580dbaf73da9620aaff683af76
Instruction Fuzzy Hash: 7221AE36200209BFDF115F68DC49E6A3BA9EF05320F244255F91A9A2E1CB31DD50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B616C7 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00B616EF
RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00B370CF,00000100,000000B0,00000088,00000410,000002C0), ref: 00B61726
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00B61818

Strings

BundleUpgradeCode, xrefs: 00B616CE
c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00B61769

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-4149154654
Opcode ID: 8fa35f86a194d1b54591c08ebe9f937580313ed13ada030f403fb1bf1522a9d9
Instruction ID: e4bff86d9013d39d6eddf5de79d8fa94bf3031cb312d68ffce23e81c6aee5a76
Opcode Fuzzy Hash: 8fa35f86a194d1b54591c08ebe9f937580313ed13ada030f403fb1bf1522a9d9
Instruction Fuzzy Hash: 9841A275E0021AABCF25CF99D884ABE77F9EF04710F1985A9FC05AB210D6389D01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B6478A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6488B: FindFirstFileW.KERNELBASE(?,?,?,00000000,?), ref: 00B648C6
Part of subcall function 00B6488B: FindClose.KERNEL32(00000000), ref: 00B648D2

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00B6487D

Part of subcall function 00B61436: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

Part of subcall function 00B616C7: RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00B616EF
Part of subcall function 00B616C7: RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00B370CF,00000100,000000B0,00000088,00000410,000002C0), ref: 00B61726

Strings

PendingFileRenameOperations, xrefs: 00B647E8
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00B647BC
crypt32.dll, xrefs: 00B647B5
\, xrefs: 00B64806

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: eb38d73f42abcbe6c1cc33b753e29f016ba10d1f60b7ade307a75c759c7be605
Instruction ID: 3ada421417b86a7d2e0c8dcdb287e59148d07f22fb634329479f4ee94b131aec
Opcode Fuzzy Hash: eb38d73f42abcbe6c1cc33b753e29f016ba10d1f60b7ade307a75c759c7be605
Instruction Fuzzy Hash: E2319F31900659FBDF21AF95CC419AEB7F5EF80B50F5480FAE514A7151E7399E40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B2419A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000003,00000001,00000001,00000000,?,00B646DF,00000001,00000000,?,00B6477B,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00B241A8
GetLastError.KERNEL32(?,00B646DF,00000001,00000000,?,00B6477B,00000003,00000001,00000001,00000000,00000000,00000000,?,00B3A74F,?,00000000), ref: 00B241B6
CreateDirectoryW.KERNEL32(00000003,00000001,00000000,?,00B646DF,00000001,00000000,?,00B6477B,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00B24226
GetLastError.KERNEL32(?,00B646DF,00000001,00000000,?,00B6477B,00000003,00000001,00000001,00000000,00000000,00000000,?,00B3A74F,?,00000000), ref: 00B24230

Strings

c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp, xrefs: 00B24260

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\138\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-215211224
Opcode ID: 49516e3db04f0e2449a02e95cade63df19a8a1be6c3cebec38b3891dcb11e7e1
Instruction ID: 863fb5f85bd4cfe08f2b1cbe269ee971d62a40c57603542954916bdd6b0cffb1
Opcode Fuzzy Hash: 49516e3db04f0e2449a02e95cade63df19a8a1be6c3cebec38b3891dcb11e7e1
Instruction Fuzzy Hash: A7212B36654331E7DB311BA6AC44B3BBAE4EFA9BA1F1141A1FD0CFB940D7648C8192D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B640E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00B64134
GetLastError.KERNEL32 ref: 00B6413E
CloseHandle.KERNEL32(?), ref: 00B64171

Strings

<, xrefs: 00B64126
c:\agent\_work\138\s\src\libs\dutil\shelutil.cpp, xrefs: 00B6415F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$c:\agent\_work\138\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-455212561
Opcode ID: 32e24067731593f07406614b429deb818ebfe05236615da9a6f039e1cba0612e
Instruction ID: edbb6f0843fba548127c0b8c4f1ba978bc3d9fe5406b23cf993b71614f44abd2
Opcode Fuzzy Hash: 32e24067731593f07406614b429deb818ebfe05236615da9a6f039e1cba0612e
Instruction Fuzzy Hash: 0F21A3B5E11229EBCB10CFA9D944ADEBFF8AB19B50F10405AE915F7340E7749A40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B639DA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B639E9
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00B8C7A0,00000001,00000000,00B2536B,?,?,?,?,?,?), ref: 00B63A21
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00B8C7A0,?,?,?,?,?,?), ref: 00B63A2D

Strings

Msxml2.DOMDocument, xrefs: 00B63A1C
MSXML.DOMDocument, xrefs: 00B63A28

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: FromProg$Initialize
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 4047641309-2356320334
Opcode ID: 4a1102b33d12592902daaa661e79222d7f43bfb5a07e60c17c9f1995f31d2858
Instruction ID: 7ef61a9b58cd64659ba4b75d39c76d9bf2c27c39099327634a8a3a146ccd98fe
Opcode Fuzzy Hash: 4a1102b33d12592902daaa661e79222d7f43bfb5a07e60c17c9f1995f31d2858
Instruction Fuzzy Hash: 3EF0A031B482715BE71057A5BC44B1A2EE4DB41F64B1000A6E982D31B0D7A8DD82CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00B6131B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00B48C68), ref: 00B61376
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00B48C68,00000000), ref: 00B61394
RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00B48C68,00000000,00000000,00000000), ref: 00B613EA

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00B613BA

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3069916640
Opcode ID: d0307f43b14b7f3e4d1d85eefeb9680ce84ba8881023de1d4ad26a2a5063820b
Instruction ID: fdd230345a40451de280125cc847cee9e909e4fb381033376ad57d1c06a670ff
Opcode Fuzzy Hash: d0307f43b14b7f3e4d1d85eefeb9680ce84ba8881023de1d4ad26a2a5063820b
Instruction Fuzzy Hash: 453196B6901125FBEB218B989C81DAFBAECEF04750F1544A5FD01AB310D7358E009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B48968 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B61436: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

RegCloseKey.KERNELBASE(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00B48CA4,00000000,00000000), ref: 00B48A25

Strings

Failed to ensure there is space for related bundles., xrefs: 00B489D8
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00B48994
Failed to initialize package from related bundle id: %ls, xrefs: 00B48A0B

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: c7668a6ec4171044756ab067d0e5ee3669436e854cdf7855c1d8b9dc47dfc112
Instruction ID: d0cfe882b2fb782f35245d6acc14e6bb06de805edff35bc9d84ef2cdc1ebf5cf
Opcode Fuzzy Hash: c7668a6ec4171044756ab067d0e5ee3669436e854cdf7855c1d8b9dc47dfc112
Instruction Fuzzy Hash: B1217F32900619FBDF129A40DC06BBEBBB8EF04714F108096F910A6150DBB59F20FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B6023C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00B6090E,00000000,00000000,?,00000001,00000001), ref: 00B6025B
GetLastError.KERNEL32(?,00B6090E,00000000,00000000,?,00000001,00000001,?,00B2568C,00000000,?,00000000,00000000,?,00B38CE0,00000002), ref: 00B60267
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00B6090E,00000000,00000000,?,00000001,00000001,?,00B2568C,00000000,?), ref: 00B602D0

Strings

c:\agent\_work\138\s\src\libs\dutil\logutil.cpp, xrefs: 00B60286

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\138\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-1566132964
Opcode ID: 60b4a0c305ecf63201a069ac7d97062d7268b0bdf7253aa6ffbb6cacf5e2992f
Instruction ID: 552a0c2aabaac9365901c7ab34518988794d564fc3ba397b146beabbe6173407
Opcode Fuzzy Hash: 60b4a0c305ecf63201a069ac7d97062d7268b0bdf7253aa6ffbb6cacf5e2992f
Instruction Fuzzy Hash: BE11C432600225EBDF21AF92CC19EEF7BB8EF54710F014099FD04AA1A0D7748E50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B408AB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B412C5: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00B408DA,?,?,?), ref: 00B412ED
Part of subcall function 00B412C5: GetLastError.KERNEL32(?,00B408DA,?,?,?), ref: 00B412F7

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00B408E8
GetLastError.KERNEL32 ref: 00B408F2

Strings

c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B40916
Failed to read during cabinet extraction., xrefs: 00B40920

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2170121939-2593745101
Opcode ID: bfdf7bd18baa528211a7df0119acb563bd92e57bc28be56bc35ef56d89e828a2
Instruction ID: 2bb001513e08eec3f1ec68ec9dd1d052d6e9bcd2a8c70864114ebd56b71c0ce2
Opcode Fuzzy Hash: bfdf7bd18baa528211a7df0119acb563bd92e57bc28be56bc35ef56d89e828a2
Instruction Fuzzy Hash: 0001E532A1022ABBDB219F95DC04E8A7BE8EF44760B014195FE18E7290D730DA00DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00B412C5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00B408DA,?,?,?), ref: 00B412ED
GetLastError.KERNEL32(?,00B408DA,?,?,?), ref: 00B412F7

Strings

Failed to move to virtual file pointer., xrefs: 00B41325
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B4131B

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 2976181284-2495663704
Opcode ID: 4912767a15356166e9c736b8bebc6324f68cb18e96e250e210bf952b2d403e0c
Instruction ID: a3b331a96de07fcda8b104ee242a19645fb3efe45b80b4e84f497f4cbc9b2ff8
Opcode Fuzzy Hash: 4912767a15356166e9c736b8bebc6324f68cb18e96e250e210bf952b2d403e0c
Instruction Fuzzy Hash: B201F733A0123AB7C7211E9A9C04D8BBFA4EF40770701C565FD2C9B550DB25DD6096D8

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D975 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00B2D99C
FreeLibrary.KERNELBASE(?,?,00B2495B,00000000,?,?,00B25506,?,?), ref: 00B2D9AB
GetLastError.KERNEL32(?,00B2495B,00000000,?,?,00B25506,?,?), ref: 00B2D9B5

Strings

BootstrapperApplicationDestroy, xrefs: 00B2D994

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 15c9846e21803de4f52894a03539bb0cefd9520558b95b7f62115e73722b0a54
Instruction ID: 14a723b6d144ceaf421211dd17447a1fcbffd851a01ad0d230767d1f0299a9c5
Opcode Fuzzy Hash: 15c9846e21803de4f52894a03539bb0cefd9520558b95b7f62115e73722b0a54
Instruction Fuzzy Hash: 52F04F32610626ABC3245B65E804F26FBA8FF04B627018269F81DD7560C765EC90CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F231 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00B3F246
GetLastError.KERNEL32 ref: 00B3F250

Strings

c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00B3F274
Failed to post plan message., xrefs: 00B3F27E

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-3584526468
Opcode ID: 3ffbd5543b0eac0c55e85c92f7b2a98f271599d5a02e4ae56a701314987314f3
Instruction ID: 2c96adb87130d6e53fa01aba8e6eab78a9236b46e5c777b92b172be47aaae028
Opcode Fuzzy Hash: 3ffbd5543b0eac0c55e85c92f7b2a98f271599d5a02e4ae56a701314987314f3
Instruction Fuzzy Hash: 2AF08237A55331A786212AD56C0AD5BBED4AF04F60F1280A5FD18AB291DA55980082D5

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F33F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00B3F354
GetLastError.KERNEL32 ref: 00B3F35E

Strings

Failed to post shutdown message., xrefs: 00B3F38C
c:\agent\_work\138\s\src\burn\user\userforapplication.cpp, xrefs: 00B3F382

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\138\s\src\burn\user\userforapplication.cpp
API String ID: 2609174426-83663741
Opcode ID: a072a3b6060f449147d049a7112523a58c451813a5aa6d575099c14360fe4c20
Instruction ID: db62ca14ddc7fdfd16deb30a1dcf4bfe9bacacf511759d3f84afc0dd8cc543d8
Opcode Fuzzy Hash: a072a3b6060f449147d049a7112523a58c451813a5aa6d575099c14360fe4c20
Instruction Fuzzy Hash: 49F0A737A45335A787212A956C09E5B7ED8EF00BA0F1280A5FD1CFB1A1EA559C0046D9

Uniqueness

Uniqueness Score: -1.00%

Function 00B40678 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,00B415CD,00000000,00000000,?,00B2C33B,00000000,?,?,00B4ABF3,?,00000000,?,?), ref: 00B40682
GetLastError.KERNEL32(?,00B415CD,00000000,00000000,?,00B2C33B,00000000,?,?,00B4ABF3,?,00000000,?,?,?,00000000), ref: 00B4068C

Strings

Failed to set begin operation event., xrefs: 00B406BA
c:\agent\_work\138\s\src\burn\user\cabextract.cpp, xrefs: 00B406B0

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\138\s\src\burn\user\cabextract.cpp
API String ID: 3848097054-2744104430
Opcode ID: 7506187c60a4b598cdee0c917a9208366b102662a92659d1293cc1273f7cfc2f
Instruction ID: 5ed6b41d06a201ec9aee3db55ad1aa7b3fb038e63ca19570fd9905dce0710cbb
Opcode Fuzzy Hash: 7506187c60a4b598cdee0c917a9208366b102662a92659d1293cc1273f7cfc2f
Instruction Fuzzy Hash: E4F05C339216316743203A946C0AA8F7AD8CF80B6070280E1FE09FB180EB799D1026E4

Uniqueness

Uniqueness Score: -1.00%

Function 00B64322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00B643B8
GetLastError.KERNEL32 ref: 00B6441B

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00B6443F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-3168567549
Opcode ID: 992d69b5a2d31cf2631709897763907376b5da96ea462092b3d6724cd5fd5c5a
Instruction ID: 893f6c8a2cc97d41709d3de67f7121bdcb0933b6b2120013704937d3752926ca
Opcode Fuzzy Hash: 992d69b5a2d31cf2631709897763907376b5da96ea462092b3d6724cd5fd5c5a
Instruction Fuzzy Hash: AB318E31A006699BDB21CF59D881BEA77F4FB04751F0040E6E949EB340DFB89EC49B94

Uniqueness

Uniqueness Score: -1.00%

Function 00B3582C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00B35849
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00B358A2

Strings

Failed to initialize COM on cache thread., xrefs: 00B3585E

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: e8b1d9f03d3b2cb5879ecfca0978c8e2b6d71847fa583cb2d4e07f0ac260ffbb
Instruction ID: a3a95052794166e40243161ee9c9db8641b4f6d5ac67b1cd75bbb3d42e29124a
Opcode Fuzzy Hash: e8b1d9f03d3b2cb5879ecfca0978c8e2b6d71847fa583cb2d4e07f0ac260ffbb
Instruction Fuzzy Hash: 9A016D72600619BFCB059F95D884DDABBECFF18354B1081A6F60997221DB71AD508B94

Uniqueness

Uniqueness Score: -1.00%

Function 00B2519B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00B21104,?,?,00000000), ref: 00B251BA
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00B21104,?,?,00000000), ref: 00B251EA

Strings

burn.clean.room, xrefs: 00B251A7, 00B251B4, 00B251E1

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: ce4389bfd84d259dd292256ad7411055fe957266d464b49b0862e086af2f349e
Instruction ID: c0bad037525501064a24f5c4e0bbc7dcea67490d7d1118d8d7072c50107ee504
Opcode Fuzzy Hash: ce4389bfd84d259dd292256ad7411055fe957266d464b49b0862e086af2f349e
Instruction Fuzzy Hash: 9301D1B2500636AA83304B69FC89D73BBFCEB297A17100116E908D3264CB70DC81C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B65269 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00B643DF,?,?,?), ref: 00B6528D
GetLastError.KERNEL32(?,?,00B643DF,?,?,?), ref: 00B65297

Strings

c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp, xrefs: 00B652C0

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\138\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-3168567549
Opcode ID: e73304413e2d7cdc2d6607eaf54dd484c8835ad0d45af5303726d766d50f9330
Instruction ID: 5903f52dff84aacb5600ce1e1ce05b205d90a933c4c08b3b5fdd8f5ba6e82754
Opcode Fuzzy Hash: e73304413e2d7cdc2d6607eaf54dd484c8835ad0d45af5303726d766d50f9330
Instruction Fuzzy Hash: 99F08133601639BBC7219E99CC45E9FBBADFB44B61F014195F904E7140D774ED1086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B234EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00000000,00000104,00000000,00000104,?,00000000,00000000,?,00B4AD90,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?), ref: 00B23510
GetLastError.KERNEL32(?,00B4AD90,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?,00000000,?,?,?,?,?,?,?), ref: 00B23527

Strings

c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp, xrefs: 00B2354B

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\138\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-537661423
Opcode ID: e01b88f11c006605f8e20e1f7adee6f55aa73f0685315f890e42c904f5b2e94e
Instruction ID: 3a35aa5c6c6da927433bb1792c84ba057b1609fff375310702cc1b07dac7e11e
Opcode Fuzzy Hash: e01b88f11c006605f8e20e1f7adee6f55aa73f0685315f890e42c904f5b2e94e
Instruction Fuzzy Hash: 5BF0C273900230A387315A59BC89E4BAAE89F51F60B1641A1FE0DEB250DA69DE0082E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2390C Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00B2394B
GetLastError.KERNEL32 ref: 00B23955
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00B239BE

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: ad1608f39b27cdfd49b5a850d2fa14b6e3a6d86bba39669c4f6fc24295533c19
Instruction ID: 9d896827d3752bb09c2d7e526b1a28cc909dbf1eb196d7f4fe5c37bf10143bd4
Opcode Fuzzy Hash: ad1608f39b27cdfd49b5a850d2fa14b6e3a6d86bba39669c4f6fc24295533c19
Instruction Fuzzy Hash: 1621DDB6D0133967CB209B64AC45F9B77FC9B05B10F1141E1BD59F7281D678DEC48A90

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E9A3 Relevance: 4.5, APIs: 3, Instructions: 19synchronizationwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00B3E9B0
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B3E9C6
WaitForSingleObject.KERNEL32(?,00003A98,?,00B24CBD,?,?,?,?,?,00B6B490,?,?,?,?,?,?), ref: 00B3E9D7

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: MessageObjectPostSingleWaitWindow
String ID:
API String ID: 1391784381-0
Opcode ID: a175142d205855ae86dc95b66ee34d730bf55b4f2b6396a0bc82c4956932ecea
Instruction ID: 25297bd7353431c533784de9a37f04cfcaaf1a1bdb0b09d9c2e1bd2188c39524
Opcode Fuzzy Hash: a175142d205855ae86dc95b66ee34d730bf55b4f2b6396a0bc82c4956932ecea
Instruction Fuzzy Hash: 31E0E632340314B7D7211B50DC19FDB7BADFB05751F080626F655E61E0CBF565509754

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F7E6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B61436: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00B37D4C,?,?,?), ref: 00B2F84A

Part of subcall function 00B614EA: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000078,00B6695F,00000000,?,?,?,00B65C4D,00000000,?,00B6695F,00000078), ref: 00B6150F

Strings

Installed, xrefs: 00B2F812

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: 561eb01288348d1a161a3f9f4ee35a544f4bdc3a50ff4627d62fbdd7dc21641a
Instruction ID: 368f81014d3e60efd1ee4a7151c19ed38ea5965e4cbf1ebeca856e0be806e7e7
Opcode Fuzzy Hash: 561eb01288348d1a161a3f9f4ee35a544f4bdc3a50ff4627d62fbdd7dc21641a
Instruction Fuzzy Hash: 1B018F32810229EFDB119B98C856BEDBBF8EF00711F1180B4E500AB160D7799E40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B61436 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

Strings

c:\agent\_work\138\s\src\libs\dutil\regutil.cpp, xrefs: 00B61487

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\138\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3069916640
Opcode ID: 5da1082be8a9b5ae4fbad2f1a7fe70b4ecb318dbfc2ab744951b6c960cb1557b
Instruction ID: 3dea883dfa430e9e6f6240f3bb28d68f8c8879803986d1ecf0c593b26c92b612
Opcode Fuzzy Hash: 5da1082be8a9b5ae4fbad2f1a7fe70b4ecb318dbfc2ab744951b6c960cb1557b
Instruction Fuzzy Hash: 90F0BB32740135678B31095D9C05A6B6ED9DB81BB0F194475BE49DF320DD29CC109BF0

Uniqueness

Uniqueness Score: -1.00%

Function 00B69523 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,000000B0,00000088,00000410,000002C0), ref: 00B69579

Part of subcall function 00B61436: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

Strings

%ls%ls\%ls\%ls, xrefs: 00B69546

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpen
String ID: %ls%ls\%ls\%ls
API String ID: 47109696-1267659288
Opcode ID: 8f5842a6eb2acb94b40fef6f079b22b1977d8ba869dc3e8d8649c43567aaee2b
Instruction ID: 30c5dc002f31a8a3f5df3e35df63c1a146e2623dbe3f9e7e88dada325bda4b27
Opcode Fuzzy Hash: 8f5842a6eb2acb94b40fef6f079b22b1977d8ba869dc3e8d8649c43567aaee2b
Instruction Fuzzy Hash: CF01F632800228FBDF12ABA0DD0AFDDBBB9EB04355F144094F505A6170D7795B60EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B499A0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B49A14

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 29d43241527f869f3d6bd86e04c13342d969392d49575bdf1c24fbd6b2f6f007
Instruction ID: 6f56dcec48d1a92330dc1c2313a6136d18269f18b58a18bb3c415816a24ac963
Opcode Fuzzy Hash: 29d43241527f869f3d6bd86e04c13342d969392d49575bdf1c24fbd6b2f6f007
Instruction Fuzzy Hash: D1314771600204AFDB24CF59C881D6BB7FAFB88750B1489ADFA86C7720C231ED41EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B69598 Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B69213: lstrlenW.KERNEL32(00000100,?,?,?,00B695B3,000002C0,00000100,00000100,00000100,?,?,?,00B47BE4,?,?,000001BC), ref: 00B69238

RegCloseKey.ADVAPI32(000002C0,000002C0,00000100,00000100,00000100,?,?,?,00B47BE4,?,?,000001BC,00000000,00000000,00000000,00000100), ref: 00B69650

Part of subcall function 00B61436: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000001,00B8BB7C,00000000,?,00B65BF9,80000002,00000000,00020019,?,SOFTWARE\Policies\,00000000,00000000), ref: 00B6144A

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: CloseOpenlstrlen
String ID:
API String ID: 514153755-0
Opcode ID: 2c0c484b11dc8595ecb0eb13afbacfa880a9401cc0cc3c96599fd7e7c4b77084
Instruction ID: 6b19eff89ce107d4cdbb91434e79823487bb210f0789fdd3ddf21a21fe3e981a
Opcode Fuzzy Hash: 2c0c484b11dc8595ecb0eb13afbacfa880a9401cc0cc3c96599fd7e7c4b77084
Instruction Fuzzy Hash: 92210C73C00229EB8F229FA8DD4189DBAFDEB44B54B1542A6FD41B7121E7364E50ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 00B235D3 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?,?,00000104,00000000,?,00B38BB5,0000001C,?,00000000,00000000,?), ref: 00B235F3

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: e37b10eb52d5464b8e975f3570516c90be8ef316eeb0250dc8aa5084517805d0
Instruction ID: 8fad8f6fe10294980e6a7742a3a57a68265effe1b07d688a6ac9ce56e19470eb
Opcode Fuzzy Hash: e37b10eb52d5464b8e975f3570516c90be8ef316eeb0250dc8aa5084517805d0
Instruction Fuzzy Hash: A7E012723091347BEB022B65BC01DAB7BDCEF157517108451FE48D7100D665DA5086B4

Uniqueness

Uniqueness Score: -1.00%

Function 00B24273 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,?,00B3A41F,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,?), ref: 00B2427C

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c52b422a4635147f27a7f45e6381bc5346ff59a327d1f7d69636b2993b158b67
Instruction ID: 62622180742276ac29b4561970b726541588e3feb4f7749a4d7de08e409c597a
Opcode Fuzzy Hash: c52b422a4635147f27a7f45e6381bc5346ff59a327d1f7d69636b2993b158b67
Instruction Fuzzy Hash: A9D02B31211138D75B184EBAA8048667F94DF437707604615FD18C75D0C3308C11C3C0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5F8A9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B5F890

Part of subcall function 00B69CCB: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00B69CD6
Part of subcall function 00B69CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B69D3E
Part of subcall function 00B69CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B69D4F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 659ad71f0fab64307a83e697cb30fc6cf5dfe6df4e1b51c15e52e790fb353557
Instruction ID: 699e4b901e6c6b1e95d8ac1493df3319c7583e0aaaf3aa4cf41e388c6c8538fb
Opcode Fuzzy Hash: 659ad71f0fab64307a83e697cb30fc6cf5dfe6df4e1b51c15e52e790fb353557
Instruction Fuzzy Hash: 31B01296268101ED324C71542D02D3701DCC0C4F2173089EEF400C0172DE600C458331

Uniqueness

Uniqueness Score: -1.00%

Function 00B5F899 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B5F890

Part of subcall function 00B69CCB: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00B69CD6
Part of subcall function 00B69CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B69D3E
Part of subcall function 00B69CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B69D4F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 9aa1ec40e044efa7898638b4cdd72b886a5348add83182f7de8d8b1c4cdba8e5
Instruction ID: f729706be5dfc768a9944d0f22f2689ab02c38141f184b1dbf69439c44c23095
Opcode Fuzzy Hash: 9aa1ec40e044efa7898638b4cdd72b886a5348add83182f7de8d8b1c4cdba8e5
Instruction Fuzzy Hash: F1B01296268002ED324C71541E02D3701DCC0C4F1133088EEF400C0171DE600C068231

Uniqueness

Uniqueness Score: -1.00%

Function 00B5F878 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B5F890

Part of subcall function 00B69CCB: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00B69CD6
Part of subcall function 00B69CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B69D3E
Part of subcall function 00B69CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B69D4F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 34fa9509a6bd6ee6cdb5e09a4ac5c4287635bc6e01ee9a1175ebd089622c285e
Instruction ID: c4f081c13800f9754aedef700c3c9d3d1e2444b1963fcc19f5c952e49a46b4f6
Opcode Fuzzy Hash: 34fa9509a6bd6ee6cdb5e09a4ac5c4287635bc6e01ee9a1175ebd089622c285e
Instruction Fuzzy Hash: 12B012962B8001FD320C31501D02C3701DCC0D0F12330C9FEF800C0071EE600C098131

Uniqueness

Uniqueness Score: -1.00%

Function 00B699E5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B699FD

Part of subcall function 00B69CCB: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00B69CD6
Part of subcall function 00B69CCB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B69D3E
Part of subcall function 00B69CCB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B69D4F

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 2d6fed285e7d25dfd111871742d65c98ccff850e96eb77572f44c4277f683998
Instruction ID: c7ed358b0b4d57162f45d0c6436712bea5d30318e15be9e7fd051a016de951dd
Opcode Fuzzy Hash: 2d6fed285e7d25dfd111871742d65c98ccff850e96eb77572f44c4277f683998
Instruction Fuzzy Hash: FFB012C3258105BD720832905DC6C3601DCC0C1F1037085DEF005C00B1FD648C419232

Uniqueness

Uniqueness Score: -1.00%

Function 00B214AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,00B222DC,00000000,?,00000000,00000000,?,00B38C0D,00000000,00000000,00000000,00000000), ref: 00B214DC

Part of subcall function 00B23C9A: GetProcessHeap.KERNEL32(00000000,000001C7,?,00B22300,000001C7,80004005,8007139F,?,?,00B60687,8007139F,?,00000000,00000000,8007139F), ref: 00B23CA2
Part of subcall function 00B23C9A: HeapSize.KERNEL32(00000000,?,00B22300,000001C7,80004005,8007139F,?,?,00B60687,8007139F,?,00000000,00000000,8007139F), ref: 00B23CA9

Memory Dump Source

Source File: 00000009.00000002.2709042019.0000000000B21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000009.00000002.2709017911.0000000000B20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709096535.0000000000B6B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709126998.0000000000B8B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2709150197.0000000000B8E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_dotnet60desktop.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 35374dc1aee77833c91089a0524c2d20724e92395f48d834a59ab5af5bdd1579
Instruction ID: ebab8b1695a2b383b7a5503a2bd6d31ae9ec48ef1719675b449645b568d9ae58
Opcode Fuzzy Hash: 35374dc1aee77833c91089a0524c2d20724e92395f48d834a59ab5af5bdd1579
Instruction Fuzzy Hash: D701B5321001347BCF116E59FC85FDB7BE9EF65760F118991FE2DAB191C67099009AA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2N Driver for External USB Readers.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6df02c.rbs

C:\Config.Msi\6df030.rbs

C:\Config.Msi\6df034.rbs

C:\Config.Msi\6df038.rbs

C:\Config.Msi\6df03b.rbs

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BgApiDriver.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\BouncyCastle.Crypto.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Fleck.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Hardcodet.NotifyIcon.Wpf.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Interop.ZKFPEngXControl.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\NLog.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Newtonsoft.Json.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Common.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Encryption.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\Nn.Rfid.Twn4.dll (copy)

C:\Program Files (x86)\2N TELEKOMUNIKACE\2N USB Driver\ServerSSL.pfx (copy)

Windows Analysis Report
2N Driver for External USB Readers.exe

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre