Edit tour

Windows Analysis Report
astx_setup.exe

Overview

General Information

Sample Name:	astx_setup.exe
Analysis ID:	755221
MD5:	7dd75b2c2e214c0347df3dc137161b19
SHA1:	072a03d9279d3ecbdb5a76c70a862a75fb50d95b
SHA256:	06f360d2a25c75619cb769f56ced75d3d92cd339cb3ec2e3aa9c642ba6f3158f
Infos:

Detection

GuLoader

Score:	34
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Compliance

Score:	51
Range:	0 - 100

Signatures

Yara detected AntiVM3

Yara detected GuLoader

Found driver which could be used to inject code into processes

May modify the system service descriptor table (often done to hook functions)

Writes many files with high entropy

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Abnormal high CPU Usage

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Tries to load missing DLLs

Uses cacls to modify the permissions of files

Drops PE files to the windows directory (C:\Windows)

Yara detected Keylogger Generic

Creates or modifies windows services

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to delete services

Creates a process in suspended mode (likely to inject code)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64_ra

astx_setup.exe (PID: 6348 cmdline: C:\Users\user\Desktop\astx_setup.exe MD5: 7DD75B2C2E214C0347DF3DC137161B19)

cmd.exe (PID: 6456 cmdline: C:\Windows\system32\cmd.exe /C "ECHO Y| cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)" MD5: 4943BA1A9B41D69643F69685E35B2943)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

cmd.exe (PID: 6512 cmdline: C:\Windows\system32\cmd.exe /S /D /c" ECHO Y" MD5: 4943BA1A9B41D69643F69685E35B2943)

cacls.exe (PID: 6524 cmdline: cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA) MD5: B304B0EF47E125F696425BD99096D3E3)

V3Medic.exe (PID: 6624 cmdline: "C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe" MD5: F4116873D9C057697783C2C128708617)

SysX64.exe (PID: 7156 cmdline: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe MD5: 9005E21833E657558F139A3D3945C97D)

conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

SysX64.exe (PID: 6204 cmdline: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe MD5: 9005E21833E657558F139A3D3945C97D)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2413738502.0000000000768000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: astx_setup.exe PID: 6348	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: V3Medic.exe PID: 6624	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus or Machine Learning detection for unpacked file

Source: 6.3.V3Medic.exe.5b54600.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.3.V3Medic.exe.5ab0000.5.unpack	Avira: Label: TR/Patched.Ren.Gen7
Source: 6.3.V3Medic.exe.6065a80.14.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1007F680 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

0_2_1007F680

Compliance

Uses 32bit PE files

Source: astx_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

Window detected: < BackI AgreeCancelAhnLab Installation System AhnLab Installation SystemLicense AgreementPlease review the license terms before installing AhnLab Safe Transaction.Press Page Down to see the rest of the agreement.AhnLab Software License AgreementIMPORTANT - READ CAREFULLY BEFORE USING AHNLAB SOFTWARE.This Software License Agreement (this Agreement) is a legal agreement by and between you and AhnLab Inc. (AhnLab) with regard to the use of the software as defined below (AhnLab Software). If you do not agree to be bound by this Agreement you shall not install copy or use AhnLab Software. 1. Definitions 1.1 AhnLab Software means the software that AhnLab develops or produces and holds the rights such as copyright ownership right etc. AhnLab Software may include computer software any media printed materials and online or electronic documents including but not limited to any and all executable files additional functions user manual help files and other files accompanying AhnLab Software. 1.2 Computer means information processors such as server computer user computer etc. that can transmit and receive information through connection with communication networks. 1.3 Appliance means products that AhnLab sells to customers as a separate form of products produced by installing AhnLab Software in hardware equipment. 1.4 Use refers to any and all acts of using AhnLab Software such as storing installing or executing AhnLab Software in the main or auxiliary memory of Computer CD-ROM or other storage devices or displaying AhnLab on the screen. 1.5 Supplier means a person such as its distributor or reseller who entered into a business partnership agreement with AhnLab with regard to the sales of AhnLab Software or has been officially authorized by AhnLab to sell AhnLab Software. 1.6 You or Customer refers to you as a group or an individual that has entered into an agreement with AhnLab or the Supplier for the license to use AhnLab Software (the Purchase Agreement). 1.7 Commercial Product refers to AhnLab Software that AhnLab or the Supplier sells with charges. 1.8 Free Product refers to AhnLab Software that AhnLab or the Supplier provides free of charges. 2. Software License2.1 Restricted License: Subject to your consent to the terms and conditions of this Agreement AhnLab grants the non-exclusive and non-transferrable license to use AhnLab Software during the term of the license (in case of Commercial Product the term set forth in Purchase Agreement and in case of Free Product the term during which AhnLab Software is available for free).2.2 Scope of License: If you are a purchaser of Commercial Product you may install and use as many copies of AhnLab Software as you have agreed to use under the license from AhnLab or the Supplier. If you (i) execute the process of configuration or installation of this Software in a physical and/or virtual environment or (ii) make all or part of the existing instance run on a separate memory through for ex

Creates license or readme file

Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_en_US.txt	Jump to behavior
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_ko_kr.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\license.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\license.txt	Jump to behavior

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

File opened: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr90.dll

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\table	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us\image	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us\table	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Quarantine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2\ASDTEMP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MeD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\Microsoft.VC90.CRT.manifest	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\license.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\drvinfo_astx.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\defcfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\ipcntry.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\nzcmncfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\nzdefcfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\product.dat.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\mupdate2.cfg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Product.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\V3Prtect.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca.der	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\astx.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipprt.rul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipsig.rul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\aos.sld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\aspinfo.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\extraopn_ply.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\netizen_ply_default.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\ply_ver.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\starter_ply.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ENU.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\msvcr90.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dafault.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dim.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dafault.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dim.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_f.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\checkboxes.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\custom_logo.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_hover.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_normal.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_firewall.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_log_viewer.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_error.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_info.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_warning.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_on.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_product_tray.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_quarantine.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_detect.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_setting.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_stx_info.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_alert.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_shel_check.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_listctrl_header.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_popup_titlebar.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_safe.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_warning.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_bg.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_bg.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo_about.bmp	Jump to behavior

PE / OLE file has a valid certificate

Source: astx_setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: astx_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: AhnRghNt.pdb source: V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\WinFWMgr\Trunk\Build\X64Release.vc90\WinFWMgr.pdb source: V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\PdCfg.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1795673899.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\Av.pdb source: V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2028561930.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\UpEx.pdb source: V3Medic.exe, 00000006.00000003.1838675962.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ATamptNt.pdb source: V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\CdmCtrl.pdb source: V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25def.pdb source: V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AHAWKENT.pdb source: V3Medic.exe, 00000006.00000003.2203334329.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonTDLH.pdb source: V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonTDnt.pdb source: V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl32.pdb source: V3Medic.exe, 00000006.00000003.1872389829.0000000006605000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1817604204.0000000006AC0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: AMonCDw7.pdb source: V3Medic.exe, 00000006.00000003.2206061085.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\build\X64Release.vc60\AhnCtlKD.pdb source: V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\HsbCtl.pdb source: V3Medic.exe, 00000006.00000003.1746313302.0000000003A5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\2.1\Trunk\Src\Common\aostrust\Trunk\Build\X64Release\aostrust32.pdb source: V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcm90.i386.pdb source: V3Medic.exe, 00000006.00000003.1941544747.0000000005E6A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\AhnTrust\3.0\trunk\Build\X64Release.vc90\atstrumt.pdb source: V3Medic.exe, 00000006.00000003.2376704009.0000000006BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\ScrMon32.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: certutil.pdb source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzPlugin.pdb source: V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Build\_building\Build\Engine\EngineNG\brahma\trunk\build\msvc6_win64\AMD64Release\bin\asc_main.pdb source: V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: HSBDrv64.pdb source: V3Medic.exe, 00000006.00000003.1994448685.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1965582045.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALWFCtrl.pdb source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Mkd2Nadr.pdb source: V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2002829645.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release64\mkd25.pdb source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\AupASD.pdb source: V3Medic.exe, 00000006.00000003.2098362304.00000000038A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk.pdb source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDUp.pdb source: V3Medic.exe, 00000006.00000003.2086586393.0000000003856000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mfc90u.amd64.pdb source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2238811654.0000000005DC2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Mkd3kfNt.pdb source: V3Medic.exe, 00000006.00000003.2005506483.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2006028938.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcr90.amd64.pdb source: V3Medic.exe, 00000006.00000003.2258731491.00000000062A1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1419152820.00000000005F2000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1993346827.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Project\KCMVP\ACM\1.0\D.0000000017\Build\libacm.dll\VC9.0\Win32Release\libacm.pdb source: V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AMonCDw7.pdbGCTL source: V3Medic.exe, 00000006.00000003.2206061085.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtInst.pdb source: V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp90.amd64.pdb source: V3Medic.exe, 00000006.00000003.2258731491.00000000062A1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\AhnTrust\3.0\trunk\Build\X64Release.vc90\atstrust.pdb source: V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: V3ElamDr.pdb source: V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2048046261.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2049620514.000000000062B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcm90.amd64.pdb source: V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25sdk.pdb source: V3Medic.exe, 00000006.00000003.1569077142.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1596806201.0000000005DEC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Build\Install\Common\Plugins\building\build\svn\AhnLab\Install\Common\Plugins\Trunk\Build\NT32Release\SysX64.pdb source: SysX64.exe, 0000000F.00000000.1385836130.000000000040F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDSvc.pdb source: V3Medic.exe, 00000006.00000003.2080153436.00000000038AA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcp90.i386.pdb source: V3Medic.exe, 00000006.00000003.1942456409.0000000005EA3000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDCr.pdb source: V3Medic.exe, 00000006.00000003.2072555587.000000000385F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\AHAWKE.pdb source: V3Medic.exe, 00000006.00000003.2109994779.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\ahnlab\system\common\public\monster_v4.0\trunk\src\amonlwlh\amd64\AMonLWLH.pdb source: V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzBrcom.pdb source: V3Medic.exe, 00000006.00000003.1778783611.0000000003A58000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: V3ElamCt.pdb source: V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\local_temp\win_amd64_unicode_msvs09\AHLOHA\Ahloha1.4.0.1_SRC\build\msvs09\x64\Release\ahloha.pdb source: V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzInst.pdb source: V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\CdmAPI.pdb source: V3Medic.exe, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSvr.pdb source: V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: V3Medic.exe, 00000006.00000003.1942456409.0000000005EA3000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1597415511.0000000005E41000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TSFltCtl.pdb source: V3Medic.exe, 00000006.00000003.2029624911.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TSFltDrv.pdb source: V3Medic.exe, 00000006.00000003.2048550396.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2048046261.00000000035F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Building\TSMime\TSMime_1.0\build\X64Release.vc90\tsmime.pdb source: V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\V3Cert.pdb source: V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonHKnt.pdb source: V3Medic.exe, 00000006.00000003.2209193882.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TfFRegNt.pdb source: V3Medic.exe, 00000006.00000003.2293256353.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2293596896.0000000000638000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25def.pdb 0 source: V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonCDw8.pdbGCTL source: V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Common\AhnI2\7.0\building\build\AhnLab\Common\AhnI2\7.0\Trunk\Build\NT32Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90u.i386.pdb source: V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: V3Medic.exe, 00000006.00000003.1597415511.0000000005E41000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\Core.pdb source: V3Medic.exe, 00000006.00000003.2174084552.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2227219595.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\TNNetUtil.pdb source: V3Medic.exe, 00000006.00000003.2200976148.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl32.pdb@ source: V3Medic.exe, 00000006.00000003.1872389829.0000000006605000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1817604204.0000000006AC0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Project\KCMVP\ACM\1.0\D.0000000017\Build\libacm.dll\VC9.0\x64Release\libacm.pdb source: V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\NT32Release32On64\HsbCtl32.pdb source: V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: AMonCDw8.pdb source: V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ATamptU.pdb source: V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDCli.pdb source: V3Medic.exe, 00000006.00000003.2066690791.0000000003855000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi32.pdb source: V3Medic.exe, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi.pdb source: V3Medic.exe, 00000006.00000003.1797309111.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\devel\Ark6\bin.sdk\Ark64lgplv2.pdb source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\build\system\product\mkd\korenc\building\build\ahnlab\system\product\mkd\korenc\trunk\src\klib_sys\amd64\klb64mkd.pdb source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\2.1\Trunk\Src\Common\aostrust\Trunk\Build\X64Release\aostrust32.pdb source: V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk.pdb source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDi.pdb source: V3Medic.exe, 00000006.00000003.2141353793.000000000385B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi32.pdb source: V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Ambass\ambass\projects\msvc9\x64\Release DLL MT\ambassmt.pdb source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Cdm2DrNt.pdb source: V3Medic.exe, 00000006.00000003.2221847702.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\AKDVE.pdb source: V3Medic.exe, 00000006.00000003.2062693325.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Common\AhnI2\7.0\building\build\AhnLab\Common\AhnI2\7.0\Trunk\Build\X64Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: certadm.pdb source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1548503760.0000000000620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Mkd2Bthf.pdb source: V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2000992273.000000000062B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk32.pdbp$ source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl.pdb source: V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\AhnLab\Common\BTScan\Trunk\Build\AMD64\Free\BtScnCtl.pdb source: V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALWFCtrl.pdbL source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\ScrMon32.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk32.pdb source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\NT32Release\NzInst.pdb source: V3Medic.exe, 00000006.00000003.1946553042.0000000005FC7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\ais\ahni2\master-36\build\git\AIS\ahni2\Build\X64Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.2122627555.0000000006ABD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Install\Common\Plugins\building\build\svn\AhnLab\Install\Common\Plugins\Trunk\Build\NT32Release\AhnIEx.pdb source: astx_setup.exe, 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release64\mkd25.pdb 0 source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: U:\Ambass\ambass\projects\msvc9\x64\Release DLL MT\ambassmt.pdb! source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007633 IsCharAlphaW,FindFirstFileW,FindFirstFileW,GetLastError,FindClose,	0_2_10007633
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1000776E IsCharAlphaW,FindFirstFileW,FindFirstFileW,GetLastError,FindClose,	0_2_1000776E
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100157E0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,	0_2_100157E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007A49 FindFirstFileW,FindClose,GetLastError,	0_2_10007A49
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007AAA FindFirstFileW,FindClose,	0_2_10007AAA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10009FBA FindFirstFileW,GetLastError,FindNextFileW,FindClose,	0_2_10009FBA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100086D8 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,FindNextFileW,FindClose,GetLastError,	0_2_100086D8

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\DB\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Quarantine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Temp\	Jump to behavior

Networking

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2238811654.0000000005DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ftp://http://HTTP/1.0
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%1/CertEnroll/%1_%3%4.crtfile://
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%1/CertEnroll/%3%8%9.crlfile://
Source: V3Medic.exe, 00000006.00000003.1778783611.0000000003A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http:///..
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://allyoucanleet.com/
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://broofa.com/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/SecureCertificateServices.crl09
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/globalca1.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng3.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0Y
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1577088768.0000000000620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: V3Medic.exe, 00000006.00000003.2028561930.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2109994779.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: V3Medic.exe, 00000006.00000003.1378099121.0000000003240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.ahnlab.com/down/ahnreport/AhnRpt.exe
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gladman.plushost.co.uk/oldsite/AES/index.php
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/)
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://json.org/).
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mathiasbynens.be/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mattmahoney.net/dc/zpaq.html
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mattmahoney.net/zpaq/
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ncompress.sourceforge.net/
Source: astx_setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2079647005.0000000003885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2125960885.0000000003857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng30V
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.ahnlab.com.
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com0_
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng3ocsp.crt04
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://site.icu-project.org/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sourceforge.jp/projects/lha/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sourceforge.net/p/infozip/patches/18/
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcd.com0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tss-geotrust-crl.thawte.com/ThawteTimestampingCA.crl0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wakaba.c3.cx/s/apps/unarchiver.html
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.7-zip.org/download.html
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.7-zip.org/sdk.html
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.aarongifford.com/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.aescrypt.com/
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1984695970.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ahnlab.com/redir/1102.rdir?locale=en_US2http://www.ahnlab.com/redir/1101.rdir?locale=en_U
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1984695970.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ahnlab.com/redir/1102.rdir?locale=ko_KR2http://www.ahnlab.com/redir/1101.rdir?locale=ko_K
Source: V3Medic.exe, 00000006.00000003.1984695970.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ahnlab.com/redir/1102.rdir?locale=sp_ES2http://www.ahnlab.com/redir/1101.rdir?locale=sp_E
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.arjsoftware.com/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.bzip.org/downloads.html
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cabextract.org.uk/libmspack/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.compression.ru/ds/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: astx_setup.exe, 00000000.00000002.2409620376.000000000040A000.00000004.00000001.01000000.00000003.sdmp, V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2173657512.000000000389A000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2088378566.00000000038BF000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143188218.00000000038C8000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1745963415.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1792743690.0000000006AEA000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1816448826.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2342461595.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.entrust.net/CRL/net1.crl0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/pub/infozip/license.html.
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kmonos.net/lib/xacrett.en.html
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/Copyright
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.apple.com/apsl/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.apple.com/source/xnu/xnu-1486.2.11/bsd/vfs/
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phreedom.org/md5)
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phreedom.org/md5)0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phreedom.org/md5)MD5
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.rarlab.com/rar_add.htm
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1577088768.0000000000620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wavpack.com/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winace.com/
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/zlib_license.html
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://yuilibrary.com/license/
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://%1/CertEnroll/nsrev_%3.aspldap:///CN=%7%8
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.bandisoft.com
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://code.bandisoft.com/
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0)
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gactivation.ahnlab.com/api/auth/v1/activate/client
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gactivation.ahnlab.com/api/auth/v1/activate/relay
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gactivation.ahnlab.com/api/auth/v1/healthcheck
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/zopfli
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/necolas/normalize.css/
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wycats/handlebars.js
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wycats/handlebars.js)
Source: V3Medic.exe, 00000006.00000003.1486462149.0000000000611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jp.ahnlab.com/site/support/qna/qnaAddForm2.do;
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mgactivation.ahnlab.com/api/auth/v1/activate/client
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mgactivation.ahnlab.com/api/auth/v1/activate/relay
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mgactivation.ahnlab.com/api/auth/v1/activate/relayhttps://mgactivation.ahnlab.com/api/auth/v
Source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mgactivation.ahnlab.com/api/auth/v1/healthcheck
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://opensource.ahnlab.com
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://seed.kisa.or.kr/iwt/ko/sup/EgovLeaInfo.do
Source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bandisoft.com
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2122424988.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2383715131.0000000006D22000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: V3Medic.exe, 00000006.00000003.2099236206.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2017798525.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs

Source: unknown

DNS traffic detected: queries for: gms.ahnlab.com

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_10081531 WSASetLastError,recv,WSAGetLastError,

0_2_10081531

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match

File source: Process Memory Space: V3Medic.exe PID: 6624, type: MEMORYSTR

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\NSIS.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ca2.der	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ca.der	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca.der	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\NSIS.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\V3ElamDr.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.cat	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_arm64.nz entropy: 7.99987389692	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_com.nz entropy: 7.99992425007	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_nt32.nz entropy: 7.99994581027	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_x64.nz entropy: 7.99996367978	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_ARM64.nz entropy: 7.99997967236	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Common.nz entropy: 7.99995972837	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_ARM64.nz entropy: 7.99992330835	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_NT32.nz entropy: 7.99991798674	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_X64.nz entropy: 7.99993900021	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_NT32.nz entropy: 7.99995451457	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Res.nz entropy: 7.99808528554	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_X64.nz entropy: 7.99996849744	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_ARM64.nz entropy: 7.99962010979	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_NT32.nz entropy: 7.99968840658	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_X64.nz entropy: 7.9996709535	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_ARM64.nz entropy: 7.99997224914	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_NT32.nz entropy: 7.99997283206	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_X64.nz entropy: 7.99997706581	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_ARM64.nz entropy: 7.99993645268	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_NT32.nz entropy: 7.99993597151	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_X64.nz entropy: 7.99993716897	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_ARM64.nz entropy: 7.99974501255	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_NT32.nz entropy: 7.99971520737	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_X64.nz entropy: 7.99975169927	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_ARM64.nz entropy: 7.99851995659	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_NT32.nz entropy: 7.99884081465	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_X64.nz entropy: 7.99914416454	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Update.nz entropy: 7.99991954609	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\asdahc.nz entropy: 7.99403404133	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\geo.asd entropy: 7.99435509055	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\geo.asd entropy: 7.99435509055	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\gof.dat entropy: 7.99341158373	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\gof.dat entropy: 7.99341158373	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msg.dat entropy: 7.99989526323	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\msg.dat entropy: 7.99989526323	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Prtect.dat entropy: 7.99468772612	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\V3Prtect.dat entropy: 7.99468772612	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tnnipsig.rul entropy: 7.9985827226	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipsig.rul entropy: 7.9985827226	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\defcfg.db entropy: 7.99346459276	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\DB\defcfg.db entropy: 7.99346459276	Jump to dropped file

System Summary

Uses 32bit PE files

Source: astx_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1000D6BA AI_ExitWindows,AhnIEx_ExitWindows,		0_2_1000D6BA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1001869A AhnIEx_ExitWindows,AhnIEx_IsWinNT,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,ExitWindowsEx,GetLastError,		0_2_1001869A

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

File created: C:\Windows\AhnInst.log

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100EF060	0_2_100EF060
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A7080	0_2_100A7080
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_101150A7	0_2_101150A7
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_101130A7	0_2_101130A7
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B30B0	0_2_100B30B0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A30E0	0_2_100A30E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B10E0	0_2_100B10E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009B110	0_2_1009B110
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A51C0	0_2_100A51C0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C7320	0_2_100C7320
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F3320	0_2_100F3320
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009F340	0_2_1009F340
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009B360	0_2_1009B360
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A9380	0_2_100A9380
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A53B0	0_2_100A53B0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A1410	0_2_100A1410
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AB440	0_2_100AB440
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F3440	0_2_100F3440
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A3450	0_2_100A3450
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F3488	0_2_100F3488
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100734F0	0_2_100734F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A5550	0_2_100A5550
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B15E0	0_2_100B15E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_101135EB	0_2_101135EB
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100DF640	0_2_100DF640
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A9650	0_2_100A9650
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B3700	0_2_100B3700
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A3750	0_2_100A3750
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A5760	0_2_100A5760
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008D780	0_2_1008D780
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009F7E0	0_2_1009F7E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100DF7F0	0_2_100DF7F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B1800	0_2_100B1800
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F58F0	0_2_100F58F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009B920	0_2_1009B920
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100EF940	0_2_100EF940
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AD970	0_2_100AD970
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1010D98B	0_2_1010D98B
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F3A60	0_2_100F3A60
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A5A70	0_2_100A5A70
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F5B10	0_2_100F5B10
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10113B2F	0_2_10113B2F
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1009FBF0	0_2_1009FBF0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A9C50	0_2_100A9C50
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C3C80	0_2_100C3C80
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100DFC80	0_2_100DFC80
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1003DCD0	0_2_1003DCD0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100E3CE0	0_2_100E3CE0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100E7CF0	0_2_100E7CF0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008DD00	0_2_1008DD00
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10073D10	0_2_10073D10
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C1D20	0_2_100C1D20
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A3D30	0_2_100A3D30
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F5D50	0_2_100F5D50
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A5D90	0_2_100A5D90
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A3DF0	0_2_100A3DF0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FBDF1	0_2_100FBDF1
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C3E10	0_2_100C3E10
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C1EF0	0_2_100C1EF0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10073F10	0_2_10073F10
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A5F20	0_2_100A5F20
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B1FA0	0_2_100B1FA0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10105FC2	0_2_10105FC2
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008E058	0_2_1008E058
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A4050	0_2_100A4050
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A2080	0_2_100A2080
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AC0E0	0_2_100AC0E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F60E0	0_2_100F60E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AA130	0_2_100AA130
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A01A0	0_2_100A01A0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F41C0	0_2_100F41C0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008A200	0_2_1008A200
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008A229	0_2_1008A229
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F0220	0_2_100F0220
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10114227	0_2_10114227
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A42A0	0_2_100A42A0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FC2C6	0_2_100FC2C6
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100E8300	0_2_100E8300
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A2340	0_2_100A2340
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100F4340	0_2_100F4340
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100EE350	0_2_100EE350
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100D0370	0_2_100D0370
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008E390	0_2_1008E390
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008C3E0	0_2_1008C3E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A63F0	0_2_100A63F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AA3F0	0_2_100AA3F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10074420	0_2_10074420
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B4430	0_2_100B4430
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B6490	0_2_100B6490
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A44A0	0_2_100A44A0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100524D0	0_2_100524D0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A0560	0_2_100A0560
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100C45C0	0_2_100C45C0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1008C5F0	0_2_1008C5F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B4610	0_2_100B4610
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100D6610	0_2_100D6610
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A8630	0_2_100A8630
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A2680	0_2_100A2680
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FC69A	0_2_100FC69A
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100B2690	0_2_100B2690
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100A46C0	0_2_100A46C0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100AA6E0	0_2_100AA6E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100506F0	0_2_100506F0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100E0770	0_2_100E0770
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1000A7B7	0_2_1000A7B7
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002	6_3_00635002
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00642484	6_3_00642484
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644688	6_3_00644688
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064195B	6_3_0064195B
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00644909	6_3_00644909
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640786	6_3_00640786
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_006435EA	6_3_006435EA
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640BF2	6_3_00640BF2
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064354C	6_3_0064354C
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064354C	6_3_0064354C
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_006435EA	6_3_006435EA
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640BF2	6_3_00640BF2
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_0064354C	6_3_0064354C
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_006435EA	6_3_006435EA
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00640BF2	6_3_00640BF2

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 10105818 appears 55 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 100FB0D0 appears 620 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 100FAF3D appears 44 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 10051590 appears 84 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 100FADEC appears 263 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 10017248 appears 51 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1004F8A0 appears 105 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1004F950 appears 374 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1004F970 appears 49 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1004F8E0 appears 81 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 100FAADF appears 39 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1000A6E4 appears 49 times
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: String function: 1005DA30 appears 48 times

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_10006383 __ehhandler$?_Initialize@SchedulerPolicy@Concurrency@@AAEXIPAPAD@Z,__EH_prolog3,_memset,GetLastError,GetLastError,CreateProcessAsUserW,GetLastError,GetLastError,

0_2_10006383

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

Process Stats: CPU usage > 98%

Sample file is different than original file name gathered from version info

Source: astx_setup.exe, 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: OriginalFilenameAhnIEx.dll( vs astx_setup.exe

Tries to load missing DLLs

Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Section loaded: mfc90enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Section loaded: mfc90enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Section loaded: mfc90enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Section loaded: mfc90enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Section loaded: mfc90loc.dll	Jump to behavior

Contains functionality to delete services

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_10013A39 OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,GetLastError,AhnIEx_SetReboot,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,CloseServiceHandle,GetLastError,

0_2_10013A39

Source: C:\Users\user\Desktop\astx_setup.exe

File read: C:\Users\user\Desktop\astx_setup.exe

Jump to behavior

Source: astx_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\astx_setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\astx_setup.exe C:\Users\user\Desktop\astx_setup.exe
Source: C:\Users\user\Desktop\astx_setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C "ECHO Y\| cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)
Source: C:\Users\user\Desktop\astx_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe "C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe"
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\astx_setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C "ECHO Y\| cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)"	Jump to behavior
Source: C:\Users\user\Desktop\astx_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe "C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1001869A AhnIEx_ExitWindows,AhnIEx_IsWinNT,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,ExitWindowsEx,GetLastError,

0_2_1001869A

Source: C:\Users\user\Desktop\astx_setup.exe

File created: C:\Users\user\AppData\Local\Temp\nspB39D.tmp

Jump to behavior

Source: classification engine

Classification label: sus34.rans.troj.evad.winEXE@16/713@3/0

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100162BF __EH_prolog3,CoCreateInstance,_wcsrchr,

0_2_100162BF

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: OpenSCManagerW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,GetLastError,GetLastError,GetLastError,CloseServiceHandle,GetLastError,		0_2_100135A9
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: AI_CreateService2,		0_2_1000E5CE

Source: C:\Users\user\Desktop\astx_setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1000D788 AI_GetDiskFreeSpace,AhnIEx_GetDiskFreeSpace,AhnIEx_snprintf,

0_2_1000D788

Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s WHERE %s;
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_master SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1582968292.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s;
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1586545869.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100136B9 OpenSCManagerW,OpenServiceW,StartServiceW,GetLastError,GetLastError,GetLastError,PeekMessageW,Sleep,QueryServiceStatus,DispatchMessageW,PeekMessageW,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

0_2_100136B9

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_02
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_mutex_ahni2_log_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_Mutex_AIL_SingleInstance_{FF56B785-EF71-461B-AF11-9891E8303723}_ASTX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_02
Source: C:\Users\user\Desktop\astx_setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_Mutex_AIL_Log_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:304:WilStaging_02

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_10019718 LoadResource,LockResource,SizeofResource,

0_2_10019718

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

File created: C:\Program Files\AhnLab

Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

File written: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\BldInfo.ini

Jump to behavior

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

File opened: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr90.dll

Jump to behavior

Submission file is bigger than most known malware samples

Source: astx_setup.exe

Static file information: File size 81412376 > 1048576

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\table	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us\image	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\en_us\table	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Quarantine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2\ASDTEMP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MeD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\Microsoft.VC90.CRT.manifest	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\license.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\drvinfo_astx.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\defcfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\ipcntry.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\nzcmncfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DB\nzdefcfg.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\AHC\product.dat.ahc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\mupdate2.cfg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Product.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\V3Prtect.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca.der	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\astx.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipprt.rul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipsig.rul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\aos.sld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\aspinfo.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\extraopn_ply.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\netizen_ply_default.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\ply_ver.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\DefPly\starter_ply.ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ENU.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\msvcr90.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dafault.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dim.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dafault.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dim.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_over.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_f.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_h.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_n.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_p.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\checkboxes.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\custom_logo.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_focus.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_hover.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_normal.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_pressed.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_firewall.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_log_viewer.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_error.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_info.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_warning.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_on.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_product_tray.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_quarantine.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_detect.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_setting.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_stx_info.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_alert.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_complete.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_default.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_disable.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_shel_check.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_listctrl_header.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_popup_titlebar.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_safe.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_warning.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_bg.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_bg.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_line.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_mid.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_left.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_right.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Directory created: C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo_about.bmp	Jump to behavior

PE / OLE file has a valid certificate

Source: astx_setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: astx_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: AhnRghNt.pdb source: V3Medic.exe, 00000006.00000003.2204584934.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\WinFWMgr\Trunk\Build\X64Release.vc90\WinFWMgr.pdb source: V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\PdCfg.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1795673899.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\Av.pdb source: V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2028561930.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\UpEx.pdb source: V3Medic.exe, 00000006.00000003.1838675962.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ATamptNt.pdb source: V3Medic.exe, 00000006.00000003.2220560883.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\CdmCtrl.pdb source: V3Medic.exe, 00000006.00000003.2164525785.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25def.pdb source: V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AHAWKENT.pdb source: V3Medic.exe, 00000006.00000003.2203334329.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonTDLH.pdb source: V3Medic.exe, 00000006.00000003.2212897136.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonTDnt.pdb source: V3Medic.exe, 00000006.00000003.2216027615.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl32.pdb source: V3Medic.exe, 00000006.00000003.1872389829.0000000006605000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1817604204.0000000006AC0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: AMonCDw7.pdb source: V3Medic.exe, 00000006.00000003.2206061085.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\build\X64Release.vc60\AhnCtlKD.pdb source: V3Medic.exe, 00000006.00000003.2118726572.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\HsbCtl.pdb source: V3Medic.exe, 00000006.00000003.1746313302.0000000003A5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\2.1\Trunk\Src\Common\aostrust\Trunk\Build\X64Release\aostrust32.pdb source: V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcm90.i386.pdb source: V3Medic.exe, 00000006.00000003.1941544747.0000000005E6A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\AhnTrust\3.0\trunk\Build\X64Release.vc90\atstrumt.pdb source: V3Medic.exe, 00000006.00000003.2376704009.0000000006BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\ScrMon32.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: certutil.pdb source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzPlugin.pdb source: V3Medic.exe, 00000006.00000003.1790684505.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1858664684.000000000614A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Build\_building\Build\Engine\EngineNG\brahma\trunk\build\msvc6_win64\AMD64Release\bin\asc_main.pdb source: V3Medic.exe, 00000006.00000003.2023263372.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2039114730.0000000003750000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: HSBDrv64.pdb source: V3Medic.exe, 00000006.00000003.1994448685.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1965582045.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALWFCtrl.pdb source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Mkd2Nadr.pdb source: V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2002829645.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release64\mkd25.pdb source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\AupASD.pdb source: V3Medic.exe, 00000006.00000003.2098362304.00000000038A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk.pdb source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDUp.pdb source: V3Medic.exe, 00000006.00000003.2086586393.0000000003856000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mfc90u.amd64.pdb source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2238811654.0000000005DC2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Mkd3kfNt.pdb source: V3Medic.exe, 00000006.00000003.2005506483.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2006028938.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcr90.amd64.pdb source: V3Medic.exe, 00000006.00000003.2258731491.00000000062A1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1419152820.00000000005F2000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1993346827.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Project\KCMVP\ACM\1.0\D.0000000017\Build\libacm.dll\VC9.0\Win32Release\libacm.pdb source: V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AMonCDw7.pdbGCTL source: V3Medic.exe, 00000006.00000003.2206061085.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtInst.pdb source: V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1802866087.0000000000629000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp90.amd64.pdb source: V3Medic.exe, 00000006.00000003.2258731491.00000000062A1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\AhnLab\Common\AhnTrust\3.0\trunk\Build\X64Release.vc90\atstrust.pdb source: V3Medic.exe, 00000006.00000003.2158939065.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: V3ElamDr.pdb source: V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2048046261.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2049620514.000000000062B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcm90.amd64.pdb source: V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25sdk.pdb source: V3Medic.exe, 00000006.00000003.1569077142.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1596806201.0000000005DEC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Build\Install\Common\Plugins\building\build\svn\AhnLab\Install\Common\Plugins\Trunk\Build\NT32Release\SysX64.pdb source: SysX64.exe, 0000000F.00000000.1385836130.000000000040F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDSvc.pdb source: V3Medic.exe, 00000006.00000003.2080153436.00000000038AA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcp90.i386.pdb source: V3Medic.exe, 00000006.00000003.1942456409.0000000005EA3000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDCr.pdb source: V3Medic.exe, 00000006.00000003.2072555587.000000000385F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\AHAWKE.pdb source: V3Medic.exe, 00000006.00000003.2109994779.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\ahnlab\system\common\public\monster_v4.0\trunk\src\amonlwlh\amd64\AMonLWLH.pdb source: V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzBrcom.pdb source: V3Medic.exe, 00000006.00000003.1778783611.0000000003A58000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: V3ElamCt.pdb source: V3Medic.exe, 00000006.00000003.2031350084.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\local_temp\win_amd64_unicode_msvs09\AHLOHA\Ahloha1.4.0.1_SRC\build\msvs09\x64\Release\ahloha.pdb source: V3Medic.exe, 00000006.00000003.2117776200.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\NzInst.pdb source: V3Medic.exe, 00000006.00000003.1425377759.0000000004546000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\CdmAPI.pdb source: V3Medic.exe, V3Medic.exe, 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSvr.pdb source: V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: V3Medic.exe, 00000006.00000003.1942456409.0000000005EA3000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1597415511.0000000005E41000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TSFltCtl.pdb source: V3Medic.exe, 00000006.00000003.2029624911.000000000062B000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TSFltDrv.pdb source: V3Medic.exe, 00000006.00000003.2048550396.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2045082920.00000000038E1000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2048046261.00000000035F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Building\TSMime\TSMime_1.0\build\X64Release.vc90\tsmime.pdb source: V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\V3Cert.pdb source: V3Medic.exe, 00000006.00000003.1839454028.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonHKnt.pdb source: V3Medic.exe, 00000006.00000003.2209193882.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TfFRegNt.pdb source: V3Medic.exe, 00000006.00000003.2293256353.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2293596896.0000000000638000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release\mkd25def.pdb 0 source: V3Medic.exe, 00000006.00000003.1567514805.0000000000620000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AMonCDw8.pdbGCTL source: V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Common\AhnI2\7.0\building\build\AhnLab\Common\AhnI2\7.0\Trunk\Build\NT32Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90u.i386.pdb source: V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: V3Medic.exe, 00000006.00000003.1597415511.0000000005E41000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\Core.pdb source: V3Medic.exe, 00000006.00000003.2174084552.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2227219595.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\TNNetUtil.pdb source: V3Medic.exe, 00000006.00000003.2200976148.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl32.pdb@ source: V3Medic.exe, 00000006.00000003.1872389829.0000000006605000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1817604204.0000000006AC0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Project\KCMVP\ACM\1.0\D.0000000017\Build\libacm.dll\VC9.0\x64Release\libacm.pdb source: V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\NT32Release32On64\HsbCtl32.pdb source: V3Medic.exe, 00000006.00000003.1753923421.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: AMonCDw8.pdb source: V3Medic.exe, 00000006.00000003.2207735485.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ATamptU.pdb source: V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDCli.pdb source: V3Medic.exe, 00000006.00000003.2066690791.0000000003855000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi32.pdb source: V3Medic.exe, V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi.pdb source: V3Medic.exe, 00000006.00000003.1797309111.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\devel\Ark6\bin.sdk\Ark64lgplv2.pdb source: V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\build\system\product\mkd\korenc\building\build\ahnlab\system\product\mkd\korenc\trunk\src\klib_sys\amd64\klb64mkd.pdb source: V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\2.1\Trunk\Src\Common\aostrust\Trunk\Build\X64Release\aostrust32.pdb source: V3Medic.exe, 00000006.00000003.1754532060.0000000000627000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk.pdb source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u:\Project\Medicine\Framework\2.5\Trunk\Build\X64Release\ASDi.pdb source: V3Medic.exe, 00000006.00000003.2141353793.000000000385B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\powapi32.pdb source: V3Medic.exe, 00000006.00000003.1799138938.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Ambass\ambass\projects\msvc9\x64\Release DLL MT\ambassmt.pdb source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Cdm2DrNt.pdb source: V3Medic.exe, 00000006.00000003.2221847702.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\Build\X64Release.vc60\AKDVE.pdb source: V3Medic.exe, 00000006.00000003.2062693325.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Common\AhnI2\7.0\building\build\AhnLab\Common\AhnI2\7.0\Trunk\Build\X64Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: certadm.pdb source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1548503760.0000000000620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Mkd2Bthf.pdb source: V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2000992273.000000000062B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk32.pdbp$ source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StCtl.pdb source: V3Medic.exe, 00000006.00000003.1866509398.000000000640F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: U:\AhnLab\Common\BTScan\Trunk\Build\AMD64\Free\BtScnCtl.pdb source: V3Medic.exe, 00000006.00000003.2160139288.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALWFCtrl.pdbL source: V3Medic.exe, 00000006.00000003.2123371733.000000000062C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\ScrMon32.pdb source: V3Medic.exe, 00000006.00000003.1863999407.0000000006332000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1800565257.000000000062E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\X64Release\StSdk32.pdb source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: u:\Product\AOS\SafeTransaction\1.0\Trunk\Build\NT32Release\NzInst.pdb source: V3Medic.exe, 00000006.00000003.1946553042.0000000005FC7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\Build\ais\ahni2\master-36\build\git\AIS\ahni2\Build\X64Release.vc90\AhnI2.pdb source: V3Medic.exe, 00000006.00000003.2122627555.0000000006ABD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\Build\Install\Common\Plugins\building\build\svn\AhnLab\Install\Common\Plugins\Trunk\Build\NT32Release\AhnIEx.pdb source: astx_setup.exe, 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: d:\Build\Product\AOS\SafeTransaction\1.0\building\build\Product\AOS\SafeTransaction\1.0\Trunk\Src\AkSdk\Trunk\Build\Release64\mkd25.pdb 0 source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: U:\Ambass\ambass\projects\msvc9\x64\Release DLL MT\ambassmt.pdb! source: V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2413738502.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: astx_setup.exe PID: 6348, type: MEMORYSTR

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FB580 push ecx; ret	0_2_100FB593
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1010585D push ecx; ret	0_2_10105870
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00635002 pushad ; retn 0000h	6_3_00635AF1
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Code function: 6_3_00631142 push FFFFFF89h; retf	6_3_00631144

PE file contains sections with non-standard names

Source: medvphku.dll.6.dr	Static PE information: section name: .detourc
Source: medvphku.dll.6.dr	Static PE information: section name: .detourd
Source: medvphku.dll.6.dr	Static PE information: section name: .UPX0
Source: medvphku.dll0.6.dr	Static PE information: section name: .detourc
Source: medvphku.dll0.6.dr	Static PE information: section name: .detourd
Source: medvphku.dll0.6.dr	Static PE information: section name: .UPX0
Source: medvphkuw6.dll.6.dr	Static PE information: section name: .detourc
Source: medvphkuw6.dll.6.dr	Static PE information: section name: .detourd
Source: medvphkuw6.dll.6.dr	Static PE information: section name: .UPX0
Source: medvphkuw6.dll0.6.dr	Static PE information: section name: .detourc
Source: medvphkuw6.dll0.6.dr	Static PE information: section name: .detourd
Source: medvphkuw6.dll0.6.dr	Static PE information: section name: .UPX0
Source: trueeyesu.dll.6.dr	Static PE information: section name: .detourc
Source: trueeyesu.dll.6.dr	Static PE information: section name: .detourd
Source: trueeyesu.dll.6.dr	Static PE information: section name: .UPX0
Source: trueeyesu.dll0.6.dr	Static PE information: section name: .detourc
Source: trueeyesu.dll0.6.dr	Static PE information: section name: .detourd
Source: trueeyesu.dll0.6.dr	Static PE information: section name: .UPX0
Source: ScrMon32.dll.6.dr	Static PE information: section name: .ScrmonS
Source: ScrMon32.dll0.6.dr	Static PE information: section name: .ScrmonS
Source: Ark64.dll.6.dr	Static PE information: section name: text
Source: Ark64.dll0.6.dr	Static PE information: section name: text

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_101101FA LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_101101FA

Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.008144709647387
Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.008144709647387
Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.097619293313276
Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.097619293313276
Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.030662826386985
Source: initial sample	Static PE information: section name: .UPX0 entropy: 7.030662826386985

Persistence and Installation Behavior

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\NzInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcp90.dll	Jump to dropped file

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\HsbCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medcored.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmAPI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ALWFCtrl.Dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ALWFCtrl.Dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\TSFltCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcored.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\PdCfg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\mkd3kfnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\klb64mkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\IAccessible2Proxy32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Medic.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ahloha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\powapi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamCt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Cert.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnRghNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TFFREGNT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonHKnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\StSdk32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\trueeyesu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ATampt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\AhnIEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25def64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asc_main.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2Nadr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25sdk64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonTDnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StSdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\NzInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\StSess32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AhnIEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certadm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Cdm2DrNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\StCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\BtScnCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW8.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64lgplv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\BtScnCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\NzPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd2564.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\asc_main.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ENU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ambassmt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ScrMon32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDUp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\PdCfg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AupASD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medvphkuw6.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKENT.SYS	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\tsmime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDWsc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StCtInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphku.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDCr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\SCTX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ENU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnCtlKD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbDrv64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2bthf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\aostrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysARM64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AI7z20.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATamptNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Av.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Ark64lgplv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\klb64mkd.sys	Jump to dropped file
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd3kfnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AupASD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AKDVE.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW7.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\atstrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\atstrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\UpEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmCtrl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\powapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\IAccessible2Proxy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90ENU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\ScrMon32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\WinFWMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tsmime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AhnRghNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonTDLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonCDW8.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\UpEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ssl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AtamptU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ASDUp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkuw6.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\WinFWMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Mkd2Nadr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TNNetUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonHKnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzInst32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StSess.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medvphkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\CdmAPI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SCTX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AtamptU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\V3ElamDr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StSvr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ahloha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\NzBrcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\AhnCtlKD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AhnI2t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ATamptNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Av.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\V3ElamCt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\HsbDrv64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\StCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Mkd2bthf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATampt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\NzInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonCDW7.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\NzInst32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\CdmCtrl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\medvphku.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\TSFltDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\NzBrcom32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\V3Cert.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd2564.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\TFFREGNT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSvr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Nz32\aostrust32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\ambassmt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\HsbCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Cdm2DrNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\trueeyesu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvpdrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\TNNetUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\Ark64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\MFC90ESP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nss3.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\HsbDrv64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonCDW8.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Mkd2bthf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\V3ElamDr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\klb64mkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\mkd3kfnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonCDW7.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Mkd2Nadr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\Cdm2DrNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonTDnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AhnRghNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonTDLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonHKnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Windows\System32\drivers\AMonLWLH.sys	Jump to dropped file

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1000B0F4 AhnIEx_SetMode,AhnIEx_GetMode,AhnIEx_GetMode,AhnIEx_GetMode,_memset,AhnIEx_IsWinNT,AhnIEx_IsWinNT,AhnIEx_IsWinNT,GetPrivateProfileStringW,

0_2_1000B0F4

Creates license or readme file

Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_en_US.txt	Jump to behavior
Source: C:\Users\user\Desktop\astx_setup.exe	File created: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_ko_kr.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\license.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File created: C:\Program Files\AhnLab\Safe Transaction\license.txt	Jump to behavior

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mkd2Nadr

Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

0_2_100136B9

Hooking and other Techniques for Hiding and Protection

May modify the system service descriptor table (often done to hook functions)

Source: V3Medic.exe, 00000006.00000003.2062693325.000000000062C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: KeServiceDescriptorTable

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1001D082 GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,FreeLibrary,_memset,

0_2_1001D082

Uses cacls to modify the permissions of files

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)

Source: C:\Users\user\Desktop\astx_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys, type: DROPPED
Source: Yara match	File source: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys, type: DROPPED

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\astx_setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-73949

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\HsbCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medcored.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmAPI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ALWFCtrl.Dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ALWFCtrl.Dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\TSFltCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcored.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\PdCfg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\mkd3kfnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\klb64mkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\IAccessible2Proxy32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Medic.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ahloha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\powapi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamCt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Cert.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnRghNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TFFREGNT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonHKnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\StSdk32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ATampt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\trueeyesu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25def64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asc_main.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2Nadr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25sdk64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonTDnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StSdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\StSess32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certadm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\Cdm2DrNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\StCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\BtScnCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW8.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64lgplv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\BtScnCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\NzPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\asc_main.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd2564.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ambassmt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ScrMon32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDUp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\PdCfg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AupASD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medvphkuw6.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKENT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\tsmime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDWsc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StCtInst.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphku.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDCr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\SCTX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnCtlKD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbDrv64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2bthf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\aostrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysARM64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AI7z20.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATamptNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Av.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\klb64mkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Ark64lgplv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd3kfnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AupASD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW7.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AKDVE.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\atstrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\atstrust.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\UpEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCli.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmCtrl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\powapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\IAccessible2Proxy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\ScrMon32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\WinFWMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tsmime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AhnRghNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonTDLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonCDW8.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\UpEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ssl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AtamptU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ASDUp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkuw6.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\WinFWMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\Mkd2Nadr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TNNetUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90ITA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzInst32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonHKnt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StSess.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medvphkd.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\CdmAPI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AtamptU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SCTX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\V3ElamDr.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StSvr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90CHT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ahloha.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\NzBrcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\AhnCtlKD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ATamptNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Av.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90DEU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\V3ElamCt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\HsbDrv64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\Mkd2bthf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\StCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATampt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\AMonCDW7.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\NzInst32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\CdmCtrl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\medvphku.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\NzBrcom32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\TSFltDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\ProgramData\AhnLab\AIS\SafeTransaction\AhnI2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\V3Cert.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd2564.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\libacm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\TFFREGNT.SYS	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSvr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Nz32\aostrust32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\HsbCtl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\ambassmt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Cdm2DrNt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\trueeyesu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvpdrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\TNNetUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\Ark64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Dropped PE file which has not been started: C:\Program Files\AhnLab\Safe Transaction\MFC90ESP.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\astx_setup.exe

API coverage: 1.2 %

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007633 IsCharAlphaW,FindFirstFileW,FindFirstFileW,GetLastError,FindClose,	0_2_10007633
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1000776E IsCharAlphaW,FindFirstFileW,FindFirstFileW,GetLastError,FindClose,	0_2_1000776E
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100157E0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,	0_2_100157E0
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007A49 FindFirstFileW,FindClose,GetLastError,	0_2_10007A49
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10007AAA FindFirstFileW,FindClose,	0_2_10007AAA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_10009FBA FindFirstFileW,GetLastError,FindNextFileW,FindClose,	0_2_10009FBA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100086D8 FindFirstFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,FindNextFileW,FindClose,GetLastError,	0_2_100086D8

Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\DB\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Quarantine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	File opened: C:\Program Files\AhnLab\Safe Transaction\Temp\	Jump to behavior

Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware View Agent
Source: V3Medic.exe, 00000006.00000003.1842987372.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .\StSdkSa_PcLog.cpp[IAstxSaPcLogImpl::Initialize] called[IAstxSaPcLogImpl::Uninitialize] calledIAstxSaPcLogImpl::GetPcLogA[IAstxSaPcLogImpl::GetPcLogA] STSDKEX_ERROR_BAD_PARAMETER[IAstxSaPcLogImpl::GetPcLogA] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s) bReload(%d)VirtualMachineYnYN[IAstxSaPcLogImpl::GetPcLogA] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s), strEnvValue:(%s), bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogA] dwError(0x%08x)IAstxSaPcLogImpl::GetPcLogW[IAstxSaPcLogImpl::GetPcLogW] STSDKEX_ERROR_BAD_PARAMETER[IAstxSaPcLogImpl::GetPcLogW] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s) bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogW] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s), strEnvValue:(%s), bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogW] dwError(0x%08x)[CStSdkSaPcLog::Uninitialize] called0
Source: V3Medic.exe, 00000006.00000003.1778783611.0000000003A58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: setupapi.dllSetupDiGetClassDevsWSetupDiDestroyDeviceInfoListSetupDiEnumDeviceInfoSetupDiGetDeviceRegistryPropertyWvmicrdvQEMU-GA{4D36E967-E325-11CE-BFC1-08002BE10318}vmwarevboxvirtual hd ata devicewsnm.exeVMware View AgentSOFTWARE\Citrix\VirtualDesktopAgentCitrix\Virtual Desktop AgentWorkStationAgentWorkstationAgent.exebrokeragent.exectxsvchost.exepvsvmagent.exexenguestagent.exeParallels Tools Service.\AkMsgCtrl.cpp[CAkMsgCtrl::Initialize][CAkMsgCtrl::Initialize] _beginthreadex m_hAliveThread=%x, nThreadId=%x[CAkMsgCtrl::Initialize] _beginthreadex m_hProcessingThread=%x, nThreadId=%x[CAkMsgCtrl::Initialize] _beginthreadex m_hWaitingThread=%x, nThreadId=%x[CAkMsgCtrl::Finalize][CAkMsgCtrl::AliveThread][CAkMsgCtrl::WaitingThread]\\.\pipe\session(%d)nzbrco(%d)[CAkMsgCtrl::Callback] pRequest == NULL%s[CAkMsgCtrl::ProcessingThread]commandtypefilefilepathrbcommandseqe2e_inite2e_starte2e_cleare2e_focuse2e_blure2e_stopget_datae2e_alivee2e_uninite2e_unloade2e_gethashe2e_gettexte2e_settexte2e_forminite2e_formgetsdk_getenctext[CAkMsgCtrl::ProcessingThread] Unknown Request=%sACKresultpageid[CAkMsgCtrl::OnE2EUninit] pInstance == NULL, IsWindow(hwndFocus=%x) == %d[CAkMsgCtrl::OnE2EUnload] pInstance == NULL, IsWindow(hwndFocus=%x) == %de2e_inputidnamee2e_typeurlhwndvAlgcustcodeak_drvnosptw_vkeyw_kstr0call_settextcall_gettextvm_env1formmaxlengthtxtmsktypee2e_inputtype[CAkMsgCtrl::OnE2EFocus] pE2EInput == NULL21password[CAkMsgCtrl::OnE2EFocus] pInstance == NULL, hwndFocus=%x[CAkMsgCtrl::OnE2EFocus] pInstance == NULL, IsWindow(hwndFocus=%x) == false[CAkMsgCtrl::OnE2EFocus] Updated pE2EWindow->m_hwndFocus(%x) to hFocus(%x)[CAkMsgCtrl::OnE2EBlur] pInstance == NULL, IsWindow(hwndFocus=%x) == %d[CAkMsgCtrl::OnE2EBlur] ignored, still focused [CAkMsgCtrl::OnE2EStop] pInstance == NULL, IsWindow(hwndFocus=%x) == %dalgids1names1ids2names2uniqcert1cert2utimenorsa&=e2e_data2e2e_data1[CAkMsgCtrl::OnE2EGetHash] pE2EInput == NULL[CAkMsgCtrl::OnE2EGetHash] strHash(empty)hashwizvera_key[CAkMsgCtrl::OnE2EGetText] pE2EInput == NULL2231[CAkMsgCtrl::OnE2EGetText] not allowed, m_strE2EType=%s[CAkMsgCtrl::OnE2EGetText] Wizvera Mode. Key is empty.text[CAkMsgCtrl::OnE2EGetText] Wizvera Mode. Encrypt failed.e2eformnoenc[CAkMsgCtrl::OnE2ESetText] pE2EInput == NULLe2e_datancertversvre2e_form1e2e_form2[CAkMsgCtrl::OnE2EFormGet] pE2EInput == NULLcustomcoderandom[CAkMsgCtrl::OnSDKGetEncText] E2EMGR.GetEncTextStr() failed.getenctext.\apihook.cpphModuleHandleszExportAPI[HookFreeCodeGetProcAddress] EXCEPTION_EXECUTE_HANDLERpbMemBufpbRawBuf[GetOrgCodeFromFile] GetModuleHandle failed(errno=%ld,%s)dwRvaAddr > 0[GetOrgCodeFromFile] CreateFileA failed(errno=%ld,%s)[GetOrgCodeFromFile] CreateFileMapping failed(errno=%ld)[GetOrgCodeFromFile] MapViewOfFile failed(errno=%ld)[GetOrgCodeFromFile] ReadFile failed(errno=%ld)CallWindowProcWCallWindowProcAuser32.dll.\CallWindowProcApiHook.cppCCallWindowProcApiHook::Hook_CallWindowProcA FF SetSafeWndProc lpPrevWndFunc[0x%08x]xul.dllCCallWindowProcApiHook::Hook_
Source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \\.\pipe\nzsesspipeserver..\Common\NzSessMessageMgr.cpp[CNzSessMessageMgr::CNzSessMessageMgr] CAccessUtility::CreateEveryoneAccessibleSecurityDescriptor() failed.{7D33F21A-8B4E-4c90-B80D-227DBF687A4E}NULL != m_hSyncMutex[CNzSessMessageMgr::SendBrwsLogMessage] CPipeClient::CheckServer() failed. error=%d[CNzSessMessageMgr::SendBrwsLogMessage] CPipeClient::Connect() failed. error=%dCNzSessMessageMgr::SendSdkEstmMessage[CNzSessMessageMgr::SendSdkEstmMessage] CPipeClient::CheckServer() failed. error=%d[CNzSessMessageMgr::SendSdkEstmMessage] CPipeClient::Connect() failed. error=%dNULL != pSecureMsg[CNzSessMessageMgr::SendSdkExMessageIntRet] CPipeClient::CheckServer() failed.[CNzSessMessageMgr::SendSdkExMessageIntRet] CPipeClient::Connect() failed.[CNzSessMessageMgr::SendSdkExMessageStrRet] CPipeClient::CheckServer() failed.[CNzSessMessageMgr::SendSdkExMessageStrRet] CPipeClient::Connect() failed.xdigitwuppersspacepunctprintlowergraphdigitdcntrlblankalphaalnumteamviewervncrc40app.exercengmgru.exeManufacturerModelProduct\iphlpapi.dllGetExtendedTcpTablesetupapi.dllSetupDiGetClassDevsWSetupDiDestroyDeviceInfoListSetupDiEnumDeviceInfoSetupDiGetDeviceRegistryPropertyWvmicrdvQEMU-GA{4D36E967-E325-11CE-BFC1-08002BE10318}vmwarevboxvirtual hd ata devicewsnm.exeVMware View AgentSOFTWARE\Citrix\VirtualDesktopAgentCitrix\Virtual Desktop AgentWorkStationAgentWorkstationAgent.exebrokeragent.exectxsvchost.exepvsvmagent.exexenguestagent.exeParallels Tools Service
Source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/..\Common\PcLogGatherer.cpp[CPcLogGatherer::Reload] m_hReloadThread=%x, m_nReloadThreadID=%d[CPcLogGatherer::Reload] PcLog is already reloadingCPcLogGatherer::ReloadInternalPrivIP%dGatewayIP%dGatewayIPIP_ETH0_PRIV_YNIP_ETH1_PRIV_YNIP_ETH2_PRIV_YN0.0.0.0ActiveGWIPPrivIP1PrivIP2PrivIP3McAdr%dMAC_ORG_ETH%dFORGERY_MAC_ETH%d_YNJuniper Network Connect Virtual Adapter%02X-%02X-%02X-%02X-%02X-%02X00-00-00-00-00-00McAdr%dFORGERY_MAC_YNVpnYnVpnIPVpnCntryCdIP_VPN_LCALUSE_VPNVPN_N_COUNTRY_CODEVPN_NIPWin32_BaseBoardSerialNumberMbSerial_VMMbSerial%MbProductNoMbManufacturerCustomHdSerial[CPcLogGatherer::UseCustomHDSerial] dwCustomHdSerial=%dHdSerial_VMHdSerialWMINOTSUPPORTEDHdSerial2HdSerial3Win32_DiskDriveDeviceIDphysicaldrive0HdModelDISKSERIALHdSerial1_NHHdSerial2_NHHdSerial3_NHWin32_PhysicalMediaTagphysicaldrive%d00000000000000000000UsbSerial%dSYSTEM\CurrentControlSet\services\USBSTOR\EnumCountWin32_OperatingSystemOSType%02xOsTypeCdOsVerCdOSLanguage%04xOsLangCdServicePackMajorVersionOsSpCdSOFTWARE\Microsoft\CryptographyMachineGuidOsGuidSYSTEM\CurrentControlSet\Control\Terminal ServerfDenyTSConnectionsOsRemoteYnSYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileEnableFirewallDoNotAllowExceptionsOsFwStupCd03OS_FIREWALL_CD0102%04d%02d%02dLogDate%02d%02d%02d%03ldLogTime1.0LogVerPrxyUseYnP_INFPrxyIPPrxyIP_sz15PrxyCntryCdPRXY_LCAL[CPcLogGatherer::GetPcLog] m_bTimeoutReload = TRUESoftware\AhnLab\Safe Transaction\pl[CPcLogGatherer::GetPcLog] Base64Decode error=%d[CPcLogGatherer::SetPcLog] skip (%s)[CPcLogGatherer::SetPcLog] Base64Encode error=%d[CPcLogGatherer::SetPcLog] reg.Create error=%d[CPcLogGatherer::SetPcLog] %s=%src50app.exercsemgru.exercuimgru.exeRD\|RSNORemoteEnvREMOTE_YNIS_REMOTEMadr%dValidYn^[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}$^[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}$Win32_keyboardDescriptionUSBPS/2%02dKbdType10-%03d-%03d-%02dOS_VSN_CD10OS_CD00OS_SPVSN99MSIEEdge60Firefox20rvOpera50OPRChromeEdg7030Safari40%s-%03d-%03d-000-000BwVsnCdBR_VERBR_LONG_NAMEBwVsnCd2%03d%s-%s-000Internet ExplorerMS EdgeEtcPubIPPubIPCntryCdENAT_ERR_CDW_COUNTRY_CODECPcLogGatherer::InitializeDBDB\ipcntry.db[CPcLogGatherer::InitializeDB] error : sqlite3_open(%s)CPcLogGatherer::SetCountryCodeselect CODE from t where START <= %u and END >= %uSTS_DHACKSTS_KEYLOG_YNELAPSED_TMCpuId_VMCpuIdCPUID0CPUID1Win32_ProcessorProcessorIdNameCpuNameCaptionCpuCaptionCpuId_NH%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02XSOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCardsServiceName%s=%s\\.\[CPcLogGatherer::GetNICMacAddress] CreateFileA(%s) error[CPcLogGatherer::GetSecuLogCount] Sdk Mode can't gathered SecuLog[CPcLogGatherer::GetSecuLogCount] cLogDB.Initialize() error[CPcLogGatherer::GetSecuLogCount] cLogDB.GetLogInterface() error[CPcLogGatherer::GetSecuLogCount] cLogDB.GetLogDataInterface() erro
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .\StSdkSa_PcLog.cpp[IAstxSaPcLogImpl::Initialize] called[IAstxSaPcLogImpl::Uninitialize] calledIAstxSaPcLogImpl::GetPcLogA[IAstxSaPcLogImpl::GetPcLogA] STSDKEX_ERROR_BAD_PARAMETER[IAstxSaPcLogImpl::GetPcLogA] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s) bReload(%d)VirtualMachineYnYN[IAstxSaPcLogImpl::GetPcLogA] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s), strEnvValue:(%s), bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogA] dwError(0x%08x)IAstxSaPcLogImpl::GetPcLogW[IAstxSaPcLogImpl::GetPcLogW] STSDKEX_ERROR_BAD_PARAMETER[IAstxSaPcLogImpl::GetPcLogW] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s) bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogW] SDK_MSG_ID_PCLOG_GET_ENV_INFO_FUNC strEnvType(%s), strEnvValue:(%s), bReload(%d), dwSize:(%d)[IAstxSaPcLogImpl::GetPcLogW] dwError(0x%08x)[CStSdkSaPcLog::Uninitialize] calledH
Source: V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: optsvm_parallels[checVirtualMachine] vm_parallels=%d(result=%d)[procIsVmEnv] in1vm_env[procIsVmEnv] out (result:%s)[procIsRemoteEnv] inremote_env[procIsRemoteEnv] out (result:%s)[procIsVmRemoteEnv] invm_remote_env[procIsVmRemoteEnv] out (result:%s)[procIsOfflineMaster] in\|bldnum[procIsOfflineMaster] out (result:%s, strBldNum : %s)[CResponseASTx2::procIsNotSupportOS] ak=[%d], fw=[%d], pb=[%d], pcs=[%d]Description[CResponseASTx2::procIsNotSupportOS] QueryDWORDValue lRet=%d, dwDesc=0x%08x[CResponseASTx2::procIsNotSupportOS] %s127.0.0.10.0.0.0ASTX2application/javascript[handleTCPClientSSL] SSL is null
Source: V3Medic.exe, 00000006.00000003.1823374005.0000000003A24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .\StSdkSa_Mkd25.cpp[CStSdkSaMkd25::Initialize] module:(%s)[CStSdkSaMkd25::Initialize] GetProcAddress failed:(%s)[CStSdkSaMkd25::Initialize] LoadLibraryEx failed:(%s)[CStSdkSaMkd25::Uninitialize] called[CStSdkSaMkd25::GetObject8A] called[CStSdkSaMkd25::GetObject8W] called.\StSdkSa_Pb.cpp[IAstxSaPbImpl::Initialize] called[IAstxSaPbImpl::Initialize] Running on server OS[IAstxSaPbImpl::Uninitialize] calledIAstxSaPbImpl::StartA[IAstxSaPbImpl::StartA] AhnHS_Activate fail, dwError:(%x)[IAstxSaPbImpl::StartA] return (%x)stsess.exe;stsess32.exe;aupasd.exe;asdwsc.exe;asdup.exe;asdsvc.exe;asdcr.exe;asdcli.exe;akdve.exe;vmtoolsd.exe;sg_oathexe.exe;microsoftedgecp.exe;[IAstxSaPbImpl::StartA] Skip using [HSB] driver[IAstxSaPbImpl::StartA] AhnHS_Start success[IAstxSaPbImpl::StartA] AhnHS_Start fail, dwError:(%x)IAstxSaPbImpl::StartW[IAstxSaPbImpl::StartW] AhnHS_Activate fail, dwError:(%x)[IAstxSaPbImpl::StartW] return (%x)[IAstxSaPbImpl::StartW] Skip using [HSB] driver[IAstxSaPbImpl::StartW] success [IAstxSaPbImpl::StartW] AhnHS_Start fail, dwError:(%x)IAstxSaPbImpl::StopA[IAstxSaPbImpl::StopA] Skip using HSB driver[IAstxSaPbImpl::StopA] Success [IAstxSaPbImpl::StopA] Fail IAstxSaPbImpl::StopW[IAstxSaPbImpl::StopW] Skip using HSB driver[IAstxSaPbImpl::StopW] Success [IAstxSaPbImpl::StopW] Fail IAstxSaPbImpl::SetActivateSubFuncIAstxSaPbImpl::SetEventCallbackIAstxSaPbImpl::SetExOptionA[IAstxSaPbImpl::SetExOptionA] Skip using HSB driverexceptprocesspid[IAstxSaPbImpl::SetExOptionA] protectProcess Ins, ulOption:(%x)IAstxSaPbImpl::SetExOptionW[IAstxSaPbImpl::SetExOptionW] Skip using HSB driver[IAstxSaPbImpl::SetExOptionW] protectProcess Ins, ulOption:(%x)[IAstxSaPbImpl::IAstxSaPbImpl] Running on server OS[CStSdkSaPb::Uninitialize] called[CStSdkSaPb::StSdk_GetPbObject] calledL
Source: V3Medic.exe, 00000006.00000003.1848648986.0000000005D70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: serverteamviewervncWM_AKHOOK_SETSTATE\iphlpapi.dllGetExtendedTcpTablesetupapi.dllSetupDiGetClassDevsWSetupDiDestroyDeviceInfoListSetupDiEnumDeviceInfoSetupDiGetDeviceRegistryPropertyWvmicrdvQEMU-GA{4D36E967-E325-11CE-BFC1-08002BE10318}vmwarevboxvirtual hd ata devicewsnm.exeVMware View AgentSOFTWARE\Citrix\VirtualDesktopAgentCitrix\Virtual Desktop AgentWorkStationAgentWorkstationAgent.exebrokeragent.exectxsvchost.exepvsvmagent.exexenguestagent.exeParallels Tools Service%%%result\\.\pipe\session(%d)stsess[requestPIP] Connect failed(errno=%d,%s)[requestPIP] WriteAndBinRet failed(errno=%d,response=%d(%d),%s)rnd{v:%s,s:%s}{method:%d,salt:%d,stamp:%s}dataACKurlstampnorsa{method:%d,salt:%d,norsa:%d,stamp:%s}NCK[procCheckServer] result=%s,method=%dstepcert%dcert[procSetCert] result=%s,nstep=%d[procSetProtect] referer=%scustomeridakfwpbpcs[procSetProtect] customerid=[%s], ak=[%d], fw=[%d], pb=[%d], pcs=[%d][procSetProtect] customerid is invalidNSPfuncdynplycommand[procSetProtect] result=%sncert[procGetData] ncert=%d,norsa=%dcert1cert2pageid[procGetData] result=%s,pageid=%snlogoptbrowseripaddr[procGetPCLOGData] nlog=%d,norsa=%d,ipaddr=%s,browser=%s,opt=%s[procGetPCLOGData] useragent=%suseragent[procGetPCLOGData] result=%s(%.3fs)3stsvrsvr[procE2Estart] svr=%s,url=%s,useragent=%s, browser=%s,pageid=%sEGOTEG0hwnd[procE2Estart] response(%s)[procE2Estart] failed(%s)e2e_focuse2e_blur?[CResponseASTx2::getHost] AfxParseURL error(%d)https://%shttp://%s[CResponseASTx2::QueryToNzSessPipeServer] CPipeClient::CheckServer() failed. error=%d[CResponseASTx2::QueryToNzSessPipeServer] CPipeClient::Connect() failed. error=%d[CResponseASTx2::PostAIPScriptInfo] version=%s[CResponseASTx2::PostAIPScriptInfo] url=%s[CResponseASTx2::PostAIPScriptInfo] error=%d[CResponseASTx2::IsProtectedSite] %s, nIsProtectedSite=%d[CResponseASTx2::IsForgeryMonitorSite] %s, nIsScriptMonitorSite=%d[CResponseASTx2::IsForgeryScript] csUrl IsEmpty == true[CResponseASTx2::IsForgeryScript] csUrl=%s[CResponseASTx2::IsForgeryScript] csHost=%s[CResponseASTx2::IsForgeryScript] csObjectName=%s[CResponseASTx2::IsForgeryScript] false, %s[CResponseASTx2::IsForgeryScript] true, %s[procHello] csAgent=%s[procHello] csReferer=%s[procHello] csScriptUrl=%s[procHello] csScriptVer=%s[procHello] IsProtectedSite false - %sastx2.min.js[procHello] IsForgeryScript true - %snoenc[procE2EFormInit] ncert=%d,norsa=%d,noenc=%d[procE2EFormInit] result=%s,pageid=%s[CResponseASTx2::GetResponseData] failed SplitSubData %s/ASTX2/helloalivee2e_alivecheckset_certset_protectget_dataget_pclogis_vm_envis_remote_envis_vm_remote_enve2e_starte2e_inite2e_gettexte2e_settexte2e_cleare2e_stope2e_uninite2e_unloade2e_gethashe2e_forminite2e_formgetis_offline_masteris_not_support_oscallbacktry{%s(%s);}catch(e){}%s(%s)[getCurrentFocusWindowsHandleEdge] less-than WIN10(osver=%d)ApplicationFrameWindow[getCurrentFocusWindowsHandleEdge] pid=%d,hwnd=0x%08X,class=%s
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\Ahnlab\ASP\MyKeyDefense 2.5CheckDataFile nMode[%d] bRet[%d]IPTip_Main_WindowGetExtendedTcpTable\iphlpapi.dll\StringFileInfo\%04x%04x\%sCompanyName\VarFileInfo\TranslationWorkstationAgent.exeWorkStationAgentCitrix\Virtual Desktop AgentSOFTWARE\Citrix\VirtualDesktopAgentwinvnc.exevboxvmware{4D36E967-E325-11CE-BFC1-08002BE10318}QEMU-GASetupDiGetDeviceRegistryPropertyASetupDiEnumDeviceInfoSetupDiDestroyDeviceInfoListSetupDiGetClassDevsAsetupapi.dllProductModelManufacturerWQLSELECT * FROM Win32_BaseBoardROOT\CIMV2macappleCCheckEnv HasConflictingBoard=%d.CCheckEnv NotSupportOs=%d.CCheckEnv Remote=%d.IsVirtualMachine, dwType=%dLastPolicy@
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA
Source: V3Medic.exe, 00000006.00000003.1877125538.00000000067B2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .\StSdkSa_Mkd25.cpp[CStSdkSaMkd25::Initialize] module:(%s)[CStSdkSaMkd25::Initialize] GetProcAddress failed:(%s)[CStSdkSaMkd25::Initialize] LoadLibraryEx failed:(%s)[CStSdkSaMkd25::Uninitialize] called[CStSdkSaMkd25::GetObject8A] called[CStSdkSaMkd25::GetObject8W] called.\StSdkSa_Pb.cpp[IAstxSaPbImpl::Initialize] called[IAstxSaPbImpl::Initialize] Running on server OS[IAstxSaPbImpl::Uninitialize] calledIAstxSaPbImpl::StartA[IAstxSaPbImpl::StartA] AhnHS_Activate fail, dwError:(%x)[IAstxSaPbImpl::StartA] return (%x)stsess.exe;stsess32.exe;aupasd.exe;asdwsc.exe;asdup.exe;asdsvc.exe;asdcr.exe;asdcli.exe;akdve.exe;vmtoolsd.exe;sg_oathexe.exe;microsoftedgecp.exe;[IAstxSaPbImpl::StartA] Skip using [HSB] driver[IAstxSaPbImpl::StartA] AhnHS_Start success[IAstxSaPbImpl::StartA] AhnHS_Start fail, dwError:(%x)IAstxSaPbImpl::StartW[IAstxSaPbImpl::StartW] AhnHS_Activate fail, dwError:(%x)[IAstxSaPbImpl::StartW] return (%x)[IAstxSaPbImpl::StartW] Skip using [HSB] driver[IAstxSaPbImpl::StartW] success [IAstxSaPbImpl::StartW] AhnHS_Start fail, dwError:(%x)IAstxSaPbImpl::StopA[IAstxSaPbImpl::StopA] Skip using HSB driver[IAstxSaPbImpl::StopA] Success [IAstxSaPbImpl::StopA] Fail IAstxSaPbImpl::StopW[IAstxSaPbImpl::StopW] Skip using HSB driver[IAstxSaPbImpl::StopW] Success [IAstxSaPbImpl::StopW] Fail IAstxSaPbImpl::SetActivateSubFuncIAstxSaPbImpl::SetEventCallbackIAstxSaPbImpl::SetExOptionA[IAstxSaPbImpl::SetExOptionA] Skip using HSB driverexceptprocesspid[IAstxSaPbImpl::SetExOptionA] protectProcess Ins, ulOption:(%x)IAstxSaPbImpl::SetExOptionW[IAstxSaPbImpl::SetExOptionW] Skip using HSB driver[IAstxSaPbImpl::SetExOptionW] protectProcess Ins, ulOption:(%x)[IAstxSaPbImpl::IAstxSaPbImpl] Running on server OS[CStSdkSaPb::Uninitialize] called[CStSdkSaPb::StSdk_GetPbObject] called
Source: V3Medic.exe, 00000006.00000003.1778783611.0000000003A58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .\WinEventHook.cpp[CWinEventHook::Initialize] tid(%d) is recycled.[CWinEventHook::Initialze] hwnd=%x, pData->hHook=%08xhHook[CWinEventHook::Initialze] SetWinEventHook failed[CWinEventHook::Uninitialize] pData->m_hHook=%08x[CWinEventHook::Uninitialize] unhook failed, pData->m_hHook=%08x[CWinEventHook::WinEventProcFocus] ByPass, IsProhibited true[CWinEventHook::WinEventProcFocus] CLASS_IE_SHDOCVW ignored, role=%08x, hwnd=%08x[CWinEventHook::WinEventProcFocus] non-client, role=%08x, hwnd=%08x..\Common\ak_controller.cppm_hSession != NULLpByte16 != NULLpIV16 != NULL..\Common\ak_controller.cpppByte != NULLpIV != NULL%d.%d.%d.%d0.0.0.0[CController::Initialize] MKD2_CRACH_SKEY_CHKANDSTOP Success[CController::Initialize] MKD2_CRACH_SKEY_CHKANDSTOP Error [0x%08x][CController::Terminate] Mkd2Ctl_Terminate() fail.(0x%08x)[CController::PsPageInInit] Mkd2Ctl_PsPageInInit() fail.(0x%08x)[CController::PsPageInInit] Changed to unprotected mode[CController::PsPageInInit] Mkd2Ctl_AddFilterMode, dwResult=%d[CController::PsPageOutCleanUp] Mkd2Ctl_PsPageOutCleanUp() fail.(0x%08x)[CController::SetRule] Mkd2Ctl_Set_Rule_Version(%ld)dwError == 0[CController::SetRule] Mkd2Ctl_Set_Rule_Version(RULE_MKD20) error(0x%08x)[CController::SetRule] Mkd2Ctl_Set_Rule_Version(RULE_MKD26) error(0x%08x)[CController::SetRule] Mkd2Ctl_Set_Rule_Version(RULE_MKD25) error(0x%08x)[CController::GetKeyActionTable] Mkd2Ctl_Get_Rule_VersionEx error=%d[CController::SetKeyActionTable] GetKeyActionTable error(0x%08x)[CController::SetKeyActionTable] Mkd2Ctl_Set_Rule_VersionEx(%ld)[CController::SetKeyActionTable] Mkd2Ctl_Set_Rule_VersionEx(%ld) error(0x%08x)[CController::SetAkCtlLogPath] log skipAkCtl.log[CController::SetAkCtlLogPath] Mkd2Ctl_StartSecureLogAndSetPath szLogPath[%s][CController::SetAkCtlLogPath] Mkd2Ctl_StartSecureLogAndSetPath Failed[0x%08x][CController::PreInitialize] IsVirtualMachine, dwVMType=%x[CController::PreInitialize] Running on server OS. Skip using AK driver
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [CDriverLoaderForVista::SetDriverParam] lRet=%d, dwParam=%x, dwInstallDate=%xParam1SYSTEM\CurrentControlSet\Services\Mkd2KfNtSYSTEM\CurrentControlSet\Services\Mkd3KfNtInstallDateSOFTWARE\Microsoft\Windows NT\CurrentVersion[CDriverLoaderForVista::UnSetDriverParam] lRet=%dvboxvmware{4D36E967-E325-11CE-BFC1-08002BE10318}QEMU-GASetupDiGetDeviceRegistryPropertyASetupDiEnumDeviceInfoSetupDiDestroyDeviceInfoListSetupDiGetClassDevsAsetupapi.dll
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine, dwType=%d
Source: V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware View Agentwsnm.exexenguestagent.exepvsvmagent.exectxsvchost.exebrokeragent.exe
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware View Agentwsnm.exexenguestagent.exepvsvmagent.exectxsvchost.exebrokeragent.exeP
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_UnloadDriver failed[0x%08x][CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_UnloadDriver leave.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_UnloadDriver enter.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_LoadDriver failed[0x%08x][CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_LoadDriver bypass.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_LoadDriver leave.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_LoadDriver enter.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_RegisterDriver failed[0x%08x][CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_RegisterDriver leave.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_RegisterDriver enter.[CDriverLoaderForVista::DriverCtrlThreadProc] Mkd2Ctl_StartSecureLogAndSetPath failed[0x%08x][CDriverLoaderForVista::DriverCtrlThreadProc] IsVirtualMachine, dwVMType=%d[CDriverLoaderForVista::CreateDriverCtrlThread] WaitLoop failed. (0x%x)[CDriverLoaderForVista::CreateDriverCtrlThread] WaitLoop leave.[CDriverLoaderForVista::CreateDriverCtrlThread] WaitLoop enter.[CDriverLoaderForVista::CreateDriverCtrlThread] _beginthreadex failed. %d[CDriverLoaderForVista::LoadDriver] already loaded.[CDriverLoaderForVista::LoadDriver] called.[CDriverLoaderForVista::UnloadDriver] not loaded.[CDriverLoaderForVista::UnloadDriver] called.
Source: V3Medic.exe, 00000006.00000003.1983606470.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [CDriverLoaderForVista::DriverCtrlThreadProc] IsVirtualMachine, dwVMType=%d

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100FB0BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_100FB0BA

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\astx_setup.exe

0_2_101101FA

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100151A4 lstrcmpiW,AllocateAndInitializeSid,GetLastError,HeapAlloc,LookupAccountNameW,GetLastError,GetProcessHeap,HeapAlloc,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,GetLastError,GetFileSecurityW,GetLastError,GetProcessHeap,HeapAlloc,GetFileSecurityW,GetLastError,InitializeSecurityDescriptor,GetLastError,GetSecurityDescriptorDacl,GetLastError,GetAclInformation,GetLastError,GetLengthSid,GetProcessHeap,HeapAlloc,InitializeAcl,GetLastError,GetLastError,GetAce,GetLastError,EqualSid,AddAce,GetLastError,AddAccessAllowedAce,GetLastError,GetAce,GetAce,GetLastError,AddAce,GetLastError,SetSecurityDescriptorDacl,GetLastError,GetModuleHandleW,GetProcAddress,GetSecurityDescriptorControl,GetLastError,GetLastError,SetFileSecurityW,GetLastError,

0_2_100151A4

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FB0BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_100FB0BA
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_100FD98A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_100FD98A
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: 0_2_1010FF2F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	0_2_1010FF2F

HIPS / PFW / Operating System Protection Evasion

Found driver which could be used to inject code into processes

Source: medvpdrv.sys.6.dr	Static PE information: Found potential injection code
Source: medvpdrv.sys0.6.dr	Static PE information: Found potential injection code

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\astx_setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C "ECHO Y\| cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe	Jump to behavior

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100FA845 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,_memset,GetVersionExW,CreateMutexW,CreateMutexW,CreateMutexW,GetCurrentProcessId,

0_2_100FA845

Source: C:\Users\user\Desktop\astx_setup.exe

0_2_100151A4

Source: V3Medic.exe, 00000006.00000003.2279453834.00000000067A9000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: .\FunctionHook.cpp[HookFunction] Fatal error : Can't add FunctionHookInfo.\FunctionHook.cpp[HookFunction] Can't Hook the %S %p.\FunctionHook.cpp[HookFunction] Can't find the %S's address.\FunctionHook.cpp[HookFunction] Can't get the %S's address.\FunctionHook.cpp[HookFunction] Can't load the %S.\FunctionHook.cpp[FH_FindCodePattern] exception, Failed to find patternuser32.dllUserClientDllInitializeuser32.dllUserClientDllInitializeuser32.dllUserClientDllInitializeuser32.dllUserClientDllInitializeuser32.dllUserClientDllInitializeuser32.dllUserClientDllInitializeRtlRetrieveNtUserPfnntdll.dllRtlRetrieveNtUserPfnntdll.dllNtQueryInformationProcessntdll.dllNtQueryInformationProcessntdll.dll%02X.\GlobalHookProtect.cppAtsVerifyExternalFile(CAT) - file=[%s], result=[0x%08X].\GlobalHookProtect.cpp[AhnLabSignatureCheckFunc] ptszSourceFile is NULL.\GlobalHookProtect.cppAtsVerifyInternalFile() - file=[%s], result=[0x%08X].\GlobalHookProtect.cpp[AhnClientLoadLibrary] PROTECT >> %sATamptU.dll.\GlobalHookProtect.cpp[AhnClientLoadLibrary] Exception !!ATamptU.dllATamptU.dllATamptU.dllATamptU.dllATamptU.dlluser32.dllgSharedInfo.\GlobalHookProtect.cpp[GlobalHookProtect_Initialize] Find_pfnClient Failed.\GlobalHookProtect.cpp[GlobalHookProtect_Initialize] FH_HookFunction Failed.\GlobalHookProtect.cpp[GlobalHookProtect_Initialize] GetModuleHandleW Failed.\GlobalHookProtect.cpp[GlobalHookProtect_Initialize] Initialize.\GlobalHookProtect.cpp[GlobalHookProtect_Finalize] Finalize.\GlobalHookProtect.cpp[GlobalHookProtect_Start] Start.\GlobalHookProtect.cpp[GlobalHookProtect_Stop] Stopuser32.dllUserClientDllInitializeuser32.dllPeekMessageAuser32.dllPeekMessageWuser32.dllGetMessageAuser32.dllGetMessageWuser32.dllSendMessageAuser32.dllSendMessageWuser32.dllPostMessageAuser32.dllPostMessageWuser32.dllDispatchMessageAuser32.dllDispatchMessageWuser32.dllPostQuitMessageShell_TrayWndDV2ControlHostTaskListThumbnailWndWindows.UI.Core.CoreWindow

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\astx_setup.exe	Code function: GetLocaleInfoA,		0_2_10111771
Source: C:\Users\user\Desktop\astx_setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		0_2_1000C1D0

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1010B0DB GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_1010B0DB

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_1010BB2E __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_1010BB2E

Source: C:\Users\user\Desktop\astx_setup.exe

Code function: 0_2_100FA845 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,_memset,GetVersionExW,CreateMutexW,CreateMutexW,CreateMutexW,GetCurrentProcessId,

0_2_100FA845

Source: C:\Users\user\Desktop\astx_setup.exe

0_2_100151A4

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	12 Service Execution	1 Valid Accounts	1 Valid Accounts	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	22 Windows Service	11 Access Token Manipulation	2 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	1 Services File Permissions Weakness	22 Windows Service	1 DLL Side-Loading	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	112 Process Injection	22 Masquerading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Services File Permissions Weakness	1 Valid Accounts	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Access Token Manipulation	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
astx_setup.exe	2%	ReversingLabs
astx_setup.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ALWFCtrl.Dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.sys	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDCr.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDSvc.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDUp.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ASDi.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ATampt.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\ATamptNt.sys	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AhnCtlKD.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AhnI2.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Ark64.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Ark64lgplv2.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AtamptU.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\AupASD.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Av.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\BtScnCtl.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\CdmAPI.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\CdmCtrl.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe	2%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Core.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\HsbCtl.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\IAccessible2Proxy.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90CHS.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90CHT.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90DEU.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90ENU.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90ESN.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90ESP.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90FRA.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90ITA.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90JPN.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MFC90KOR.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcp90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcr90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\libcrypto-1_1-x64.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\AhnI2.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\HsbCtl32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\IAccessible2Proxy32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ENU.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\NzBrcom32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\NzInst32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\ScrMon32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\StCtl32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\StSdk32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\StSess32.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\aostrust32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\libacm.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\mfc90u.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcp90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcr90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\Nz32\powapi32.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\NzBrcom.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\NzInst.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\NzPlugin.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\PdCfg.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SCTX.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\msvcr90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd2564.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25def64.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25sdk64.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\msvcr90.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StCli.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StCtInst.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StCtl.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StSdk.dll	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StSess.exe	0%	ReversingLabs
C:\Program Files\AhnLab\Safe Transaction\StSvr.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.3.V3Medic.exe.5b54600.7.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
6.3.V3Medic.exe.5ab0000.5.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
6.3.V3Medic.exe.6065a80.14.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
webclinic.ahnlab.com.cdngc.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.sk.ee/cps/0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	URL Reputation	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
http://www.disig.sk/ca0f	0%	URL Reputation	safe
http://www.sk.ee/juur/crl/0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.trustdst.com/certificates/policy/ACES-index.html0	0%	URL Reputation	safe
http://www.firmaprofesional.com0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
https://www.netlock.net/docs	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://sourceforge.jp/projects/lha/	0%	Avira URL Cloud	safe
http://www.valicert.com/1	0%	URL Reputation	safe
http://www.aescrypt.com/	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://javascript.nwbox.com/IEContentLoaded/)	0%	Avira URL Cloud	safe
http://www.phreedom.org/md5)MD5	0%	Avira URL Cloud	safe
http://www.phreedom.org/md5)	0%	Avira URL Cloud	safe
http://broofa.com/	0%	Avira URL Cloud	safe
http://sourceforge.jp/projects/lha/	0%	Virustotal		Browse
http://www.phreedom.org/md5)0	0%	Avira URL Cloud	safe
http://gladman.plushost.co.uk/oldsite/AES/index.php	0%	Avira URL Cloud	safe
http://%1/CertEnroll/%1_%3%4.crtfile://	0%	Avira URL Cloud	safe
http://www.phreedom.org/md5)	1%	Virustotal		Browse
http://www.aarongifford.com/	0%	Avira URL Cloud	safe
http://%1/CertEnroll/%3%8%9.crlfile://	0%	Avira URL Cloud	safe
http://wakaba.c3.cx/s/apps/unarchiver.html	0%	Avira URL Cloud	safe
http://www.bzip.org/downloads.html	0%	Avira URL Cloud	safe
https://seed.kisa.or.kr/iwt/ko/sup/EgovLeaInfo.do	0%	Avira URL Cloud	safe
https://%1/CertEnroll/nsrev_%3.aspldap:///CN=%7%8	0%	Avira URL Cloud	safe
http://www.winace.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webclinic.ahnlab.com.cdngc.net	101.79.212.66	true	false	0%, Virustotal, Browse	unknown
gms.wip.ahnlab.com	34.249.110.217	true	false		high
webclinic.ahnlab.com	unknown	unknown	false		high
gms.ahnlab.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gactivation.ahnlab.com/api/auth/v1/activate/relay	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certifikat.dk/repository0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.compression.ru/ds/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.info-zip.org/pub/infozip/license.html.	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jp.ahnlab.com/site/support/qna/qnaAddForm2.do;	V3Medic.exe, 00000006.00000003.1486462149.0000000000611000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mgactivation.ahnlab.com/api/auth/v1/activate/client	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.phreedom.org/md5)MD5	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sourceforge.net/p/infozip/patches/18/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://yuilibrary.com/license/	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sk.ee/cps/0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sourceforge.jp/projects/lha/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://json.org/).	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://mgactivation.ahnlab.com/api/auth/v1/activate/relay	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.pki.gva.es0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.phreedom.org/md5)	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.oces.certifikat.dk/oces.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/necolas/normalize.css/	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.certicamara.com/dpc/0Z	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.pki.wellsfargo.com/wsprca.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mgactivation.ahnlab.com/api/auth/v1/activate/relayhttps://mgactivation.ahnlab.com/api/auth/v	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://javascript.nwbox.com/IEContentLoaded/)	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.aescrypt.com/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	astx_setup.exe	false		high
http://broofa.com/	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://acedicom.edicomgroup.com/doc0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mathiasbynens.be/	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.rarlab.com/rar_add.htm	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
https://code.bandisoft.com/	V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gactivation.ahnlab.com/api/auth/v1/healthcheck	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://opensource.ahnlab.com	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.entrust.net/CRL/net1.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://site.icu-project.org/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.catcert.net/verarrel	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.disig.sk/ca0f	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.e-szigno.hu/RootCA.crl	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.sk.ee/juur/crl/0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.chambersign.org/chambersignroot.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.7-zip.org/sdk.html	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/wycats/handlebars.js	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.trustdst.com/certificates/policy/ACES-index.html0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.firmaprofesional.com0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/)	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.pkioverheid.nl/policies/root-policy-G20	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mgactivation.ahnlab.com/api/auth/v1/healthcheck	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.netlock.net/docs	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.phreedom.org/md5)0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gladman.plushost.co.uk/oldsite/AES/index.php	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%1/CertEnroll/%1_%3%4.crtfile://	V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.aarongifford.com/	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	V3Medic.exe, 00000006.00000003.2143577905.0000000006AB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://%1/CertEnroll/%3%8%9.crlfile://	V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://wakaba.c3.cx/s/apps/unarchiver.html	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tss-geotrust-crl.thawte.com/ThawteTimestampingCA.crl0	V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://code.bandisoft.com	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/MPL/2.0/.	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.bzip.org/downloads.html	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://download.ahnlab.com/down/ahnreport/AhnRpt.exe	V3Medic.exe, 00000006.00000003.1378099121.0000000003240000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	V3Medic.exe, 00000006.00000003.1420382575.0000000004040000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2201964543.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1997387941.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1759759379.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1885537209.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1963764220.0000000000629000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1929338565.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1856686596.000000000608F000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2270494586.0000000006597000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1758039315.0000000000627000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.2210361972.000000000062D000.00000004.00000020.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1855415087.0000000006012000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.e-szigno.hu/RootCA.crt0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ncompress.sourceforge.net/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.wavpack.com/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
https://seed.kisa.or.kr/iwt/ko/sup/EgovLeaInfo.do	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valicert.com/1	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp, V3Medic.exe, 00000006.00000003.1577088768.0000000000620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gactivation.ahnlab.com/api/auth/v1/activate/client	V3Medic.exe, 00000006.00000003.2127012435.000000000389C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.e-szigno.hu/SZSZ/0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://%1/CertEnroll/nsrev_%3.aspldap:///CN=%7%8	V3Medic.exe, 00000006.00000003.1591414722.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://github.com/wycats/handlebars.js)	V3Medic.exe, 00000006.00000003.1527249058.0000000005AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.winace.com/	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersignroot.html0	V3Medic.exe, 00000006.00000003.1599622384.0000000005F9C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mattmahoney.net/dc/zpaq.html	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.zlib.net/zlib_license.html	V3Medic.exe, 00000006.00000003.2056642457.0000000005AB1000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	755221
Start date and time:	2022-11-28 13:40:01 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	astx_setup.exe
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus34.rans.troj.evad.winEXE@16/713@3/0
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, usocoreworker.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, login.live.com, ctldl.windowsupdate.com
Execution Graph export aborted for target V3Medic.exe, PID 6624 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
gms.wip.ahnlab.com	erver.exe	Get hash	malicious	Browse	211.115.106.210
	http://caferaa.com/	Get hash	malicious	Browse	211.115.106.73
	2.exe	Get hash	malicious	Browse	34.249.110.217
	ype7NXxUaT.exe	Get hash	malicious	Browse	34.246.64.247

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL	astx_setup.exe	Get hash	malicious	Browse
C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE	astx_setup.exe	Get hash	malicious	Browse
C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS	astx_setup.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110904
Entropy (8bit):	5.727949815668744
Encrypted:	false
SSDEEP:	3072:h9eJxJSRE87TODAFI7c2Hnye0JoWV/cw/L:brRE87K0F4jYoWpx
MD5:	ED19F652BB5A53BA04EFEDD277808D44
SHA1:	27C2C3F47048557E8241B86F9A41FF87CA496BB1
SHA-256:	03E94DBCC74E14927EB77361C98513464CD36797E2C99A47EAD5ACD2F270697C
SHA-512:	BC2902186FB7F6AE4225FADF8DE4EF170C5078CE77AF701080752A52B07E68926AFABA68B7145B3063D0AAF5320953E8782B8BC19C3668B5A8EA34C2DB51F730
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: astx_setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4..4..4..BL.3..BL.6..BL.?..4..O..BL.'..BL..5..BL.5..BL..5..Rich4..................PE..d.....Mb.........." .....2...........=..............................................]4......................................................X...x....p.......`..........8#......l....T...............................................P...............................text...^0.......2.................. ..`.rdata...@...P...B...6..............@..@.data...0............x..............@....pdata.......`.......z..............@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76744
Entropy (8bit):	6.278803320665906
Encrypted:	false
SSDEEP:	1536:z/AIFd4bP9qNlbMLoGGRnNFzp47dal4MW:z/9d4L9Q2LoGWbiIaz
MD5:	6DAEEDE536374A5A1106D140EB39E36B
SHA1:	00CD82052C3FFE6E8CC59488FDFA34FA21B65334
SHA-256:	E51FC1DC8FEEBF82F2A197E88001787986239A29B984A24BF9B7C74C8C2D7248
SHA-512:	AF74D2FBA0E2657DED5873F5EF9FC2384ED98774530F7478848076AD902ABFC66C151A402A9D263FD8B8B1CE22EA70439E7B0E54750BD5F57DE2FB6FF19D6F64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: astx_setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."<..f]..f]..f]..f]..;]......e]......d]......c]......h]....d.g]......g]..Richf]..........PE..d......b.........."..........&.................@.............................0....../.....`.....................................................(........................O... ..8.......8............................................................................text.............................. ..h.rdata..T...........................@..H.data...p...........................@....pdata..............................@..H.gfids..............................@..HINIT....\|........................... ..b.rsrc...............................@..B.reloc..8.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark32.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "Ark32.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11028
Entropy (8bit):	7.623917073492213
Encrypted:	false
SSDEEP:	192:ZgvhIYiYF82M34qFIwUtmWJfsHR9y2sE9jBFL2UzZQHn4M:Zg5IYitvUtm4i/8E9VFL2UtQH4M
MD5:	727F84AF01A30962FE25ECE73B37814D
SHA1:	01A8AA51443BEA3424FCC6EEDACBD1031EFB8E13
SHA-256:	BF5E2C43BBF220809EF7FEAA96DA5AFEA2A15B4845005E569260D4B3C913CB7B
SHA-512:	9EB0628AA88D91C8CA7B01FAE619355ED38B4B7A952539865ADA5D20A1B91874DEF396D16BD8C95109D13BBB40AC7999D240C37C4786CFE89796E80070600A3D
Malicious:	false
Preview:	MSCF............D...............................h..........b.......B..........T.m`.Ark32.dll.ahf..[<.B.B.2,2ABE06494F086D08F1B589DA910374C770089728B32EE339ADE57456A74F08B10.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... oy.9\..f_..Ac.....g.<..i...;..t.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8......

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark32lgplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 178 bytes, 1 file, at 0x44 +AX "Ark32lgplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	7.629657496141642
Encrypted:	false
SSDEEP:	192:1FIYiYF82M34qFIwzKJalQWJfsHR9y2sE9jBFL2UzZE4si:1FIYitvzKJalQ4i/8E9VFL2UtE+
MD5:	576669DA46F870202AAF654901A676AF
SHA1:	E06726A8432D53D0C093C8AB956D0C777E196C1C
SHA-256:	C122C70BF9CF551C59DF532D852DDB752E51ACBFBEE92DE9B72C5F400115F6AF
SHA-512:	14ADA27D5A70ACE63FC6E9B4DFAD15AE7B7BD540F800962331BC97D8A225C4C4498FAC6E782BE24B6A8E057ADE985EA194F6BAB5818CDC6960FEA0BC9777EB5A
Malicious:	false
Preview:	MSCF............D...............................h..........h.......B..........T.m`.Ark32lgplv2.dll.ahf..(HqB.B.2,858021E41BD9E1745E03734747EA69AC814A0E28F7021405E680FCAF8D5308070.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .N,......R.........5.1....%..u.010...`.H.e....... ...s..-@VD.`..}..5..G.k &.@.%..\|....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "Ark64.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11028
Entropy (8bit):	7.624446104806095
Encrypted:	false
SSDEEP:	192:07IYiYF82M34qFIwl7LaLWJfsHR9y2sE9jBFL2UzZEi:07IYitvl7+L4i/8E9VFL2UtEi
MD5:	7316D2E214A0FD1F5D92AC078A42E266
SHA1:	36C89819F48F4189323A9D4737B28C4F35D9CD3C
SHA-256:	4EA96C4A3137365CE507D7D89C690ACF6B1DC97FD92A102128A80FC45512AE09
SHA-512:	712F097902573F80066313BB025C59AB1B2BEA6CCE42B55315F5162BB104FB92E2ECCC7F23C227504782037D45D11EB421D1FF150B5E3EBC361E1E02A3E79553
Malicious:	false
Preview:	MSCF............D...............................h..........b.......B..........T.m`.Ark64.dll.ahf.~YG.B.B.2,CE5F64E3308E8AAFB8FA3DC77652949EE0E1F40FCB6133CFB0AC63D1B934A3D80.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... .(..9U.0..e.....Jn.32.!....f.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8......

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64a.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 173 bytes, 1 file, at 0x44 +AX "Ark64a.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11037
Entropy (8bit):	7.622721528183033
Encrypted:	false
SSDEEP:	192:ujPIYiYF82M34qFIkeuLJ0gaOWJfsHR9y2sE9jBFL2UzZsRn:ubIYitvNLF4i/8E9VFL2UtsR
MD5:	C89A3327D1023B1046DADB9EF38A9CC4
SHA1:	98DABA53F58F0E2690F9668693A55404F629A1EF
SHA-256:	B4ED00F58E44BC656FB90A29DB71B563728ADD5166014DAA883C2B8CDC5DCAE1
SHA-512:	513CE80768E457EC4978D49EE998AFB0199A2582CB64748466DDA16592B72BCD7CA41FA3C6B0AF959B89B93ED9AFD350505C7857CD02CAB3FE446D132CFE9FC1
Malicious:	false
Preview:	MSCF............D...............................p..........c.......B..........T.m`.Ark64a.dll.ahf..YE.B.B.2,4EE688FFA25A96387C68745D010D10E4BEECBB3027BC3285B484EFCA0124DC4C0.e...H........V0.R...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". %yn..M%Yu.W..8..]t.EZK.....u.\010...`.H.e....... ..."....R.%.s'O......tL...3..Q......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.....

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64algplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 179 bytes, 1 file, at 0x44 +AX "Ark64algplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11035
Entropy (8bit):	7.627543987594771
Encrypted:	false
SSDEEP:	192:B1+IYiYF82M34qFIwFbrEw8WJfsHR9y2sE9jBFL2UzZAee2:B1+IYitvFHB84i/8E9VFL2UtAee2
MD5:	1D2B7AB2A3BEB4160DAA0203D6407FC9
SHA1:	B0EA2F1986C485AE390F58C08B4740D96EE02512
SHA-256:	E7DD82367FF8A66570EAB691EAFEBCB5FA4C175A390315B5517E948F79F806B5
SHA-512:	760D5BD9198089AEE5A54AC26FCC579D6AB688ED9A4C260FBB2C88781932029C4E7E986C68198C692AC320A07F74EC2EDE03B18B7295C38834753CE01E5160AB
Malicious:	false
Preview:	MSCF............D...............................h..........i.......B..........T.m`.Ark64algplv2.dll.ahf.}W6.B.B.2,8A89C31218BCDFDA742BCF489D2E51DA0392E941FFF1E331D99B5DB718B847B30.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...M.X\|../f..6.8.!...hH....T..b010...`.H.e....... ..JA..@....].I....U...t.T....:2.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64lgplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 178 bytes, 1 file, at 0x44 +AX "Ark64lgplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	7.620996950141226
Encrypted:	false
SSDEEP:	192:wNIYiYF82M34qFIwp69sWJfsHR9y2sE9jBFL2UzZhMX9G/:wNIYitvp69s4i/8E9VFL2UthMtw
MD5:	BC626499AF7D3F09723B76BB27304C1D
SHA1:	AABD8E8FA72A6EB2864F0107E2B12433FAF4B71B
SHA-256:	38D2E303FE97AE694F9C993736DB5B791CB523F81C095B475889022832C727EC
SHA-512:	B3036E353118D9FF15B7BCEDD2C6BBC2F0A59CC69536D623F0ACC53222D755627BC4AC111E697BC58A11030C3D792A3D0C42857156D117E38BCF95179322C332
Malicious:	false
Preview:	MSCF............D...............................h..........h.......B..........T.m`.Ark64lgplv2.dll.ahf.yWG.B.B.2,B058BB04AD2695FDED14F06CD800D686B047C605F824287ADD2BD4EC36C18F3B0.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .N,......R.........5.1....%..u.010...`.H.e....... ..-.\|.<......^....&{..ki...Z4.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.

C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcp90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.630453563750433
Encrypted:	false
SSDEEP:	192:6IYiYF82M34qFIIauV+noPOJB3hy2sE9jBF0NyPIjwlKpE:6IYitv6jPxh8E9VF0NyP+YKu
MD5:	7477778473856EF6AB1A747658FFA704
SHA1:	CEF501CE9BB0948B91EF33D999C5221D432D8F24
SHA-256:	06D2088C3C3D4D31ADED1B7E98398869F36D12235072B3308184A65177104FCC
SHA-512:	A8BDE84DB21C5CF033807B7E9E20B2934C058C02DDFA707D42849BD9CBAAEA3E485934B8ED45063A58145B2022623533938FA9C54F571440F0E96CD09CC04B25
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcp90.dll.ahf..V[...3,671F007C30C1C0D2D847465AD3FF72A2649825F90.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... l..,$/.I."5...wSph2q.a....4.F\|I....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcr90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.636438381503087
Encrypted:	false
SSDEEP:	192:nIYiYF82M34qFI2PO9BT8+noPOJB3hy2sE9jBF0NyAelnivhka1:nIYitv7W9BThPxh8E9VF0NyAGn+hka1
MD5:	5A5824134E91A727AB73ABF5F50DC440
SHA1:	D125B71DF4EA4C4861D104DECF2A2ACDDCF123E5
SHA-256:	35E8F87634978ECF6EBEB7C4D380936E757A1B1843464AFE4D093C84C8A41580
SHA-512:	490D645983D9087F295E74E68B0FBFB1258500FAF39E0739B18116601E0326E824657B581E0DD88B05172D57EAB53F58DAF98FEBA1A5E2DA4E614785E1C33D45
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcr90.dll.ahf.jQ ...3,553D6AAE83B2593DB866C7F9EF34A96187F6906C0.G...H........80.4...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ......%..Vw....7kh.%pQg;E..R.......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcp90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.638792345823077
Encrypted:	false
SSDEEP:	192:wIYiYF82M34qFIIGEyWE+noPOJB3hy2sE9jBF0NyYjl8kr:wIYitvmE5Pxh8E9VF0NyYpRr
MD5:	E7244F5137B83C216A283DF04AAF8C6F
SHA1:	3252CA7EE9F2E148B644C856A737D32EC8FAC5CD
SHA-256:	4AFD857285741CD8662635011FECC610BF93449F9BB4D2AE8B46E505E0FF8A88
SHA-512:	100192C77B0ACC798C31DFD9A1CCFC001E476260C2F7868BED405F4AF199D104133655881CD5BAA47F2513BEE23EFC3D0D3B1EB0EBFBD4825A47823E344B9007
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcp90.dll.ahf.k$,}..3,8D36B383C7BC9186E18F59D6019FBF6865BB2F420.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ..Y..4.....:{.<f.[J...L.-s....k'....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcr90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.62718970276648
Encrypted:	false
SSDEEP:	192:IJHIYiYF82M34qFI2P8kLP+noPOJB3hy2sE9jBF0NynXl6FLG:IVIYitv7kkLGPxh8E9VF0NynV6hG
MD5:	3EEDBECC41F04E495F3DF817F0161CF0
SHA1:	A4F7FD7656092B530F9A87AF37BB9AC5FE833643
SHA-256:	1507D929CE32200392EEE068FA9DE591707D62FED06ED483E4BB9F1BF062CE87
SHA-512:	8AADCAFFD5F07647DEC67D909193B49BAA38E9F35783AD30623CE43F8B0E7D2B6948E70C6A609B2C9B638D0FD44CB46FE89DB80165C2C21D9721E03BDDEF06C6
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcr90.dll.ahf.c]T...3,12AA00E9B45760E2DB8F9DDB0F6924CE6C7AB4500.G...H........80.4...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ...'..3 p...lUa.....\|....8]......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Program Files\AhnLab\Safe Transaction\AHC\asdf.sld.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 171 bytes, 1 file, at 0x44 +AX "asdf.sld.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	15811
Entropy (8bit):	7.4572255711379585
Encrypted:	false
SSDEEP:	384:y4y7wa+pY0RFXRKOBxQUeyt/p23+r/jLVY:hyU1fDBzRp23+zja
MD5:	59402821A9760D1789FDD15DE3E0EEAC
SHA1:	8EBDA649BBC7E258DBA0515E09B6799276AAB20F
SHA-256:	E97B7598A62230BA2543169A107410775BABD83602F6AB13D384487427D7B7B1
SHA-512:	C1334EAFA8204D61650D958FB7876DDF785514FD51E5D82E97106EA213AEB9B38A0369A05AFF57B3EEA964639748DD6C8943F751C713B5D94565290D8C0752BE
Malicious:	false
Preview:	MSCF............D................................=..........a.......B..........Q.u`.asdf.sld.ahf..&K.B.B.2,C06138DD09D44A59EFCC8C603310E7A26A0761E6FD5C5DEB1C52C06ECF0F402B0.=....H........=.0.<....1.0...+......0...+.....7....q0o0J..+.....7....<.......$f.....`..(1&0$..+.....7...1...\|$#..{L..H..{.ka....0!0...+........K..RX..........M.....O0...0................/N.R.0....H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...110413100000Z..280128120000Z0R1.0...U....BE1.0...U....GlobalSign nv-sa1(0&..U....GlobalSign Timestamping CA - G20.."0...*.H.............0..........e..W..S.4.....G.j..[..'.4.........Anf....dZF/...w..\.".jg...t.O..R.[.G.....e>..0Erm9..6....O....1.a..b.@..................Yxw...RkP.)....e.`a"...2..Q....0...........l.z....b'_o.m8t.......L...}J&..V....S.t...h.`.. .....t..).b.G...S....;.p~.%........0..0...U...........0...U.......0.......0...U......F.>.........j....0G..U. .@0>0<..U. .0402..+........&https://w

C:\Program Files\AhnLab\Safe Transaction\AHC\asdsr.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "asdsr.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	8188
Entropy (8bit):	7.318627564911616
Encrypted:	false
SSDEEP:	96:/5B9Y+YZTY/9Zvc3FUNBdtH2QLqY2DsQtPuohMVHpYn2GWmoTWYu3JUfhdyEi7Z+:OLZscF8Bd1LLvCs1iYH+2zmqWBZH7uD3
MD5:	3432003637F74064E8C0AEB34B583D93
SHA1:	17CD3FEC9BDFF1F4635F9349ADA7A9FC4D40B3D7
SHA-256:	783BF091384FB7217F4D7163757E26771685A90BBE9A152F97961C186243F844
SHA-512:	88EAEE5AC4424729A23358BCC22E40398F84B09C3DDE16E78117FFF9C9D9DA7031C03AE7B4FE06BB0EC1209F9002A9AADDE073DB6D4E574073A581C71BD5ECD6
Malicious:	false
Preview:	MSCF............D...............................P...........b.......B.........T.{`.asdsr.dat.ahf.._3xB.B.2,6F6AA9AAE8006DD2B9767E1AE311A171F5423EEDF7B6BA60B418532F7AD95E110..I...H.........:0..6...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... ...\|V....-..040...p /%#...`.........0...0............._:....x...G\0....H........0l1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1+0)..U..."DigiCert High Assurance EV Root CA0...120418120000Z..270418120000Z0l1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1+0)..U..."DigiCert EV Code Signing CA (SHA2)0.."0....H.............0.........S......d.....5...,..,..:5.:...W..../.H<..n.".Qya.C/....I1.DX>.....O#~.le$.U>..#\|.B..zbE.}.ct.c%.....EO.}....u..........>.E.z..X.64.+.+1Xf.2....R...>.v.@Z..j=.K.v..\.6...0.L...*XA......... "v.^T8.b..p$...p.d..-....!.l...{.P...6.\..J...9y..=:.%........X0..T0...U.......0.......0

C:\Program Files\AhnLab\Safe Transaction\AHC\ckwcfg.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 173 bytes, 1 file, at 0x44 +AX "ckwcfg.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10973
Entropy (8bit):	7.633731182014498
Encrypted:	false
SSDEEP:	192:Y1NIYiYF82M34qFIorR/WJfsHR9y2sE9jBF0Nyme4/UeBsqsz:Y7IYitvDx4i/8E9VF0NymNe7
MD5:	CDC7A449223FAF260A7B0B097EA3CCBE
SHA1:	58AC6CE0B0F96AE17D1416FB66F9FD798965D431
SHA-256:	057A96FD975F0D59915BAEA184586D3913EEF2E298449100096A232A08D57B63
SHA-512:	1F64CA3E452A1FC2D216B292BCFF66B86185A5088A8B83DA040477678C5E4302D403E39B59AF3D9B2C1606D721D8F15FE4FC504FCA4B0A8F5BA0B55FE3E2F3F8
Malicious:	false
Preview:	MSCF............D...............................0..........c.......B..........U..`.ckwcfg.dat.ahf.~&=qB.B.2,84362862A9E8E036D773D7F52EBF54E5E26B184A28AC2977A7B4A8FDA08FC14C0....H.........0.....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". %yn..M%Yu.W..8..]t.EZK.....u.\010...`.H.e....... q......(.6..2..+~(...D.U k..zb....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.....

C:\Program Files\AhnLab\Safe Transaction\AHC\drvinfo.ini.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 174 bytes, 1 file, at 0x44 +AX "drvinfo.ini.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10974
Entropy (8bit):	7.628058048904563
Encrypted:	false
SSDEEP:	192:aIYiYF82M34qFIoT+gD+NiWJfsHR9y2sE9jBF0Nyr7PM:aIYitvL+g6Ni4i/8E9VF0Nyr7PM
MD5:	320DE6406D07F4616E4CD997A295FFB2
SHA1:	FDF211A5B96BEBADCB83CE74C87E20D7A9B75E8B
SHA-256:	85E2E0C5DD208DE530B61D3F3FB5975F149A2AE8B4C9C5F20EF4DD8ADC8372A7
SHA-512:	3D8C24B75E76A61C20FCB59FC7AF5A02D0A0369E7119DDA957EEF31A2C318F134B2B4BC5FB8EBF4BBF43A53173E40B4DE239F3019317A6289E5E3D40C4E2C882
Malicious:	false
Preview:	MSCF............D...............................0..........d.......B..........U..`.drvinfo.ini.ahf.xWN.B.B.2,8DAE59F22A89D386BAAB97BDD2F09CC3AC7086CB8E9A4F5FB00BD52F2BDC04470....H.........0.....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". I.\|.r\..s#Q.....!-.).6...... +..010...`.H.e....... .J.&y.....@.j.Q(>.....B..3z.......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8....

C:\Program Files\AhnLab\Safe Transaction\AHC\product.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "product.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.626235361793961
Encrypted:	false
SSDEEP:	192:v/IYiYF82M34qFIIY0GV+noPOJB3hy2sE9jBF0Nya6lxwR:3IYitv40PPxh8E9VF0NyaqxwR
MD5:	2974E661965343BE2631CBA747AC2622
SHA1:	414842297E6C1804E272A7EC7E938698A93630FC
SHA-256:	BAC9573933158C513ACCC5198D66D12F400408D803B3D69467D8E097901C6AAF
SHA-512:	E62C1960746EDE5BDE62D56520C1824F6F34223584718161D3E4F6A6E1117D6F4DCB152811C5E2C0A76FBF75B4CEC3552EB7AEFC54D5BACCB72DD995C35E5DED
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU..`.product.dat.ahf..'P~..3,2CAF1D09A54F4EA21FE06258A81FE3DC8D8872560.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ...V..^..@.~....>.Y.G..>.b..#....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	174104
Entropy (8bit):	6.091677837548821
Encrypted:	false
SSDEEP:	3072:LQt0KzIz50IQkKPB+Pyz3L2YJ7Ssamp+7QF6zxNRx5ejJJVEN2L1FA4:LcRLLiU2YJWsf8bejJwG
MD5:	31C67060D0B9AAE5C7DFF17EE79996E4
SHA1:	133DEF015F0E64EFC31C55B3CF36FD2404911937
SHA-256:	F7A7059CC4485067B6517DCBAA4239DEC8294017E50791966E06EAF5F90CE5D6
SHA-512:	72C0EB5C9D87593E32FE34934E138D1152CEFD335D4AE9883F04A4CF88EF864F6303B62CEB9BA976B88C6F97B75B36AFAD4FB0EB0C8E671039B0576DC11E12D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: astx_setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........yL..."..."...".~m\...".O..".Y..."...#..".L..."._...".^...".Z...".Rich..".........................PE..d......b..........#...........................@......................................R.......................................................R..(...............\....~...*..............................................................(............................text...>........................... ..`.rdata..............................@..@.data....h...`.......D..............@....pdata..\............`..............@..@.rsrc................z..............@..@........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ALWFCtrl.Dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28416
Entropy (8bit):	5.965375645303923
Encrypted:	false
SSDEEP:	384:c3nkC0P0sL1O0znXoClBwPYNkmLDEMjFrg6hhZsHLAbhrc:AULw0kPwNhEM1gECqhg
MD5:	7CDBC107A646C1B9852C7B5730BF87C0
SHA1:	F8ACFB2CC9EA88521A6630C3286B16CB527EDB8D
SHA-256:	77CDB6B95CC6D1F4A83E306A6EE0A5BDF907D27435F96AC43D181E522DB968BC
SHA-512:	BA9574454335447635C3E0D9CAC1983A7DCA697FCE58A0A81F33B713FE5B8ED592C9D969606BEB24E2057D47479837F52EE7E020EFD9FA1C78DB30102A5666FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1`2.P.a.P.a.P.a.sa.P.a.P.a.P.a.ua.P.a.ca.P.a.ta.P.a.\|a.P.a.ra.P.a.va.P.aRich.P.a........................PE..d....w.`.........." .....B..........,E........@..........................................@..........................................P.......K..d............p..d....R..................................................................h............................text....A.......B.................. ..`.data........`.......F..............@....pdata..d....p.......H..............@..@.rsrc................L..............@..@.reloc..$............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	8421
Entropy (8bit):	7.22148801908308
Encrypted:	false
SSDEEP:	192:nX6H320oECl6EBmMBWJdZ2Mf5rfoEXpBjSou:nq7m8SmJdZ2OfXXpBjhu
MD5:	E9BDC36F448FCC137B9B18A37E8BF9B5
SHA1:	86E81D59DED13EE3532438DBF2903053B0550C43
SHA-256:	E6960D20598A27B8154B75AB9BE5DD8186E5D38CCD720ABD48CCB1A76334C20B
SHA-512:	8CB667AB6AB32AADF6DA68A87CC2B9A9D6205E25EDD7D6274BF7E17100E2A7E031ED9676B89619CB9192F5AB9E2F4D8E2CD97933DD73591A1D40E4D9077A0F3A
Malicious:	false
Preview:	0. ...*.H........ .0. ....1.0...+......0.....+.....7......0...0...+.....7..........jK....M.....190704061909Z0...+.....7.....0...0....R0.D.8.A.7.B.E.C.5.F.A.B.C.9.2.B.C.6.5.A.6.6.6.D.E.E.C.7.C.0.7.3.0.C.9.8.A.D.9.F...1..)0<..+.....7...1.0,...F.i.l.e........a.m.o.n.l.w.l.h...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........{._..+.Zfm...s....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R6.9.F.C.F.5.3.9.C.2.B.5.C.E.2.5.F.8.6.9.4.E.D.3.A.1.E.B.2.6.9.9.B.E.D.C.7.B.5.2...1..10<..+.....7...1.0,...F.i.l.e........a.m.o.n.l.w.l.h...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+........i..9..%.iN..&...{R0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......}0..y0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0

C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	5.1590609752075585
Encrypted:	false
SSDEEP:	48:/ZHNMJmrGhDugBq0FIlDV1qXmHhV3tFiRFZeDRHgDW1dDoFAqQvo2nxsp5+y+anD:hHNMMGJuf0FY2pGXfZv++yB3uHpS
MD5:	E22703E733A5569D0D199462EA8F6D69
SHA1:	0D8A7BEC5FABC92BC65A666DEEC7C0730C98AD9F
SHA-256:	0DEA44212B3DA0228E9D33CEC47CBF531D2A94B4A5B1BD5B7366A69FC0299B23
SHA-512:	20C9BAD169AC28A6FC1C2A2688F9AF270F6E5BC11CBE8EBA2233D1BE0112FA0A647F34921840AA16DE3601AC28178212ED73ABCA950731C39C2B73DD80A9C1A6
Malicious:	false
Preview:	;-------------------------------------------------------------------------..; AMonlwlh.INF -- NDIS Usermode I/O Driver..;..; Copyright (c) AhnLab.Inc All rights reserved...;-------------------------------------------------------------------------..[version]..Signature .= "$Windows NT$"..Class .= NetService..ClassGUID .= {4D36E974-E325-11CE-BFC1-08002BE10318}..Provider .= %AhnLab%..CatalogFile.= amonlwlh.cat..DriverVer.= 08/25/2014,4.0.0.20....[Manufacturer]..%AhnLab%=AHNLAB,NTx86,NTia64,NTamd64....[AHNLAB.NTx86]..%ALWF_Desc%=Install, AHNLAB_LWF....[AHNLAB.NTia64]..%ALWF_Desc%=Install, AHNLAB_LWF....[AHNLAB.NTamd64]..%ALWF_Desc%=Install, AHNLAB_LWF....;-------------------------------------------------------------------------..; Installation Section..;-------------------------------------------------------------------------..[Install]..AddReg=Inst_Ndi..Characteristics=0x40000..NetCfgInstanceId="{4F9A48F2-91CE-46e7-98CB-582B8EC4A3A3}"..Copyfiles = Alwf.copyfiles.sys....[SourceD

C:\Program Files\AhnLab\Safe Transaction\AMonLWLH.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71320
Entropy (8bit):	6.508611684996172
Encrypted:	false
SSDEEP:	768:x6itx1u/C97GTjkRHS4/X9HwjQzLBPrEb7+KvFg911tC8pU/Aa+3p23+zjx:faaQ/kRy4FHTI+8FCtC8iYI0x
MD5:	431E04EBDF9BF0403EE689F8A1DFDFC3
SHA1:	E74E4846A34D29A4373FAE1230388411BF2E83B8
SHA-256:	187A08D268EF09AA7C9EDF6C49642451FF14BA7455B0A8F01B0585FC8B2B2AAF
SHA-512:	46174E1BE2BC7D8AD0B89A6ECE07730408A35399CBF740FC69FAC7040A60782E70C2443C1976C5530D33243FD29D0EB3304B04A13670CE435BDBE72A17DDE51C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p...#...#...#.s.#...#...#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#Rich...#........PE..d...m7.].........."................................................................./C..................................................3...d...<...............\|........d..........................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..\|...........................@..H.edata..3...........................@..@INIT................................ ....rsrc...............................@..B.reloc..0...........................@..B........................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2618896
Entropy (8bit):	6.223663881006674
Encrypted:	false
SSDEEP:	49152:5TjfSk18xCIHJ+zVPbKONmcYuDVTE3AQREHwQw:hqk1WOV6um33/
MD5:	F6262C40F3D682D635466116FFE5BA99
SHA1:	FC05D3CAED28C00F834CDE01FF6C8224801DD5E9
SHA-256:	D0BC7D93E65D432849C7160A4B6BEDFFE993959F4ADA4F45B9EB03E2720D6636
SHA-512:	D9B89B2C0A1EE849A5D36AB8E01497D8EB5DF70F2D8C6F802B8BC9469542454E9E45EE1AE4788A222DC88C830C50562EAFA8D60A893CA6B6A5AA38C0C6733155
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J...J...J...2>..J..w.;..J...28..J...-..J......J...2$..J.....J...J..tK...2...K...2)..J....9..J...2<..J..Rich.J..................PE..d......c.........."..................W.........@..............................(...../.(...@.................................................8.".......&..G....$.HA....'..*...P(..@......................................................@............................text...[........................... ..`.rdata..P...........................@..@.data.........#.......".............@....pdata..HA....$..B....#.............@..@.rsrc....G....&..H...,%.............@..@.reloc...W...P(..X...t'.............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDCr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2306576
Entropy (8bit):	6.281607739604203
Encrypted:	false
SSDEEP:	49152:1b3GL2/BAJFfv9W4FAkRmeapIJJVJs/z+7Fld:0b9cpCU/z0
MD5:	C565A89728AA7EA21173C3026B65B578
SHA1:	1360FF431D6643125A9D1D17AFFF799BE3A64C96
SHA-256:	27E6E31EE68A2B9EB5BFA3E3E23CFB1C6145DDE0137D72356DD96ED083E2F3D4
SHA-512:	72860A2123CF2B2BB94C7E712D2DDF07383EE2415DEF30A6BE64DAC637ACF41A7FE05EB6313815530185C58E89DEF354656E3F141F7FE531CE46EC2B67675CCA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............T...T...T..;T...T..>T...T..=T...T.b(T...T.b.T...T..!T...T.b.T...T...T(..T..+Tc..T..,T...T..<T...T..9T...TRich...T........PE..d......c..........".................L..........@..............................#.......#...@..................................................X.......0!..G.... .......#..*....#..<..0,............................................... ...............................text...\........................... ..`.rdata...]... ...^..................@..@.data................j..............@....pdata........ .. ...N..............@..@.rsrc....G...0!..H...n .............@..@.reloc...P....#..R....".............@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2298384
Entropy (8bit):	6.289632942546819
Encrypted:	false
SSDEEP:	49152:Vr2gLf6YugF/klPsgAOxwArZ65ZoKW4q77giVo:9Hxq9gZjW4KC
MD5:	860F0CF335B1F73C6F94C71BFF47FDEF
SHA1:	5A788155C8BD59927BF80107531C020D400B1CB5
SHA-256:	487429458A15DEB08E95AC350D647A075C818BBFBA33FCC0B9574871E185C156
SHA-512:	313B92C5D7F28EC265DEAF1C5CD1C3AEEA817E67C41E7D0D48A1BC857647D8CDAA3957BAA0F1AF32B02F54A1E053E0E43B67EF365E2AE733857FDC13F2EBD83E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7&..Yu..Yu..Yu..u..Yu\|..u..Yu..u..Yu.-.u..Yu.-4u..Yu.-"u..Yu..Xu_.Yu..u..Yu..u..Yu..u..Yu..u..Yu..u..Yu..u..YuRich..Yu........PE..d...=N.b.........."............................@..............................#......d#...@.........................................@v..^....O....... !..G.... ......."..*...p#..<...,............................................... ..(............................text...X........................... ..`.rdata...V... ...X..................@..@.data....\|...........^..............@....pdata........ ......2..............@..@.rsrc....G... !..H...N .............@..@.reloc...P...p#..R....".............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDUp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2538000
Entropy (8bit):	6.277489867801208
Encrypted:	false
SSDEEP:	24576:NUgLUvUFseaaY7DrZIJS1GGiFprfHRrgqhrifzh9Us+e5GT7heCq9pL1vGH1w4c2:Vz3eOH7fHVgNf99UDuGX7qHcw4QcYyiC
MD5:	3419752301BFE5EDCC0CA04D7F7B967F
SHA1:	BE54DA092E99904B788F43A5305EC78F73381345
SHA-256:	FE382DDC150F35ADFD9FB127FAEAE60A88A4955719D13824D7ABB8E2A6EF79A8
SHA-512:	189F306C333659074709EC10DA7A5B8BBC9FE0F159E569C659AF71D193A153D701FF9825A01FB9FB5C8351946D1A9FCBD3EF9FE690C13337E247B15C962267B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VEl`.El`.El`.b...Dl`.L...Il`.b...Dl`.L....n`.L...dl`.b...Tl`.Ela.vm`.L....l`.[>..Dl`.L...Dl`.RichEl`.........PE..d......c.........."...........................@..............................'.......'...@..................................................!.......$.(}....#..3....&..*...P'..?...................................................................................text.............................. ..`.rdata..............................@..@.data.........!.......!.............@....pdata...3....#..4....".............@..@.rsrc...(}....$..~....#.............@..@.reloc...W...P'..X...8&.............@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1780600
Entropy (8bit):	6.470676233509427
Encrypted:	false
SSDEEP:	24576:Bml7cqS1GGiF6D81NYOozvytJcFCbhwPooNWKqZHR+6FTpo9bgDs/YU:mIOEo1KdvwJQCbmPooNW/ZHQioxgAYU
MD5:	D77FB51F3CB0C0156927963B7F613F38
SHA1:	297ED36F1820A8B34BEED4598E4FA7C4DEE2D0DF
SHA-256:	94F502D47E5D775CB9ABA572089532EC4066C921C9FE1D099E98275180DB4ADF
SHA-512:	E3BA0F46444F578F2393AA54578C86DDCBDDC6F45A9CCCB2EF8B37EF0ACA140056661302ACF823DF61FC528248662E028E8B697360DCF954D86E3C992CB24F84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............R..R..R.7.R..R...R..R...R..R...R..R.7.R..R..R..R...Rm.R...R..R...R..R...R..R...R..RRich..R........PE..d...J.._.........."......<...J.......4.........@.............................P......e....................................................................B..............x.......p9...Y...............................................P.. ............................text....:.......<.................. ..`.rdata.......P.......@..............@..@.data...x........,..................@....pdata..............................@..@.rsrc....B.......D..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ASDi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4127760
Entropy (8bit):	6.128172986872311
Encrypted:	false
SSDEEP:	49152:hyCl8qkokj/jLWcNylUSh0fVzkp5r1PqKrv1DXBy23o50bB7zX:jej3fYg0FXS585
MD5:	751C5B2493358445FEFAF7D5BC87A077
SHA1:	9E90206615D6D0BE8DEABCDE44668BDDFB5D15A7
SHA-256:	D1D41CA9AEEA38A48BD41CB1DFD77E2CDAEA65566680F6B75BBCA290D4814AF7
SHA-512:	B2AFD9DEEAA5DAA4DBA462B09419DAD9DB4E3A72F96BEFCB7C2E2EF90B28456007F50C5A0DC0A8885194F72670BD3FB0FE7AE254E5FF356FF0480D351AC0831D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t......q...}...v...S;..u...}...p...S;..u...}...U...S;..g...t...p...}.......}.......}...u...j...u...}...u...Richt...........PE..d......c.........." .....@-.........h.,.......................................?.....\.?...@.........................................@.;.\.....:......0?......0=.......>..*...@?.DW..P`-..............................................P-..............................text....?-......@-................. ..`.rdata.......P-......D-.............@..@.data.........;..N....;.............@....pdata.......0=......N<.............@..@.rsrc........0?......N>.............@..@.reloc..({...@?..\|...V>.............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ATampt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1698296
Entropy (8bit):	6.449038943875198
Encrypted:	false
SSDEEP:	24576:2/iJicTS1GGiFpP3ROmr1PA7PUrnVa9NtQEqayUQAZ7jGgN:2/Xcp/3RO41WsrVCHVVyUXZ7v
MD5:	35D97306886D0CFC8C9EF3E69105099A
SHA1:	843440DE4517DFD4640C2E4058805A3700A9ABA7
SHA-256:	992DFD9F3917FB52013CA2B091E5A5550763740A45596E85E2FC5B567C59476E
SHA-512:	30CC6C499A965DF05AC15987918C2FF306686F5AF4C6E7056CE83D3FF5EB4B956E73225EEF7E9B04115EC29DDBEC0A0D5FCCBD9B72D346B9AA5C39E1B6496E5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.O.>.....J.>...5.I.>.....\.=.......7...5._.....JS..>...<.......JS..?...JS..8...5.X.)...5.N.=...".H.=...5.M.=...Rich<...................PE..d......b.........." .....t...H......hz.......................................0............@.............................................b...dx..........8.......X........).......8..P................................................................................text...er.......t.................. ..`.rdata...............x..............@..@.data....^...........x..............@....pdata..X...........................@..@.rsrc...8............p..............@..@.reloc...G.......H...x..............@..B........................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ATamptNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	525744
Entropy (8bit):	6.010610484357411
Encrypted:	false
SSDEEP:	12288:jKUNiutxRz6Zcz8DvZJA0JJt2MwNI0/3neS8y44:2UR6OYDvnA0JJtvAXem
MD5:	35024DC79289F361A9A294A4FBD2F489
SHA1:	67B3B1F23A0ACACF97052A5A8BFF681BFE37C4C8
SHA-256:	06D3EA2D2FE4546FFE4266C2C85A5C87DC13614D00374BF634CDF111E2A5D397
SHA-512:	61F50B4D0375AA3595B9540B23B888036FE4B84E9887A2AA0526D2EE964420339763C3E80F818D33140AC7D44421BE38DDFAB9C3F00E95506C4FD7FB21A0E52D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Ma.m#2.m#2.m#2.0 3.m#2.0"3.m#2.m"2cm#2.0'3.m#243'3.m#243.2.m#243!3.m#2Rich.m#2........PE..d......b.........."..........6....... .........@.............................`............`.................................................. ..<....@...........:.......O...P......p7..8............................7...............................................text...E........................... ..h.rdata..,~..........................@..H.data....p...P...&...6..............@....pdata...:.......<...\..............@..H.gfids..............................@..HINIT......... ...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AhnCtlKD.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	5.95361188549271
Encrypted:	false
SSDEEP:	384:sEtW/PzMAKvMLaa3eHB+trw1b4+KIcmu0CWNf5iRwXbXqoqd4SmFadbbp/nK3nyh:gwbvMmHRCIjuKpr67q89nZkVCs3hA
MD5:	EB6F76EBBA2DE44C925595008F23F532
SHA1:	55E5BEA8C99B093CD9A8FDEA7C96739356C31893
SHA-256:	97CA53B2FE43B67D6B1BAE26693B2850692794CA557A8A5E368CB66CF7AA75BF
SHA-512:	F43C773C7C9D37445AC8215087D631CCD945E3DB048BECE225F9B26921326BA453AF756F59107C151B9278764D1588789E5417EE09CB1C42AD5C7AE697681FAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................j......j.............j......j......j......j......j.....Rich............................PE..d...`%.`.........." .....H...,......pU.........S....................................L...............................................ps.......l..d...............X....r..............@b...............................................`...............................text....G.......H.................. ..`.rdata..2....`.......L..............@..@.data................d..............@....pdata..X............f..............@..@.rsrc................l..............@..@.reloc..H............p..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AhnI2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616128
Entropy (8bit):	6.469992569412543
Encrypted:	false
SSDEEP:	24576:SgQoS1GGiFp+GY3qA+bcnvC3wJJGlZ+QoiKm3+Ea4sMXYL3KiS9/:S3MuG0qxbGaAJMoQ1KmuEa8X/
MD5:	7C35602CF615C3FAFDF5057C53756A94
SHA1:	E80B76D0EFDB37391F8E63E6BBFA922B1B7A7370
SHA-256:	726AFEFA017583C667D4359CCC3D71AAA07B6EAB686FFE656919300D3379D44F
SHA-512:	6B1EEB243D57249B9548FCF3E3C9CBC69697125431C479FF114746FB33408FE538874DBC935BD0BE8B0591055FA4EE8E4AB0BB5264138906D61FB5C8BDA9BD40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..f...f...f.......f.......f.......f.......f...g.@.f.......f.....w.f.......f.......f.......f.Rich..f.........PE..d....d9b.........." ................._..............................................A.....@.........................................`<.......)..x................................8......................................................H............................text............................... ..`.rdata..tX.......Z..................@..@.data....g...P...*...6..............@....pdata...............`..............@..@.rsrc................<..............@..@.reloc...F.......H...B..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Ark64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2085408
Entropy (8bit):	6.354856041862029
Encrypted:	false
SSDEEP:	24576:i6pbhPFZpeRnR8CwpTCZWLCwWGX7I9+vsDJNmoz8gF5B7AaRRGzNJmrqw6c+Wdnk:HpbXSR8nswC0WfdeL0s0znPTm
MD5:	D26F10BEE44D756CAD73631C1C3E90E1
SHA1:	7862102526806C87BD182076A351856420E886A1
SHA-256:	CE5F64E3308E8AAFB8FA3DC77652949EE0E1F40FCB6133CFB0AC63D1B934A3D8
SHA-512:	33EE5F6A4D2CA3028F6B56ABEDD9AE48EBE25A3A8FCC82ACC07C117C7A1D76D4BAE1994602EDD86CFD3AD62D9776CF830F913768EE5187820F0B7F37CAE04458
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.X.yt6Jyt6Jyt6Jp..J.t6Jp..Jit6Jp..J?t6J^.[Jxt6J^.MJrt6Jyt7J.t6Jp..J.u6Jp..Jxt6Jg&.Jxt6Jp..Jxt6JRichyt6J........................PE..d......b.........." ..........................................................!....... ...@..........................................-..d.......x..... . ....0..L....n.. d.... .p7..................................................................................text...Z........................... ..`.rdata..............................@..@.data........0......................@....pdata..L....0......................@..@text.........P .....................@.. data....`4...` ..6..................@..@.rsrc... ..... .....................@..@.reloc...R.... ..T..................@..B................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Ark64lgplv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	640544
Entropy (8bit):	6.262981938777764
Encrypted:	false
SSDEEP:	6144:m3SlvflrV0kD/52TRIY9rPwadIthkAgUb0/cFBMDa6VgCJcQCtbcdXzMaOSNUs6J:QSlF50UuiVRe54CIapNJ6VZ+Alh1FRuQ
MD5:	7DA16EA022A35C4FCB8CDB830B1F2DAD
SHA1:	0DB6B7D23E744B6AA842DF262F138F146805608A
SHA-256:	B058BB04AD2695FDED14F06CD800D686B047C605F824287ADD2BD4EC36C18F3B
SHA-512:	C5DBE12A3DEDF3320B33797FECAC74506675A030358D82AFEE8422A2286BE839D33E02BF4B0AAD2B363BB68447511456D8C5220B31C26E225012A4323FFCDDE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T..T5..T5..T5..]Mm.\|5..]Mj..5..]M\|.^5..s..U5..s..S5..T5..85..]Mc.5..]M{.U5..Jg}.U5..]Mx.U5..RichT5..........................PE..d......b.........." ......................................................... ...........@.................................................X...P.......l....p...\|...b.. d...........................................................................................text............................... ..`.rdata..............................@..@.data............P...z..............@....pdata...\|...p...~..................@..@.rsrc...l............H..............@..@.reloc..`............N..............@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AtamptU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1643040
Entropy (8bit):	6.442596737136437
Encrypted:	false
SSDEEP:	24576:UadDS1GGiFpNr3kAoYN4KHFQ/MUDbRmzualwjCMCA4USsJ:UMZFkttKIrD0qalwGBA46
MD5:	82CB7701384A71B47792ADD297F1D197
SHA1:	C5C7C51E7249220159C5FDF16E96C3A7DFEA6D27
SHA-256:	7676C1101035D8E1AFA2BFA5C9CC12BE0139804AF45BE187F055A7184FA157AA
SHA-512:	5DE5DBACCF6BCAFD0ED53E14CD9DF3D5CBDFCE86E0BA0E33696711E234328F7A64B845F62C544D3CC5CC98BA0BA79977A9DC28F15895251F17CFB1842E056DC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................S.....#.V.......U......8..........k.....C.M.....D.......R.......T.......Q.....Rich............PE..d...b(.b.........." .................!.......................................p............@.............................................Q....i..........$.......d....... *... ...=..07...............................................0...............................text............................... ..`.rdata...O...0...P..."..............@..@.data....f....... ...r..............@....pdata..d...........................@..@.detourd.............p..............@....detourc.!......."...r..............@..@.rsrc...$...........................@..@.reloc..xK... ...L..................@..B................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\AupASD.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2399248
Entropy (8bit):	6.314705719172017
Encrypted:	false
SSDEEP:	49152:3RwgQEl1aqArZHMMv9eyr1tF8zwlycjg7aC:hO1T8zwwcj2
MD5:	03DE4ACA4BDCB56F34E17C20D5B8B128
SHA1:	6B33AED0814099B6F109A1D924BB24FE56D6471F
SHA-256:	716EAA706149F839B7D2122903919499A7514F4344F95C2C10743EE6CF104163
SHA-512:	3D1233EB29534B3015259DB65ABDCEBD4B2BF1076F6A1B3596A12F1143BD3A6AC1D8C93D529E1030336166013494746BFD8C87F44225BA422E0D8500C7B70A93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].............>EU.......@.....>E......>E..........?.....V......\.8.....Q.c.....A.......D.....Rich............PE..d......c..........".................D..........@.............................`%.......$...@.................................................h........."..F....!.H&...r$..*....%..>..0................................................................................text...F........................... ..`.rdata...3.......4..................@..@.data...............................@....pdata..H&....!..(.... .............@..@.rsrc....F...."..H....!.............@..@.reloc...T....%..V....$.............@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Av.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1589264
Entropy (8bit):	5.763994289322921
Encrypted:	false
SSDEEP:	24576:Xo5gXeL7ypAb8kSFoNggdefG19n29KrFnq04SD63+6xvN7q6w4Y+Mb:pNAIkooNfeej2LSDX2N7zq
MD5:	3C407401D797891872A41781962BB872
SHA1:	B7EE4976A8010834EC1A3949372956876EBF745F
SHA-256:	E7C2D733D28D537E46920D989E4872EBFD0D4BCC74E5D741EDAB49D567475AC4
SHA-512:	8DBD237D6BE244CCDF3176D7A6C42322610C37EC22774206714BBAB250C17A33F910AD964C128ED9F7B533958E04192387F9E2E8F29495F7D9DB37746DF2AEC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&O.G!..G!..G!......G!......G!..?...G!..?...G!..?...G!...L..G!......G!...Z..G!..G .9F!..?...G!..?...G!..?...G!......G!..?...G!.Rich.G!.........PE..d......c.........." ................x...............................................,.....@..........................................C..o.......................h........*..............................................................@............................text............................... ..`.rdata../4.......6..................@..@.data...@....P.......4..............@....pdata..h............6..............@..@.rsrc...............................@..@.reloc..^...........................@..B................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\BldInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.959459707035537
Encrypted:	false
SSDEEP:	3:GB4ov3BRPNVLNxsusUmdOrMdZJBROdwIfFLsXLQsyxNVFy:GHpRFBNKfB/ROdwIfALQBJFy
MD5:	6E09B169BB08A70212D98F986F9FF33D
SHA1:	67CB1E75D9899919F0E0212726B8063F775799AB
SHA-256:	AB52A3BE3659C59E4DF91A0933EAD0F0ACBB740A089AA2B881126CF70767BED2
SHA-512:	EE99857655DABB27986428CEEBEECBC77054592D8BDEBBB3F10787BDB58100BF37D91DE0D5E7DC756566C4C5E84940CD1133EEEC0785E5534DD2B713B109D0A9
Malicious:	false
Preview:	[Build]..BuildNumber=1.7.0.1630..State=4..Version=1.7.0.4..[ASDFBuild] ..BuildNumber=2.5.81.1435 ..State=6 ..Version=2.5.81.6 ..UpdateVersion=0 ..

C:\Program Files\AhnLab\Safe Transaction\BtScnCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29848
Entropy (8bit):	6.634755302057254
Encrypted:	false
SSDEEP:	384:T523SlaCmIevOyl8Qf4y7wa+pYnMtRKOBxQUBHp23+r/jLo+:1OSlAnmyLAyU1tZp23+zjc+
MD5:	99A40DC9A761B2A03948BD2F5F8D1378
SHA1:	AB5ED4D4A38842C972AC8E85305E5D7EB067B5E6
SHA-256:	2837C994037D9D3ED31F4A4AA2912BAD8CF751482528AFDBF43A80071C99AEC6
SHA-512:	D05AB5B330C83F1F92D3C50773AFBF74828F21FD502545E8F71138D813BDCBAB00DD64BAE00DCA3937D7793747B9367C8F6F449039BA72998F9E4FEC06316C64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!P.U@>.U@>.U@>..5@.T@>.#.S.S@>.#.C.T@>.#.E.\@>.U@?.g@>.#.P.V@>.#.D.T@>.#.B.T@>.#.F.T@>.RichU@>.................PE..d.....^.........." .................%...............................................................................................<.......7..d....p.......`..,....8...<...........1...............................................0...............................text............................... ..`.rdata..~....0......................@..@.data........@......................@....pdata..,....`.......0..............@..@.rsrc........p.......2..............@..@.reloc..H............6..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\CdmAPI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	183608
Entropy (8bit):	5.925006152484248
Encrypted:	false
SSDEEP:	3072:mON3OrQ48MQTKxZBhMeldB1DBHxN0QWADUEekU+Y:mON3eQTKxZBielXcADUl
MD5:	D63FE44D767DE4D36943DE9DCBA5AAB7
SHA1:	1F0E72AEA935FE970999C2DF6A644EC9A4B52CC0
SHA-256:	FC89A9B2B5D8D7FDC3BD49D450A5135BC52832430989ECADAB3FEF20478B6DEC
SHA-512:	D9390AA01ADDC4FFAA10666ECB337884195489D8360E7B0D1919585468FD6EA720BE73687855C414A71F766155A0FFA3781178F2D7592A9E75A1335977954354
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,..,..,.....,..,...,.....,.....,.....,.....,.....,.....,..Rich.,..........PE..d...-.fb.........." .........$.................S....................................`...................................................Y......d.......H...............8#......x...................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\CdmCtrl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95032
Entropy (8bit):	5.702613415046306
Encrypted:	false
SSDEEP:	1536:3hsnrVygg8kxEzvUZ3nBVnwF1Ms8gRffIhL6rUJe+/nPNdBpl:WrVvg8tMktfQx6sNdBpl
MD5:	0319CE5F5E28235E8DBA9A9F669A2CE0
SHA1:	E71C781BC99CFD5C0A351EF4A569D7CF0220A4D1
SHA-256:	E758B88E8A1B3F9E4C474F0AC494C7A6890A16580A9F4EEF701B1E70F74B3828
SHA-512:	2350E5A7A41948063BB05AE2715BAAB0D25A426DAFDFDA21E968207843C1FAC4D07CE7034B0BCE679EE9D1A616AE9516FE856844407008B02A2A94E27E71EBA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.G@X..@X..@X..6...IX..@X...X..6...FX..6...BX..6...KX..6...AX..6...AX..6...AX..Rich@X..........PE..d...+.fb.........." ................P..........S....................................................................................PJ..7....@..d.......P....p.......P..8#......h... ................................................................................text............................... ..`.rdata...`.......b..................@..@.data........`.......8..............@....pdata.......p.......:..............@..@.rsrc...P............H..............@..@.reloc..B............N..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\astx.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.942112766183263
Encrypted:	false
SSDEEP:	3:hWddwA6fLBJoHeA79LczVyRHqeRpkmcBJMKe:AEAy1JoHec9LTqOpIJq
MD5:	180B33AD34ACF1D366C541BD4B6A678D
SHA1:	3475F028E03199616959E65A1A88364752AE8B2C
SHA-256:	A54EF576B172285C83E497276BA7BEE93D6AA526892EAE23C89DA264FEE06817
SHA-512:	116EC531D0888F7EDD03F06B2E01281785E08374371846469F5724633245418B731B058DF87AC9339F27E03DC63A9B61660F79E98BE9FB97DAED5F2DE55929A3
Malicious:	false
Preview:	[Version]..Signature="$Windows NT$"..[Properties]..; Friendly name property..11="{text}AhnLab Safe Transaction..

C:\Program Files\AhnLab\Safe Transaction\Cert\ca.der

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Certificate, Version=3, Serial=00d01329e89a358cfe, not-valid-before=2015-06-18 04:03:23 GMT, not-valid-after=2038-06-12 04:03:23 GMT
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.459978064135623
Encrypted:	false
SSDEEP:	12:DECA5mS57QS7NpEt11Lc7p7lQXQmaFGGhE0OhEDhpoS8P/h1ABaZD6JYhvU3x6:D5G7QS7Ug7p7lQ5aFGr0TDbuP/DAQZYY
MD5:	6684F39AE1EED64077BC9E2ED55CF318
SHA1:	E7EBD0B691D499DA5BC16A8C7ADC942CB7661C65
SHA-256:	FE46FD605FB59B26E2F8535D352F7C93F0E25431F5CD21231CB66F00DDD1EE9F
SHA-512:	D0B4F652197489411749C6EB45CC4987CC73868D5BFD6E5AAA7D13148E71EC1D5A4587F6AC0B0B27C52233B6353C4B65EA2E4B5C3FCA0031EDACFE157BC35D97
Malicious:	false
Preview:	0...0............).5..0....H........0.1.0...U....ASTxRoot10...150618040323Z..380612040323Z0.1.0...U....ASTxRoot10.."0....H.............0..........\`.t.D...}....H..8...V..1..SC.3...q.]....<T9:>..-.?$t....5..\|p...."U.kC.+...)..1y...R:..\|........C.n2........4......^.%.....q.2?....tK.%.-y..:B...H.Z...[I?&..5..>J.'...3..r.Sq.../.y....Z...Jp.s.. Y..'.{..F.i.0..Y..,p.Po0 AgW;6V..Y..tkO..a.........P0N0...U.......6.a.. .-.vow.6k_?0...U.#..0....6.a.. .-.vow.6k_?0...U....0....0....H.............LA......t......P....;n..s'.U.#m8,'.R8z...pi..K........b`"..^+...........bxP..b...H.0....2.t.....f..\........k].........,.....2.S..%..............(.Dd.M(.ZD#.Nx6...<IX..:jDvd..GP...B....`.D..$....du.....\|1...XQH........#..V.......(.1,......,...

C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Certificate, Version=3, Serial=009c786262fd7479bd, not-valid-before=2015-06-18 04:03:24 GMT, not-valid-after=2038-06-12 04:03:24 GMT
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.511801750889632
Encrypted:	false
SSDEEP:	12:PsxFIxJFOl7As3WVL65oU1q66pcW0whPWs0sLgLaXr08qo/Lb1kfKAp6WLVlu:ETl7As3WVL65GuwhPaegLaXrR9YxpbLG
MD5:	D727B1D7417252E07DC436AA754C941B
SHA1:	E6E5C1EB1E19E4F89A0C37DDCDA50C8B6EDDDD8F
SHA-256:	8A81891C6200605F963355A7D7B379221D4A14F2BC55C969353C04214A7C5685
SHA-512:	490C16A465E1045574E6082CD88ABDEB9EF854F720DFB13DD4503126B50D7F373097AA68FC41331BED697BB4DE43034B6E855F822F84C33FFDF41F48C97B6845
Malicious:	false
Preview:	0...0...........xbb.ty.0....H........0.1.0...U....ASTxRoot20...150618040324Z..380612040324Z0.1.0...U....ASTxRoot20.."0....H.............0..........x.P.....t...q.(....9.^.....` ....y..I..o....jD.J....u=vK.~].o]T\.n...&..vE...k..^...^.Z.....).'.h2..9}.U3..d.Y.TQ........-..0.`l.S.M...;..tU......7.nBQ.u.F.m.}.......?M............Z.....z_.\|m.S<....]sT......G_.B........g.......c6.t. A.......P0N0...U............".Qnh).~.l/..0...U.#..0.........".Qnh).~.l/..0...U....0....0....H...................4q+.A4hfC...>...s.2!}...FB..St>.Oi.[5!...\|Dn.;...g~+.X.7.&...i.6.ws.-..Q(...?...Vn....Q".HJ?.;.B....(..S..\|P$.......{...p..=@...%.C.<..ww!z#..j...1C_...D..Dpr...o...s....n.....P.+......%*V..S.r.P.....&X.^.wV.?...D...a......h.u...JU....z.

C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.9322947668452635
Encrypted:	false
SSDEEP:	1536:MeZq3MXXTjmZ5IplbHKp/reRgMxcRircjVgrS9Ll2shT:MeZNvmnswKGMCZSrggsh
MD5:	AED39116FE12C5550975043DA1D1B244
SHA1:	ED8AA12A00E93C1A477F4EF69864948B4014A7FB
SHA-256:	BBBA87BF62E8BDC11602F2A95712E5FE3FB1EDBBCDEB28CBDCF191AEAB286B04
SHA-512:	0AB9EF25BBA0E231A140A5153C9F9149AB194A324F374E655E43EF90715E0417987D7F31F2493E229EC8B704BEAD31F0FBFF6EE811D42CB7AF8C58361979D132
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xl.....................c.......c._............c.^.....n.].....n.b.....c.\.....c.X.....Rich............PE..L....$.>...........!.........Z...................3o.................................................................................0..p)...................`..x...................................xS..@............................................text............................... ..`.data...............................@....rsrc...p)...0...*..................@..@.reloc..N....`.......2..............@..B.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.certcli.dll.ADVAPI32.dll.USER32.dll.ole32.dll.OLEAUT32.dll.CRYPT32.dll................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569344
Entropy (8bit):	6.1181069611039955
Encrypted:	false
SSDEEP:	6144:AG/XQ+F4FFJaL5TBEf6ID0rq7XqHvXxUEuspBi9NlLlli8QMupzUMfNXyowyQv:rX0vaL506euHPOypA9NlGcuVNXa
MD5:	711DB2EF10B6C2AB2080698AEC6C6D08
SHA1:	5746C14FE1790A18B76CC9833F93BC72937ACA72
SHA-256:	75DDAB1826F220EB36A9EEA9CF8533C94C19BAC89D961380F3A418F6EEDB2B4E
SHA-512:	6568EA1BF41AFA461D2B529D42E0D873C9B1B109875C6010FD965AC8C3D9A0C98EA1EA747119815254BF42130B6CF699C8DC01EE6763F172AE7C57F656FAF7F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..x..l+..l+..l+..q+..l+..c+..l+..1+:.l+..m+5.l+..3+).l+...+3.l+..2+..l+..6+..l+Rich..l+........PE..L......>............................Wy..............................................ye........... ..........................(........`..@...................................................................P........................................text...l........................... ..`.data...$g.......P..................@....rsrc...@....`.......*..............@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>$....$.>1....$.>=....$.>J....$.>V....$.>`....$.>.....$.>m....$.>y....$.>.....>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certadm.dll.certcli.dll.COMCTL32.dll.comdlg32.dll.CRYPT32.dll.CRYPTNET.dll.CRYPTUI.dll.GDI32.dll.NETAPI32.dll.NTDSAPI.dll.ole32.dll.OLEAUT32.dll.RPCRT4.d

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	6.464020030097691
Encrypted:	false
SSDEEP:	3072:est2WKOxRTftkVeSl8w5d3wgtRgc7k8w:GWKOzTlkVzl8w8yRDA8w
MD5:	0C6B43C9602F4D5AC9DCF907103447C4
SHA1:	7A77C7AE99D400243845CCE0E0931F029A73F79A
SHA-256:	5950722034C8505DAA9B359127FEB707F16C37D2F69E79D16EE6D9EC37690478
SHA-512:	B21B34A5886A3058CE26A6A5A6EAD3B1EBAE62354540492FB6508BE869E7D292B351C0913461B47C4CC0C6A73333AAD33CD9399BCB1F83C7DACFDB7F2EE1F7A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..........................{......{......{.........6..{./....{......Rich...........................PE..L....A.O..........................................@.......................................@.................................Tq.......................................................................p..@...............h............................text...d........................... ..`.rdata..............................@..@.data................z..............@....reloc..D............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.697487951906348
Encrypted:	false
SSDEEP:	6144:ScTE2XtnPcWNo4eT4hs8LP71DRIUqqDL67PXGHrIrH:lTE2XtNrLP71Dyxqn6jI
MD5:	269BEB631B580C6D54DB45B5573B1DE5
SHA1:	64050C1159C2BCFC0E75DA407EF0098AD2DE17C8
SHA-256:	FFC7558A61A4E6546CF095BDEABEA19F05247A0DAA02DCA20EA3605E7FC62C77
SHA-512:	649CD40F3E02C2F2711F56AA21F39CCBDA9108143D4766A9728C9AD98F329D5F64F77090DF769C55B66AB48FB9AA4A380944EBE54F2C450F96CF76E5A6ADD31E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[x.5+.5+.5+..+.5+..+.5+..+.5+..+.5+.4+..5+..+.5+..+.5+..+.5+..+.5+Rich.5+................PE..L....A.O...........!.....\...J.......f.......p............................................@..........................U..O...,M..x...............................,...................................hL..@............p..x............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....F...`.......F..............@....rsrc................H..............@..@.reloc..x............L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199680
Entropy (8bit):	6.678065290017203
Encrypted:	false
SSDEEP:	3072:/zcwXcVnDhH5YI6KkEK7207EmrRelzafK+AnF4xH6dVHwpXpE92jDBSRYO6s0eEw:TUDF5YTyBJuF6DHwpXpfSRYO6Z
MD5:	6E84AF2875700285309DD29294365C6A
SHA1:	FC3CB3B2A704250FC36010E2AB495CDC5E7378A9
SHA-256:	1C158E680749E642E55F721F60A71314E26E03E785CD92E560BF650B83C4C3C8
SHA-512:	0ADD9479B2FD631BAFC617C787BCA331E915EDC6A29DD72269B6A24490EC1C85E677698E07944F5FF3BD8D849D3D20ACE61A194A044C697FEFCF992C6F05E747
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Wp.6...6...6..-x...6...@...6...@...6...@...6...N...6...6..m6...@...6...@...6...@...6...@...6..Rich.6..........PE..L...lA.O...........!.....^...........h.......p...............................p............@..............................+..<...x....0.......................@..."..................................X...@............p..`............................text....].......^.................. ..`.rdata...s...p...t...b..............@..@.data...P(..........................@....tls......... ......................@....rsrc........0......................@..@.reloc...&...@...(..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.794541181301596
Encrypted:	false
SSDEEP:	192:y39iNAtUyE7ioVwAFzuh+pOWo1v26wJMnnnLIQBIc3X7PVlD6QHS6CV+:mRUyZoVwAFzusie6wcZxrPVlpHS6c+
MD5:	1FAE68B740F18290B98B2F9E23313CC2
SHA1:	FA3545DC8DB38B3B27F1009E1D61DC2949DF3878
SHA-256:	751C2156DC00525668DD990D99F7F61C257951C3FAD01C0EE6359FCDFF69F933
SHA-512:	5386AAD83C76C625E2D64439B2B25BDA8D0F8B1EB9344B58306883B66675D1F1E98E3189C1BC29CD4B2C98A9D4A594761488AAE04D3748BBA5775A51425B11EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......vx..2...2...2...;aS.0...]o^.3...]ok.0...]o\.7...2.......]oj.(...]o[.3...]oZ.3...]o].3...Rich2...................PE..L...oA.O...........!.................'.......0...............................p............@......................... 8.......3..P....P.......................`.......................................3..@............0...............................text...T........................... ..`.rdata.......0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.576295270591411
Encrypted:	false
SSDEEP:	192:y8/u6mEWZYr/YDmJrFirLPAxHU413X7PVlD63YlFfP:1/uHE6Yr/Y+h0AlU4prPVlZlFfP
MD5:	9AE76DB13972553A5DE5BDD07B1B654D
SHA1:	0C4508EB6F13B9B178237CCC4DA759BFF10AF658
SHA-256:	38A906373419501966DAF6EC19CA2F8DB7B29609128AE5CB424D2AA511652C29
SHA-512:	DB6FD98A2B27DD7622F10491BBA08793D26AB59016D6862168AAD278644F737DDDBD312A690DED5091D5E999DC3C3518FD95B200124BE8349829E5CE6685CF4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................g......j......_......h............^......o......n......i....Rich............................PE..L...mA.O...........!.................".......0...............................p............@.........................P6......l2..P....P.......................`.......................................1..@............0...............................text............................... ..`.rdata..R....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..(....`.......,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\msvcr100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	761152
Entropy (8bit):	6.9097717021149965
Encrypted:	false
SSDEEP:	12288:TYhr4bCLI2kwAWEXqKDkoKsiYxem5GQmLuEs0NIL2fLiFHSt6mRy3jVRwB:TUIyAWKDkoKsiuem5DmLuExNILQOFQ6e
MD5:	53E17C3EEDCB0479971FBBE99FA9C0A0
SHA1:	87E3E49CF24EA5762E8E4EEFDEA750D4E365907D
SHA-256:	990EE8BCC6DC60FCE2F5D91187322EE13939B6212B6C617DD95AC4117A7F2BF3
SHA-512:	B8DF5005596340E07C742D33CCDB6E1D0E1F8053DB1C9360B32CE84C9DBD7FB22AE8643328990311BD9639DF47FEB5BFB1579E8FCB56E9965981A8234533224A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V\.X72.X72.X72...I.[72.X73..72.?x...62.?x...72.?x...72.?x..Y72.?x..Y72.?x..Y72.RichX72.........PE..L...W..I.........."!.................j.............x................................pf....@.........................0f......@V..(....p..................@.......\|J..0................................/..@............................................text............................... ..`.data....^.......8..................@....rsrc........p.......0..............@..@.reloc..0Q.......R...4..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	6.523188898405281
Encrypted:	false
SSDEEP:	24576:uN/cDx/LcwkjTGAq8f54Y6ifuGJk3c8IXRvg/W68IALE/ZcaFL4FzS17BAw:6ci+m9LEazS1
MD5:	A1C4628D184B6AB25550B1CE74F44792
SHA1:	C2C447FD2FDA68C0EC44B3529A2550D2E2A8C3BC
SHA-256:	3F997D3F1674DE9FD119F275638861BC229352F12C70536D8C83A70FCC370847
SHA-512:	07737AC24C91645D9B4D376327B84CB0B470CECBAD60920D7EE0E9B11EF4EEB8EE68FB38BF74B5D1F8817D104CECC65E461950242D940E8FF9CA64CE9D3FFBB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..............T.......Y......l.......[..............m.T.....\.......].......Z.....Rich............PE..L....A.O...........!.....2..........V;.......P...............................p............@..........................z..zb...Z..................................TS..................................0Z..@............P...............................text...^0.......2.................. ..`.rdata.......P.......6..............@..@.data...............................@....rsrc...............................@..@.reloc...\.......^..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	6.863300763286356
Encrypted:	false
SSDEEP:	6144:eeP90QTcdMTWfpUwFygo5zUM38ME/Hs3nXHkUX:eA/TcWTWfpf0gmzY03nXHkUX
MD5:	D1243817A1B22B855DE0852CF5B53BF5
SHA1:	C64F4851A2FCFE8D1E4A5B5743498870B676755E
SHA-256:	93E99CFBA00348BE3A102DC9F41ACD39BBA91D7F4E0149A9EA6C53FCC50ADAEE
SHA-512:	59ABD87F8DA58F0F4D8D3919A84B2E4FA853AA0E76DBFEA3BC011E21267909ED7C3BB42A714F030773767329A8D3DA0810E789AB5A061BC0E4452159849C4CC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......??fs{^. {^. {^. r&. y^. .(. z^. .(. y^. .(. r^. {^. C^. .(. R^. .(. z^. .(. z^. .(. z^. Rich{^. ................PE..L....A.O...........!......................................................................@..........................6..P...L1..x...............................t,...................................0..@............................................text............................... ..`.rdata..07.......8..................@..@.data....T...@...R... ..............@....rsrc................r..............@..@.reloc.../.......0...v..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.45689405407938
Encrypted:	false
SSDEEP:	3072:ES2ipxnUGhrFxZHkZvmYHG+iI2iV6nu+ZfX6AKVqzzF+:ES2ipxUSwv/m+1rAKVqz5
MD5:	051652BA7CA426846E936BC5AA3F39F3
SHA1:	0012007876DDE3A2D764249AD86BC428300FE91E
SHA-256:	8ECA993570FA55E8FE8F417143EEA8128A58472E23074CBD2E6AF4D3BB0F0D9A
SHA-512:	005B22BD5A4CCA9930C5ECA95AF01FC034BB496F4E599CAC3F20B0B9CE0957B4DB685B8E47977E5B289DC5CF1C8A81F4DD7434D0347E41D008E2C8F7F12006F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D[...[...[...R...Y.......S...4...Z...4...Y...4...P...[......4./.z...4...Z...4...Z...4...Z...Rich[...........................PE..L....A.O...........!.....n...:.......w....................................................@............................................................................................................@...............D............................text....l.......n.................. ..`.rdata...............r..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssutil3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.44977499578729
Encrypted:	false
SSDEEP:	1536:W3Hq5zbjpPQ4Y0epuuwCbDz5xAFKL8kycL7:gHQxPQfGuz5uFKL8kyu7
MD5:	C26E940B474728E728CAFE5912BA418A
SHA1:	7256E378A419F8D87DE71835E6AD12FAADAAAF73
SHA-256:	1AF1AC51A92B36DE8D85D1F572369815404912908C3A489A6CD7CA2350C2A93D
SHA-512:	BD8673FACD416C8F2EB9A45C4DEEF50E53D0BC41E6B3941FC20CDA8E2D88267205526DADB44BD89869BD333BF7D6F8DB589C95997E1F3322F7A66A09D562B1DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................`....C.k.....m.....X.....o...........Y.....h.....i.....n....Rich...........PE..L....A.O...........!................p.....................................................@..........................O.......F..x...................................................................0F..@...............l............................text...~........................... ..`.rdata..............................@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\smime3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.240650542976671
Encrypted:	false
SSDEEP:	1536:xtTRGG7+CF7k9QTPHkis9rGDE9tJ7kdsolb5XpIKz1TpNs6IRcgAGEFDGSs1f8b6:xGG6CF7k9QbHkCE9tJ7kdsW5Xh5s6IRV
MD5:	A5C670EDF4411BF7F132F4280026137B
SHA1:	C0E3CBDDE7D3CEBF41A193EECA96A11CE2B6DA58
SHA-256:	ABA2732C7A016730E94E645DD04E8FAFCC173FC2E5E2AAC01A1C0C66EAD1983E
SHA-512:	ACFCDE89A968D81363AE1CD599A6A362B047AE207722FEA8541577AC609BC5FEFB2231ED946E13F0B4B3BCD56B947C13837C1B9E360D521EC7D580BEFCBB0F46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6.k.6.k.6.k.?...4.k.Y...7.k.Y...4.k.Y...;.k.6.j..k.Y.....k.Y..7.k.Y..7.k.Y...7.k.Rich6.k.........................PE..L....A.O...........!.........j...............0............................................@.........................Pj..v...\N.......................................................................M..@............0...............................text............................... ..`.rdata...S...0...T..................@..@.data...h............l..............@....rsrc................n..............@..@.reloc...............r..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172544
Entropy (8bit):	6.496240878001019
Encrypted:	false
SSDEEP:	3072:KfHTwBGo4uYvGG3byHhQNP4IP/zsu9zvKwMNJ+Z/9tRpK:KsGTudG3GHhMz3SNY9R
MD5:	2AB31C9401870ADB4E9D88B5A6837ABF
SHA1:	4F0FDD699E63F614D79ED6E47EF61938117D3B7A
SHA-256:	22ECECE561510F77B100CFF8109E5ED492C34707B7B14E0774AAA9CA813DE4AD
SHA-512:	BC58C4DA15E902351F1F161E9D8C1EE4D10ACEB5EDA7DEF4B4454CADF4CD9F437118BA9D63F25F4F0A5694E9D34A4DEF33D40AD51EFB1CDEBB6F02A81C481871
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.e./.6./.6./.6.W.6./.6;a.6./.6.Y.6./.6.Y36./.6.Y.6./.6./.61/.6.Y26./.6.Y.6./.6.Y.6./.6.Y.6./.6Rich./.6................PE..L....A.O...........!........x.......3.......@............................................@.................................<...................................\|...................................x...@............@...............................text....(......................... ..`.rdata...O...@...P..................@..@.data................~..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.751461394308889
Encrypted:	false
SSDEEP:	6144:Cf41DoFqNI3Cm39XWYJkW07RlqHYOE1o2exosU8iZEJKvncrghAvLWDKnADA3/AF:DD76rrQ7ngYLo2MliPSghmLYk3/n
MD5:	B58848A28A1EFB85677E344DB1FD67E6
SHA1:	DAD48E2B2B3B936EFC15AC2C5F9099B7A1749976
SHA-256:	00DB98AB4D50E9B26ECD193BFAD6569E1DD395DB14246F8C233FEBBA93965F7A
SHA-512:	762B3BD7F1F1A5C3ACCDE8C36406B9BEADD4270C570EB95A05935C1F7731513938AE5E99950C648B1EACDD2A85F002319B78B7E4EA9577C72335A2FA54796B13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,J..h+.Yh+.Yh+.YaS0Yj+.Y.]?Yk+.Yh+.Y&+.Y.]=Yd+.Y.].Yj+.Y.].Yf+.Y.]8Yi+.Y.]>Yi+.YRichh+.Y........................PE..L....A.O...........!......................................................................@..........................J.......C..<...............................@&..................................@B..@...............@............................text............................... ..`.rdata..............................@..@.data........`.......D..............@....reloc..Z(.......*...N..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Cert\nss\ssl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	190976
Entropy (8bit):	6.662915165682162
Encrypted:	false
SSDEEP:	3072:82ya/vPWqodwFYAjkiV6vnjBr/WPUShgk04YZEnhacoAX8+FeHbnGmgjZzpTBfRP:j7JoiVGj+hIWNmKFpTBJ8B
MD5:	717DBDF0E1F616EA8A038259E273C530
SHA1:	926CE8EC8F79B62202ED487C5FB0C3E1A18F5F70
SHA-256:	E3227EA4C39F5B44F685EEA13D9F6663945E46B12CABE5D29DAEF28B6EEF1A9B
SHA-512:	C09BF38AC93C350DFD0638BEEDD40FBCC9435A06B0013D214F57B181C1B4292E4B8A8310DB2DB48200BCFED872BC656EA92A207ACB6F7B344E3F134226C2AB3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Af......................jq......jq=.....jq..............jq<.5...jq......jq......jq......Rich............................PE..L....A.O...........!.................".......0............................... ............@.........................p...j.......................................l......................................@............0...............................text............................... ..`.rdata......0......................@..@.data...<...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3407376
Entropy (8bit):	6.083562418610337
Encrypted:	false
SSDEEP:	49152:+KQVSmZZj5+LQPhsb/hvKgInTI6VV2AFpCR0+tyHlQAXyPvChxwQEHu2I7Fsf:7i8KEcchyF7xPEHzGsf
MD5:	7465FD034D92B69DD89FF32493972FC0
SHA1:	F21982CF025C47A466746C6F1ABE506A41B5B419
SHA-256:	186FF32054F9B4F66B7EDC7B3303DA5BDC271B77F7EEB369E6E7B596CE211949
SHA-512:	8ABF052BBBD83817DCA796135B971D006815E32B5F12250512E646E5FD2608A8D3A0D2A89F1DD729C102937BA5FEE5B62F2B82042ED8B9C23842B87268329FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......X...X...X..\X...X..YX...X..ZX...X&OX...X&.X...X..LX...X&.X...X...X...X..FX ..X..KX...X..]X...X..[X...X..^X...XRich...X........PE..d... ..c.........." ...... ...................................................4......4...@...........................................0.q....c0.@....@4.......2.t.....3.....P4.,J....!............................................... ..............................text...L. ....... ................. ..`.rdata..!..... ....... .............@..@.data.........0.."....0.............@....pdata..t.....2.......1.............@..@.rsrc........@4......d3.............@..@.reloc...f...P4..h...l3.............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\DB\defcfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.993464592755953
Encrypted:	true
SSDEEP:	768:kNLeCRkObMkPt7eYnnzmbSZHiET4hEQU2ogo:E/bMgt7e4zHJTWRxo
MD5:	D9C56468BD35AF910DEA817CABB81D36
SHA1:	0FC641A180809B63CCEC27016E38C2B572920208
SHA-256:	D3B62B5869035748F8E53F7A65FBA2621F3EB4C6F721C415195C34690DE51307
SHA-512:	B328512B0F2F1871EF0712121D39158C5BE0A1F594A3D5458CA4E4875DF5408DEAF250DE5E65335E17DA1CB59BBD62F37EBF791B55748E1010951BF2420D9C17
Malicious:	true
Preview:	.J....!W.4..........@ ..&\|?.v.$...#...5.....Y...9{.:...[]..X...i;.7.q..[.........`$G....).1\|E&...K.K....o#D.m.~.p..t.a$^.y.1.2c.%.....+6..P}o..\|.~.+..B.....k.5mXz.+...CT..>..>....".....9:._..$..%.Q.:..{.........l....vH... ..u.......L...C...v..Rz..X(XW..yl.$....%. ...4....W^......4.nX....U...1_..dq....W5.*<Hv.v!..........U.E\|..W...8+Y.p.(Wn............`r...\|..4.bP=.TaA..[<....5N.I..T...6.....?...H..9.R.>...H3p..q0{...y...^k.........O..[e......Y}D..wk.l&".}>.....\|W."..=..d.......U.go....c...[..-...6.].^.C...^....9.D.}..<........gXm\n-.......wv.P......f?.7S.H..:8....=....3...>./.+.;NQ..b.5.........<.1u1?...(..%.1...s.....K=3..!.6nK....;..x.....x.&..h..Pf.....{..b$.R@^Eh.m.........L#W.[...W......./.K.>\|Y...?"...Kq....G.._.{..B...{UNF.f..(OZ.....B.i..,..C..}.EJ..6.....!..$..U:...x.......I5L.>..p;'....N.<K...VWpS..98..T?..Q..+..=....X.H......$.N..e.w\|...G..XD.....^...........U.<._x......}...`.RI.`...v....c......l.w...mA.........I....hy

C:\Program Files\AhnLab\Safe Transaction\DB\ipcntry.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	SQLite 3.x database, last written using SQLite version 3014002, file counter 2, database pages 1127, cookie 0x1, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	4616192
Entropy (8bit):	6.24811983862515
Encrypted:	false
SSDEEP:	24576:0jfLR9PgLqyBIDr1nxgVniDPsbX6KTFSafxWOoJCFJ0qrmO9LMvwg3V9pVxk35R4:2z2Bcrw9iATgafxl/9LMXl9jxyyyv4
MD5:	A1356A635643AE79B6104BCDFF0EF93B
SHA1:	A02F5EF1F81089FF5933FFDC1E5F3C0CE7914E3A
SHA-256:	F826F9A857A0105544F1516E7F838BE9E1CC721412A047B5F8043A3D58A42464
SHA-512:	3934C7F776C956C8A7E0D29F695CF9E79EC27A24EA1F29B1651061FD4BF8691AB53E99A1B0DD4E239016571667818201A0339733862B8CD255B499A66587B4F1
Malicious:	false
Preview:	SQLite format 3......@ .......g.................................................................-.r....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\DB\nzcmncfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.904375764569563
Encrypted:	false
SSDEEP:	48:kFjgEgFdFy47RaOyNRVpl4nklxRTBia/ep/tn7ZYLsX:k6Eyy4wVXTfGRt7/
MD5:	5CC424F65E490FE65BB4613B7AA6EBFA
SHA1:	FEFF5751D5B9E4E9C04EBC2F9BB2E7B0C7779B23
SHA-256:	4F0654EA77519E62E61112B37485EE41623838B2B7DAFCE171D1178C68E2ABA4
SHA-512:	8062326B953A7416D4E2DCB69AC644DDE020E1E407855E5CFB31BBBE5E061F2382A52B670B28595C23C5B06C80B4981CA8BA8B339A1E1B66900342FBC495476B
Malicious:	false
Preview:	M.....td..O?.$+.....@ ...]....{!.{,...6 I.\....QS.(.B..2.j/6..i.F."..JYT.J.wcR..}.j!.,}[Q..8'.}{Pg.).....:..uy..Y(n....J..Q.a...S...3....J7..........R..k85p6.n...H.....g..W.,..#Z.._.q...\|...V"..d.........bv......x.:.-%.g.L".b....>>32.;.....:.]....`J.'..#.0.<3...~i..e&...C..M?7~.....N...[g..H...B......f"N'\|X..... ....\|[.;.Be.......=.(...3m....q.DDR.`....7B..+.4i;.........`.U.....\.5U..H..S..=.r....2.....0%...].Yj.).U..P;......avjU...d..n.....M.8....R..a.....j8 a($.5HS.X........&..w.:.u..S..NsFg.m....--....z...,...v.c.j..(1f.`..:X.6:....E.x.Mm....[.3ZK..).<$..A....4..^(U..m...w.*.p.......O. ....j%..6....._.4......y/0...G1T..=N.......=.+&S....c......I..2..~.bF.z.^::..i....8.[...!{.ej..Z0.....Q1.M.z.r..F....\C..Q..;...O.8...j...h.R..I..<..bS.w..i.b..Ud.....H8...Z...(.....#...,.@.......i..so.P{o.^.....d.U.......E..x...'.Hj..=...(...z`...5p...o...=\0.@.........[.......\...e..GA....H.;.uZ...t..0..."o.{...:.]K?F.S..k..E.A..-.Z.MM.U^>..t.

C:\Program Files\AhnLab\Safe Transaction\DB\nzdefcfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	7.967854076429251
Encrypted:	false
SSDEEP:	96:joely5G1ZepCvAaLRSMet/54T6J/yOVI6j3NBiDY8ovn6ZIl/jZqPrCjyYGd:Eed1wjaLwxt/OGJfVI6ZBj8ovngIlLZQ
MD5:	2B09D3FD0FB7C2710E79D3E95F35D776
SHA1:	67D36887CC8E1B7E6AD4F36B774811872765D40B
SHA-256:	DBE3AD374D83B5B5C3C6235F5E567D37A36DDDDAB00474293DE3AAD236E8EA0D
SHA-512:	2360DA35F3FA8D8EFA502FDF5B2F713700E109E7191E1CDA30AAFA43CA3FCD5E23E205D359AC4E16ABCA2D044AAE7DDFD778F2EEF9A4C79B504868AA34F7CFDF
Malicious:	false
Preview:	.;=..mYv.u..s..z.....@ .^P.1.I#....^n..\|_uua1c=...^...C.!.C.a...d.A.....?.!.O.....7.....R.DZ.B-...?i.q.^.$.6"\.N.e])..$.0....9. ..f.)..}...G......j........xO..Nzw......s.m.?j.I... .p..j<.e"...R"..(7:.......r../..H...).g.....}......._~ ..'..6..j...H.]... ..s2I/2"fs.................P..a=...X..D.......R..T..?65._).d.[l...?cA......4.b}..zc.j.~K..#....A....]@.\|.......xT...z.>.G...M+..2Q.F.f:...l_...C..E_.9.....m...).o.p.K..%......6......... .w.....I.....hY..,f.......&.L.QD..........?.\#..^@.8<.....uZ..n.+...3..........Y....(N....`...H.....A...@Z.#.{....~.)..q?,...1....%.b<.$_E.......u.d..]..D..]z.\|...........K.6R(.....?......g...N..p.....$te..G.o .:I.......z....WG.....x..-../.X......s..a.6.1.cmObQ.R(b..rg;...zQH @..).c_...D..ORO./_.[c..........V.T....I~$.2A._.G......ZoU.....C..V....f....T.Y.o'...,n....W...+.....)..(r.G.....3qf.....cn.@....\...7..(....;...B...Ts.i.....O.2g.......'&i....N..s\....bl...s.U..r.vQb...)...b..A....f._.w..`j...&.L.kW.....

C:\Program Files\AhnLab\Safe Transaction\DefPly\extraopn_ply.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 90334 bytes, 1 file, at 0x44 +AX "extraopn_ply.html.new", flags 0x4, number 1, extra bytes 20 in head, 3 datablocks, 0 compression
Category:	dropped
Size (bytes):	101166
Entropy (8bit):	6.451693133905403
Encrypted:	false
SSDEEP:	1536:+hEpEP/5gYdzpWdPWRBbDq5MkrloatgfPM6lKaBH3SU1jNUL/cBkvOS3ta77k5y:TpNYxpuOFql3tjxaxd1j2L/0k5M7my
MD5:	E84262438473D7C2A4BB1EC802BA4BD9
SHA1:	DCB13F5DE8A37E8F2B30ED998A00242C0125D064
SHA-256:	0EF849EB15CCD8611FA32133A05B77F1FE601913804563E54A06F8C095E166A7
SHA-512:	CBC7700A7665EA98FB4DB259D8F7D32172BAD2FEAF4AE4BB89FD0742F6FE4E1DE0E169E187E4D007143C78279D91FD1308985E2B14678874769E70902F63C829
Malicious:	false
Preview:	MSCF.....`......D............................`..P*..........j.......\`........!U..`.extraopn_ply.html.new....B........aRQzVVcvCap0mPFFbfnehPiuDZm/BlC/eVoYYpBJ3md/3kN+fbNR5xc+dlBI6Y+Fzl65f3MRUZPTZdHVnk3OCz5JUR+LB+wHkxBWjOErwFmA/GZes999xicqpCmszypX/k3+bPECGR30blrlczMAQjIrNSuduUefyvMWk0jthw/RDe92JtbDG54EZVvfbipsoIgoRBYJJ3jC44tlDPXJpNXHjqSjraTF9YJKLxeo0ZkL/5snhnczDqgkk/QsQjJimQHcrzoEujRFZHlGd62bhQfKurQNpdT89/BiOK2VETnEHnBCxvy6dNPOwkjQ3ztPLuaVSgwmWYzTiLlmNX4D9XNkAavyXc5BskhPt19My6Jb00o0UHIOt1e9idIdOOtet1sCn5oE0u92KA2FDPjQ9cCESYgkwCtHLUv0gjMfofE+TMCkDcRYygAwMDqMDZSK6XARAVkswBOsVRuDepLtQtKKQS0kLU10pYG6xV0exluT28BE9csIq0juXDFF5BsVt6hdS23uTokimmOV3W9rcpLvFJU/ZKecsQi4YJotSsg9t6rXu7n8yraU5lf/8+HJ04moqELwXbx7knmrXG+OdMv3m/WiP0o1AVmzQ16hW3AKyLRS/eaZtV6RW+zAJ4XU2L3H8XIup79ZAhKwK2Ux+7FAg7lTz8U7TC9KY7OeREqTxhBE0QLui83gUnjESA754zRjs1PjmkcahsMMfmKjzHG1pRjhyqxT6WLOQX4p+dfFX6uo1khTeZ64fbuGvXYJ55gaH5+YyayvR81KIa1bU/QxhtY5BzydvISrs9SPEsqc3dE1BoE3W6J2N+dwN63ug8ap2153AL3AbMQGub+6yWnEyclQuKkZ2m7FDHBAUC14LH6yYF

C:\Program Files\AhnLab\Safe Transaction\DefPly\netizen_ply_default.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 7101 bytes, 1 file, at 0x44 +AX "netizen_ply_default.html.new", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	22757
Entropy (8bit):	7.394463474354784
Encrypted:	false
SSDEEP:	384:AE42fdL8L81cwmdCggNsijDRfKa1FaZ4y7wa+pYQTbkZRKOBxQUdtt1sp23+r/j9:742l4IgdbKZ/FaOyU1Vbk3XDsp23+zj9
MD5:	0DFBA33282D828A1B5EE96B1A8B98B1B
SHA1:	B6046CBD196A878B7D45DEA3DD5FBE04254A6F2E
SHA-256:	CD1B42FBD3EBAF46665CBA3BEC0594B235AF81EE89ED3E4E5D3EE8561082C30E
SHA-512:	4450D992AAEC6131FE887487FDD4AA7BAEB63207900DCCED305757E8E55DD5858D4DB8FC1E93311BD3A411CC04CC8CA61BBBD17D8A4CA9249A8775082C566ECE
Malicious:	false
Preview:	MSCF............D...............................(=..........q.......D..........Q.U`.netizen_ply_default.html.new....D.D.....gqssyJ+f/F9qu8sxVUW57n77GnppHqVmjqnOjnjIisc4PSVloeqUAqduPSx5Af0c5JBBL6AK16QJSwEgEn0lBtMdgV6HIjvyQzleefTpYKacY0VBjet6kbc01ZnjlTAjpJBB231PWANtzR9jqlqMl36GoN7laNoxBpyZ9aGISfjzY1yl4vOnsJiU4rgCgTfk7qmZiDhaPrXe6DT4l9ZeO6T0NVbcIthSt+l3Hth0F3ZB5mT4GPtwQgvYFtBQGZmL8owiSgPgQSbpJ3daHOwSaRzf0L0VwfNwCrbCYlrmVVa+4B0j4oJcYatAmTGwnzrZ9m/1UR3ntfNyMilSTy2VqXnuu7R002mIf5cSUNFEDK7LJW22B/ZIYfYzI187zGTnmqbI19L4loAaWocWcL30bR6nJ9p8LZ12SfNwdRXN6wRwmTuR1tu3z2WoT5qP/EDQxsO8jWrADpwqiqsRMCGFm3G/SMW3f/LQwT0GKbxB3Ivy6T2TIl7hrCahBnXsW+16uMT4MwGO4XMAOTAccHdtGt/w3b4/B46m3FlKTqPIIb30PP1Iq8SJkDFJCY31BBPg4numUa+wA3PgaxqoeVEFczX45Sv/KmYMqQZ4EG1/jmmIvz3U48AoCqLf8Rg9vD4F3+uI39pQnMILcMLhUeJMvHR4NLex+gVydU4r5YKw9rmHGf52QTSc1KMrmeB6YKU+MEZuWZybN99h1ApApg2ddFLVhKoub0hl9t5MnKu33eN2gDp/epdXbCeHnFyHMiNO64oIbL4rMOHTsZy9kEy7/eATwhgiM5v3N1NPmPpf4QRfuZz7S8lzo2PmzXMyU4JiOZyVmWDVM9kz3VTIOjvdbFckbTFIafQoenHFRhluYX3

C:\Program Files\AhnLab\Safe Transaction\DefPly\ply_ver.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 137 bytes, 1 file, at 0x44 +AX "ply_ver.html.new", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10969
Entropy (8bit):	7.630007816314116
Encrypted:	false
SSDEEP:	192:8IYiYF82M34qFI2Pc+MKGMz+noPOjlGy2sE9jBF0NyPPVo1TSn:8IYitv7E+CXG8E9VF0NyPPVo1un
MD5:	03A78704029E1E80BE633F0AC89C7973
SHA1:	FE137FB036F946FCBED2DD12B78276B769E9F694
SHA-256:	FAE899E20F5AB6F766F51E7093063B63974B66FC323B0C0D6BFE8202895AD060
SHA-512:	73DF19FF4682556A7D721227AB4DEED7976A7C916A508919635D3D286BCC9DF035E0B958EA40B97D5DB550D5EBE73AC4020AEF1EC29555C93C42C616072E1BAC
Malicious:	false
Preview:	MSCF............D...............................P..........e.................4U..`.ply_ver.html.new.............dLBd6ido/t4Q1i+QnGlOow==0.G...H........80.4...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .;.G.I=...p@...[.0V......,"..010...`.H.e....... 4.U~_C~.........s.V..@....9.ReGp....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6f(_.s.&%....\...L.b.

C:\Program Files\AhnLab\Safe Transaction\DefPly\starter_ply.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 326717 bytes, 1 file, at 0x44 +AX "starter_ply.html.new", flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0 compression
Category:	dropped
Size (bytes):	337549
Entropy (8bit):	6.17318977867477
Encrypted:	false
SSDEEP:	6144:MbeMSlVNGtB0781MjjdY2r+Y8C44X3pr7s+Ch/watVnilRgOZc4vEw5WVuSgh:EYT2B+wuxjiY8p4X3NhI1cZeOWkxh
MD5:	14256CF22F6FFCF19878E7827ACBAE78
SHA1:	2596AFF196E36B4313F9A9943D07BA92E478A0F9
SHA-256:	9D015B29F1F3508F1625749E656DDDF5D7B095CC6D1F916DC288B7213DE18275
SHA-512:	B2C30B7CCE63D0A20015EA7B0E14AD4A5862309037256D2CCFE1AED6624C50B2E2BA7B96BC60C4501CA0255994127482D5AC43789D285B21A9BF40E7DAA35F03
Malicious:	false
Preview:	MSCF....=.......D...........................=...P*..........i.................4U..`.starter_ply.html.new.............oSdf4GSKNQPEWl+fxsL0B3w5SEDe8DjEYzYvuV6oNHBEPd+4CWq4wStlF9fDZaUsoYzkk2Czz3QlBEpVh4gG8QdH/f6IlF+quzQKd1WdZfgQmlUxSZ6FPmLckIKMq6WSw+Olf9raonw/lesMF76JezCE0uihs2kB9L7bjFbK+54z1JNX5Ois2RE4iHGjNEy97+Mxuy7KRXQz6zv+bCkGiRTx7FoX7Zg+LyUx3RRh4QymXSCPWK0m7738ZG33jXYopfmygv7OebRuGFG23uh7b2PooBYmLPEbxs7W3hOjPNVl6Mkr+tK9zmmbxTgkqAAa/TU2xcj9uIN5KnM6tiB/IIUGNtDbQFVc19PYCIv4PMxnkYcRKuGhDLq8t+lcS8PtznfsfEak5iQobjUbivG6Ry7aSDNB7gx8nX6Qq9t/i6X27ZEmH+PdVh99kHbkBbQsLBaMemC2oAuWm3PMlnWdQn2aKHdzQPVVCIbKyew4J4gHp5MX1aW+CVh7N3ZR3EChPvycpPdBPLg6RCBYk4eqQ4FmSnSHeESaeopDa4tJc4/FafwRlzczbxK9hp0SHNZXmjsm10xAUPJNUNaFsmC2wKAcMhD/buA7AqwgW0j72jcm94BWaL7egEtYJ8cvzywti0OpqfT75oHvgd5zNJa11ec5KmkIUvntG5ISjpjgFFcu+9nI+6MvHrpjiINx121BiBzOR0FMPsORI4sCXjYDz/VzDkOgsFc3eRBoWzUARDegHhIImMrJna5bzkfkOBhce2JzfdjlfS8QHs5dfxwp9S2Lztkalv/kuN8KfjiU7qxkSqBgMkfjSvyOF51LgNCNkG6t88g6UGxfACldBcrdOElauQEfNdSmejhzxUi3UlxFZPgKxf0

C:\Program Files\AhnLab\Safe Transaction\HsbCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2680344
Entropy (8bit):	5.846107201304436
Encrypted:	false
SSDEEP:	49152:VuaqnXgTj2qYXqeVDd0nyvb7792klH3hJvx3ZOVjzw:V5T8qeN92WZJ
MD5:	D5DE2FBF011CD87778931A1687DFEDB0
SHA1:	9B31D1B262D06CDCD677043D0AE22FEE1E9F36F1
SHA-256:	6AC3304FC9C8A6F4FDD8F06C8D6B36564C7221720A42D5748D190400C8C71FE0
SHA-512:	63D7B7387C7C27E654D8CBC04182DC35CC33F838219707827823575013C2D6E575194BF0747C429A7575983DAA1AA0B67EC33D1EF6ED22B6E2B63B5A8F7E78C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.v....N...N...N...N...N...N...N...N...N...N...N8.cN...N...Ny..N...N...N...N...N...N...N...N...NRich...N........PE..d.....c.........." ................x........................................`).....v.)..............................................Y&.f.....(.......(.......'.(y....(..*....).H;.. .................................................(..............................text...g........................... ..`.rdata..6...........................@..@.data........`&..&...P&.............@....pdata........'......v&.............@..@.idata..6>....(..@....(.............@....rsrc.........(......X(.............@..@.reloc..w[....)..\...`(.............@..B........................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\IAccessible2Proxy.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44560
Entropy (8bit):	5.893482922203998
Encrypted:	false
SSDEEP:	768:IdJtnfDOV7zIKk2AIPzwfJkdFLYityXlEnZF:ofDOV3IKk2AIPzwfJkdFL7MXW
MD5:	BEC8A457871D528FD364F49CCBD440B7
SHA1:	FF7DF1FAE7E308B47C3F2F6D0B94C4421A59AA99
SHA-256:	9D30971F21A14CF7EA0E04EB70FC1B08903038FEFC275B74FCD55E39EC23F687
SHA-512:	94F9ED7FF211731A76947D5869DF76FEFB5D4D1EBD3ADD3B5FDD20BCD4538F54C1A40F5DC39CECBE566DADDA022D2AACBC9B95DEA5078359D919ED078FDFEE3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.)...G...G...G......G......G.<[...G.<[<...G...F.".G......G......G......G......G.Rich..G.................PE..d.....(c.........." .........r.......................................................................................................}......,w..x.......(.......................... 2...............................................0...............................text...1........................... ..`.orpc........ ...................... ..`.rdata...N...0...P..................@..@.data................b..............@....pdata...............r..............@..@.rsrc...(............t..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\MFC90CHS.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35664
Entropy (8bit):	5.58023144464701
Encrypted:	false
SSDEEP:	384:wwxPHe7hDWEWy5uxcx37Xtqh5iHulR1uwTvh6dKe/VD9OLH1zLz4qjXHUB:LShL2ctXtqPvRhvhynOLtz4qjXHUB
MD5:	3D158F9970E98046E9D1CFEAF3F80007
SHA1:	C5A9CE5266AD2E1A635719C05FAAD3BCC6F6AE94
SHA-256:	71415D14B066E8A70190197FC09686AD0166D3D2C75ADBD31E6C1830C7E18371
SHA-512:	F49CFC46AB5FEC9AF14EF94A6EA07D8DFDD4621A037668B1417052078FF69B2FEFC89EA5DD4C055F8B1E8E43DEBE2C4F617B4CAA048A7013B77F962A629AB60F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." .........r................6]....................................B.....@..............................................................q...........t..P............................................................................................rsrc....q.......r..................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90CHT.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36672
Entropy (8bit):	5.588028174926814
Encrypted:	false
SSDEEP:	384:ldPwznjqQOl6HyLW7WyJMU9sNCR0OL5AlKwKTF1ECAiJJSLz4Z1joQ3C/:zki8SS19sy1KKwQ1ECDJ0z4Z1jZC/
MD5:	72C8232A2626743724D79F4D1684F3F3
SHA1:	44131077ACD660001C7C61409BC7E38C5D95FBD9
SHA-256:	8585A855C4A8FDB975A2B26CDE76B22CCD23FE19152D92FB47B30C7ACC7A966B
SHA-512:	A2E2864F8B75FCFF44CC791E9A394E928D3E628D5481E532C4F851114F1CB95A307B31CEEE10DDEA7E529C14DB7C804FA7E559DB5921A1982EAC4647EB601464
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." .........v................6].....................................a....@..............................................................u...........x..@............................................................................................rsrc....u.......v..................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90DEU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63312
Entropy (8bit):	4.147046570661323
Encrypted:	false
SSDEEP:	1536:4AhosbkV8vJVQPu6V4Z+e0petNSaQhp0vcsjsrAGeoDsaKtq5w:vhosbkV8vJVQPu6V4ZX0bhp0vcsjsrAF
MD5:	275AAC23549087011B2996C57B6AAEFE
SHA1:	F326FBDC1ED197EED3663A642609CD1425FF1905
SHA-256:	466E9AB397CE17633D2848B05435B49F62FDCE16592ABC247FA5BAA2B59CC850
SHA-512:	02FF0B3F5B8FCABC85BD6645CB1CEDA6F189E371BA00A8E57C501AA1115ABAD505672327B727F0E993FC99A330058B55FDBE04099149D7D6651792D766F9C965
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................A.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90ENU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53584
Entropy (8bit):	4.231898414434443
Encrypted:	false
SSDEEP:	768:3UrE5Ev1Y6BwLPLNq5f/nWHBN1eOU2fd5iz4qjpv3F:301Y6BkPLNYf/nWH5TdXq5V
MD5:	FC70F49F1B15802F5AE7F818AE3ECBC8
SHA1:	059F44050DF886BC74F60AE29178D634D328E848
SHA-256:	1F471B87324666B45DCDA7AF69D8109240E632F289A81A02FDBE1EFDBE75DC7A
SHA-512:	8EA60C31B49E1C839C5099A9518298E4DD71A056A7D774139BE319A30A6C4D3DAC441F06E2EB76376D08646EBD4F10C0A19FFA50B5E7309488189390E7BBB3D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................4....@.............................................................P...............P............................................................................................rsrc...P...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90ESN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61776
Entropy (8bit):	4.107682732404191
Encrypted:	false
SSDEEP:	768:cOmcQ3ulNtMFZEGBFCDCDheB5xaV59+IIN5Rz4qjXHUo0:FlNtqZEGBFM0heB5+99ICqrHU7
MD5:	6D9A46F763040C86ABF1950F211FB1BC
SHA1:	17AB5398C9B1B5B564FA478CBD5C29803DEA6EE4
SHA-256:	CA8556A58B920D799BA52C07AC85D10C0208EFBE4380058C47C124DCAA92F67A
SHA-512:	745BF74E64A3A62983E3FC1D98EEEE82274397397D13C292DACFA0734FC66131713EA758EBE933365B2731DCE23527E0492310A2656199902BA1B558F22EB90C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................L....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90ESP.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61776
Entropy (8bit):	4.107209507419263
Encrypted:	false
SSDEEP:	768:4OmcQ3u7TtMFZEGBFCDCDheB5xaV59+IIN5Vz4qjXHUM2Os:p7TtqZEGBFM0heB5+99IWqrHUM2Os
MD5:	C310853379DB86E6B0C5E4095F156F52
SHA1:	C1B2AA46AF4995717C84CE0BEBAAA47A2D3DA237
SHA-256:	CF9F783DD28CB8BD81D98F0F88C1AB924E233DF7DE26788720D181C0034268B3
SHA-512:	318ED84728FE2D4A3942FEDA6029B64E603DA7396B9BA04576BA32FA697CD736930488EC9C583CB68B8586051D8B13F209534D066074565115D94969E3CAB724
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................(.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90FRA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62800
Entropy (8bit):	4.1190781529301965
Encrypted:	false
SSDEEP:	768:3WcDf8GOQOj7e3RAaTaPCeyGdZmZ5fyyyyyyyyyyyyyyyafyLVyWong3+vz4qjXc:xgQZA2SCeB0vQJqrHUm6
MD5:	AFE56D7623448D4C3729DFDC8E56C2FE
SHA1:	FD5BD8C48537AA145E02EC143D0E655818B96E0C
SHA-256:	311461ACA503F947113D5E66DF8BB996A3FC2506A2763FFE8C97AA66103D7A75
SHA-512:	FF06FA8ABD8AF6D6C680FABABA4B7B26A87AEA8E5A54E42FC94D9C84012308BB01FAAC2378B9507317DDE7FB616CDA13C1109BC42F4AC72EEE0FC5B4D32F7B3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................[.....@.............................................................`...............P............................................................................................rsrc...`...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90ITA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61264
Entropy (8bit):	4.101771776541544
Encrypted:	false
SSDEEP:	768:5fhqLysnKliCz7PxdIlWXgiCnPOCeFO/hDsiZUWTr+z4qjXHU8t:OJuiCz7PxdIlWX/APpBT5qrHU8t
MD5:	4FF530BADEE863866EB1A02482E3BADD
SHA1:	04C679CAA989A4B10B45FCC404EFDD0CCA0A32DF
SHA-256:	E96126F9D9F5ACE396A7769470A77E035674A583771F200E393D6389E47340D0
SHA-512:	D489379A471CECDCB7417112E42E3CA727DABC2764DE222EA74FBC88DA2FFF5267B8EA7F7A1A0151FEF829BD615D0A1BD37118BF48E28A50A5DC72CC0F340995
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................$.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90JPN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43328
Entropy (8bit):	5.431136968953999
Encrypted:	false
SSDEEP:	384:iIxeR48c4rAmWoWyI6JMQ7axr10ahVIpbhYZTZ+HLz4Z1jg:5ARcEI6JM1r10OIthDz4Z1jg
MD5:	B5E78AC7392C21AF9AF0D34CCED932CF
SHA1:	AA6E4AF6BD85D58E52456FF1E86BF90187B2E423
SHA-256:	D397D7C2BF5C45E1C8B6129248D23DD7B053CE6E70C2633DAA3B931B054E9984
SHA-512:	E2A49519B60E4D59A968EB90A73F6C1C54B2ECDD1D5806F0A5A223958947FBE32EC42C9A7251ECCF74DEA836DD94BAEBB23DE2133B3FF7843ADE697EDE47EDBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................V....@.............................................................8...............@............................................................................................rsrc...8...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MFC90KOR.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42832
Entropy (8bit):	5.538055863229217
Encrypted:	false
SSDEEP:	768:GekmG+rCzaraHn9vxB2c7Cvqnz4qjpv5E:GEGlzDn9vD2c7CvqEq55E
MD5:	120B9C7E4EE56BE14F7714AA7F7E9EDF
SHA1:	8F9A0189A53CA4EDA211836311E7466808EC16F6
SHA-256:	F3733F7A07CFFF9C6F8027F18FECC7D95B6FEA6FF9399494F22DE4A4B0E9EE46
SHA-512:	27231F6367B379BE8B336DBCF91876FB54C190624025E2F6687D581F21C6A87E4333E0C0D2577365C81AB3AEF316686B35D40B28295424316C18D3F6C5138491
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................t....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\MUpdate2\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569664
Entropy (8bit):	6.521726174641651
Encrypted:	false
SSDEEP:	12288:iZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8bw:iZSZ13iwJmgLq83Ooc8SHkC2efw
MD5:	B2EEE3DEE31F50E082E9C720A6D7757D
SHA1:	3322840FEF43C92FB55DC31E682D19970DAF159D
SHA-256:	4608BEEDD8CF9C3FC5AB03716B4AB6F01C7B7D65A7C072AF04F514FFB0E02D01
SHA-512:	8B1854E80045001E7AB3A978FB4AA1DE19A3C9FC206013D7BC43AEC919F45E46BB7555F667D9F7D7833AB8BAA55C9098AF8872006FF277FC364A5E6F99EE25D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<.......................@.......43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\MUpdate2\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653120
Entropy (8bit):	6.883968356674239
Encrypted:	false
SSDEEP:	12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
MD5:	7538050656FE5D63CB4B80349DD1CFE3
SHA1:	F825C40FEE87CC9952A61C8C34E9F6EEE8DA742D
SHA-256:	E16BC9B66642151DE612EE045C2810CA6146975015BD9679A354567F56DA2099
SHA-512:	843E22630254D222DFD12166C701F6CD1DCA4A8DC216C7A8C9C0AB1AFC90189CFA8B6499BBC46408008A1D985394EB8A660B1FA1991059A65C09E8D6481A3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(.......................@........3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\geo.asd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	7.994355090548138
Encrypted:	true
SSDEEP:	768:8y7mHOHw2Ep2YSV5y0USkMestCHr5+WhGDr9bWtdBK1L:8yyYVYx0R/te5+nDrFWzkh
MD5:	D3CA79B1819D835C4C0EB65CD39804DF
SHA1:	9BCB10CB6BA5535C1BDFC3720366E6CE3D3E2A1B
SHA-256:	FE2CA2FFE285326B0B7059C245919312FFA524072D2CEF52B62C051D0B9A8DB3
SHA-512:	36A38FF6670CDB71170D558BA6B7FF8074F3CD0CBC8A56D0CE57880F62B9C53DA0BEC20CEF815C722F76062A2C112377C28B678673FF03E4A54BF6F0E070F443
Malicious:	true
Preview:	j....0V^...&.e$:.....@ ....Ix..>0?..9f.O\|+d.......`....I...'F...R.....L.G<e._* m.K8.o.v22.J......'o....a...s.wWT....p._....^U..p!.m..........7.K.pE.A.....B.....5g!@J...Q..<2.[[j...v..S.:.B.M......w..<.......U....G.H.D...........e.....q..n...4..D..a..v..6^L.S......A.B.7?.-.....u.].8...?...47...;.;,....<.-..E..p\|....JEg$.......bN.~.TC.n.Y.......i;E>....<q...Y.V.S(........k........u...H.Q.....)..4..Eu.e4X.......0.o.H..u..*K.s`D.l,.t........Q....l..X:r...g..fx.:..u.'Z.@.L4^Sk...Y~t'...gz.TV$...gqX.....[.k.....6J...@...3..y.\1Y..%..7.......r^&~^....iA.T...1..m....6V.^&...V.r`....nu..Dnw}...w.lh\)gW..20....Jnq..b.h..e....x...........e..$1g.....,..%......'N..,D..z.lQ...YD.....-.....(.{. .,.~..2o..F$...sA;...~.R...../g.Z....B.xL....8.Nm_.M..1..2,M..>Y+v8...2mY.....)T..;U/.`7..x.rt....<...[.S2{]....2T....7.V................('.f.@3B..x.....P...bjK..."p.#.k....@@.89..o.+..9....3z...1.?..k.d..#...nD@.Eqr.G'fx..u........b.

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\gof.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	25440
Entropy (8bit):	7.993411583727329
Encrypted:	true
SSDEEP:	768:Wdf+i8iRpBKOPfT5f4Qp0VHcCZnbSyPFpEOYD/yG+kq:W1+iR1f1fpacCZW6FpEOYeGw
MD5:	D08863D5E8069D42ABB577E5525C5D1D
SHA1:	72787582F5B712E81D067BD3D0EEC7E5C79A2DD0
SHA-256:	09608CDBC5D4B6E1F9F0BA409254441024855824C1FFC8789E276A9F3DF95DA2
SHA-512:	EC487249B6D9DDB94AC30ED7C707BE397E40E96297F90F54DAD541E16674EBB0B70958C5DFE353D4FBDCFA93986D2A967DB880482B675778F3E5AD135FAE011B
Malicious:	true
Preview:	......g".XU+`.<e.=E..k....4r...I.z@.I.k.....4.\|..<..$-/..w...........l..>.......VNv..+l.%..N..A;...d.P.....k..-...AK..]..i.mX.B ...9...#I'c.......k.j.+.JH...,!3R,g.W'7..s..Y.V..Y.G..T.........;N....5....&c-].y.s.ue...Ti..p..K.+.....v..@./...8....+..a..}....pu..x]B.Y......i.............A...%.-..".>...L......;n..w.E.....R,I.k..O....T..;[.Sb.l.2..vz ..M=.4.L..t.^...z..E.....@...k.n.".jn.x]....ST..d.........2pl.V1$C.A.BQ.v}v.u....2u.r..q.)r[V......f1..K...P........H....s....z..',..P&..,...H.....7......L.E......]...(..J.?......!ti.}?..w..#.>V!:..z.....1..K....4.i........W....S...lz%7vE...3.......[.A.dY...I...6bZ.......K.B....?.VX..Sy....-...R.g.).Z9bU.gd_.X.(..3..G.n.+......`.GS.K.8l....I..t.x.\|mY..Z.9..Dzx\J.....K}..j..u...%..YQy1...bx?s...R...vNz...-.........\...V..+..^dy.H.~.m7Vo^Zn}.y....Y......Q.F.J.a.w.4....._.HMP....".1....BmP.C09..R.ex.v.&.).ikA....(:.4.............'.$=OQ.4i...K..;.w..........n...;3....#.r..[...Cn.

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\libcrypto-1_1-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3215640
Entropy (8bit):	6.774316456941846
Encrypted:	false
SSDEEP:	49152:8VwASOZ0IU6ibGtlqozOh5P0TW/0z6a69XayVBpXiwfrdnCMvg8dP6Ip8RZ1CPwy:6b+DqX6TdxvDEIp8L1CPwDv3uFSH6
MD5:	9D6D2FC033754ECCAC6FA8760C33D06E
SHA1:	A416F37ABEAAFD6F1AF1317192DA8B4E24E8914E
SHA-256:	F39982B94C69D76BF6F63E73ADDE53C858891FBC0EA0CC0D743EA8AD11D77E76
SHA-512:	FAD8CB012954596AC965DF456B33048E61C6F9709CED6E1529077C7631E105BC3801F4405604AA1A4B15BEBDFCD9293F1619E4BD5635AB1669BB9C59F3875DFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3..]..]..]..Y..]..^..]..X.c.]..X..]..Y...]..^..]..\..]..\.\.]..]..].t.Y..].t.]..].t...].t._..].Rich.].........PE..d...Oj:b.........." ......"...................................................1.......1...`......................................... .,.T...t~..x.....1...... /.......0...... 1..V..p..T............................................"..............................text...."......."................. ..`.rdata........".......".............@..@.data...\............\|..............@....pdata....... /.....................@..@.rsrc.........1.......0.............@..@.reloc...V... 1..X....0.............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\mdp.scd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1023346
Entropy (8bit):	7.36193105888848
Encrypted:	false
SSDEEP:	12288:ZN1zDmTseudV1y2MltTF4qcetHZD+lzoFgKTjDlq8odbvJonsd9JbBvILL4mHJ/6:ZH/IMf1jQtZ4qce7DxAnbBcpngr
MD5:	59138020613C6F1CD031541A57BE9888
SHA1:	D2A63DD0D9B5370EFE6E32795366187174A880B7
SHA-256:	ECDE4917B6D7462E820C1063330A86A3A7B9FD11CD7132A50656B3B1F26917BD
SHA-512:	A2C9904CF8950405B4401DCB9FE7BC2113CD99C79FFAC97D32EA730357F05C7A272E081F60D6B8C2780F33C9D26EB576BA5EB319FBA95D52EF54EC4BD356588C
Malicious:	false
Preview:	AhnLab MeD Technology MDP Rule Data File...........s.Uy~...............5......JKCJSWOTHSUS.s.....................H..ROGNa[SXMWYW.w....C.OSKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKKJ@WOTHSUS.t.:...'.........9..bibo2woJ:sus9u$s...........%..+...............BA.:.JnF.?3L....rB&;BKSGL@.MK.k..;43:B.?D8CFB.c..=B:..NFK?IKI.j...KCJSRNTDSUSJp..............W.CU..DOGN^[SXMWYW.w...C.WSKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKFJ@WOTHSUS.t...............9..bibo.wot;sus9.$6.............%...............7..AB:AJNF..JOGNS[SXMWYW.w...(@.USKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKHJ@WOTHSUS.t...............9..j3jRw_tMsGsj..7.............%.....;.........4.."B%A.N1K.J)J.jD..C.B.O.L.K.KJk...;.:.G,D.C#C]c..`B:..NFK?lN....qJ.C.S8O:HSU..:.P.......D....}..Un.`.s.q.A.s....Mj.l...G._.w....Rmz.y/.Y.k.O...4F..}.:.......O.?.O............AS..\|.........S.A.J"C$S'O!H'Uk.].s............sZ_.6%/e?Q;f4"A.....HEAHQ.JRF

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\msg.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1666496
Entropy (8bit):	7.999895263234597
Encrypted:	true
SSDEEP:	49152:CtGnBjvyXRVdxgrPLvORcEKrxhh9ILt1kBDoNclZG:CQBjGIrMcHlh/IPkNoNUG
MD5:	A2084E2E1971E61EC04B1D6F19AB833E
SHA1:	093DEFCF3432EB51449C355DFE00836DC201C8DD
SHA-256:	8FA1CAD5599A318702DE04861AA8952A4691CD067737588F459EA37836E28ED5
SHA-512:	16AE5E8AFE92F5465241BBCBD2EAE2BE5F41271F277066EBB7DE885B98253A645BDB71FAEC08DA0BCAADA3A8E30BC319D8E693B315C42A79DFA24E8D647D51BE
Malicious:	true
Preview:	Ai...$...m........r]U......b)....S>.4.{.....8...=..p...$9)...m.J..M....K,w3....i....kh.o+..e\|S..'.H=.y.5_....V..V..~_.F....I<...Y....t4Z..i...j....9@6.v.H..q%...Z..9..(... 1...8;......y8;m.5.x8H...HO.5.wm.=.-x...f....R.....tU...>_-..(d..+.?~.%. T(.A(().MD....g.zu.8.yEK.HW.R...>.8..\|@}P.JgK....1<...R......@pW....&N.B..V......ej.b.wy"2.9l.5.T..../.......B.J....jQ....q..)...Rx..O.qc.\|.d.5...O...t...]..a.y+....d.<r...o..vVt..N#......./..4>......i.>......p....b..E'4...[...U...cE..W.=..b...5Q..CTd.e.^.\|R.5K6.'../..s.?.$.... ..St...&.....Y?#`....\...w...'.uPh34P....2&.B..\|..'{...d.4..............H\|...w#.I.A.H.^.....e...qD....h..............[....P.......W.jn.%.....y..u.3.....k.%o....z.m._.!..n..3v.3<.........D..s.%\...."rN....q..{."R....aWj...y.2iq.M=.^.~....a.$.."..@N.......w.......]Sp.@s..I....N..?p....2{E..n..Q...f.......G....J.....Z.#.A...(......y...Q....}....Bo..X.\|;....7......u....$........!....0.....\|.r.P..}....d.Z..)D..q.......Y...L

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\uh.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8655860171879
Encrypted:	false
SSDEEP:	24:7+V50HeJqFj9j/Vhi8JqDn0OAsYg+MuscyWJyoXVU8/bBVM0JW:yk+AN/VfJq7VhJ+MusKyoFBzB/W
MD5:	562C353E6B4F038CD5B52EAD4D5DA77A
SHA1:	197EED463470156F4564896E5E4572D222AF0466
SHA-256:	06A0D4D25F8C9C01F1B05492FF7FC1BB1531421FC5F2BA640F2656939FD04AEF
SHA-512:	8A23C03C0F2C817A6B468490F49F1F28573E1965118959610A4A8215A9E0FF207F65AD02690A94798EB6575036A8006DC98568148D66463E84BBF0E7BF2F0867
Malicious:	false
Preview:	......g".XU+`.y\..{.:..OaNS..H6aed..2...y....f..Q...Q=A.v.zZM_...6..y...B....R.@JdT......5u~...xc....I.......>...E....N....1.9.a@\|-...B.}.B.8f....%P..zT.6!/Zg.....#....A.....zL._.v..K......@d....u!.$.#.s.H..< ....C.d.L....~..qq.r.1R..N,Q...]..F.{i...\.w.L....$t;.H_.^....-...OB+5.b....A...we.fJ....$.,.a..m.F......]M<?._j.a.kz.....f`....x..%..Odz.....(:iw........^x... ..%.B...t..8i.):\|.....[..oq.Ogu.....4...\..n...e.3.+N..[>...].s.....x^.A.J.N....."y....w.8..-..a..S.g...o\|.6.@...T..N....2q5....d...<..8M.........O91I..E..l..2.4r..3..r..-....R...yg[.......?...GMZ..K+%!.wW{.a.F..Z!;!.....UL....K...1...R?.....M.e.m.Z`.@Fa.F7._w.`%.T.mx....T...3.......46U.+.....;7..s..C/..=)..5.J..2.hS...:...9m.w..cPJ(n2.....H..x^..Y...R.y.?...<Y...5(...j..X......`O.....^....[}mj..}q..C.k]:...G.4.X.X..z....._...C.m.....C.X ..e..A74."....IN...$..G..:.kI.+...FJV.e..^..u.....Dr..A.Z..\|.w.......^..8/..~G...B..2..2....rj..5\|.k..m..@.s.I+jR...t.).....fp.....".

C:\Program Files\AhnLab\Safe Transaction\MeD\Definition\wlist.asd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	493566
Entropy (8bit):	7.81581227839091
Encrypted:	false
SSDEEP:	12288:JBb74u12ILVyTW/Tc1nW8wDoDqvpI3faHGuwuuSt2Y:JBbcfILVy2L8IoOvW3nu8St/
MD5:	C812F7791912E817E79FAC44361C3835
SHA1:	AE36E182A1124064A1192C2CF253F1016182AB06
SHA-256:	D0B9EE8D937DEA3A7FC058A5412C7518DBA0F4F31A102660986D15A8FF9582E9
SHA-512:	0CBCBFA857A1BE6B94AAC9BE4E5362A3686D8257841B2554CFFABD93F36C64D9055F0D333BE90C6F6AC3B94565C10EFFCA5BA27268D1E163C4B169CF95BD68EC
Malicious:	false
Preview:	AhnLab MeD Technology White List Data File.............{eM........JKCJSWOTHSUS.s.......................z.1.8....M../....".......{G.......e................7......\.....7.......s......-..Q.............p.....8..;............................&.........`......H.A....................}......v........(e.....f+#.....R.........Z.....ml...............H............................W..O....bO......u.'.....)......................b'......................\|4.............`V......2...............P.......aJ....j................^.............&i......,.]X....0..........G......j..............Z.{............\.......i........J.u....F.......L3b......u...............h.....3..............F.z.......V....j..........E....c.......`.........+!.....%3....r........z.....>1.3..............j....................i ......?.~\....4........6.......k.'............-................................9...........0`........f..............J......4.............\|.Df.....Y......H................1..............n.9...

C:\Program Files\AhnLab\Safe Transaction\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	5.38478122745935
Encrypted:	false
SSDEEP:	48:3SlK+vU6gaAg09kkKb+Ezo09kkK/zzbK5C09kkKsrzY:Clt8UAgXk8+E8Xkaz/MCXkJ8
MD5:	A806C2A878EBCAA97F095E204AD23527
SHA1:	83EB34D7CED2B9DC71DBB849AA21EA78EC45A78C
SHA-256:	6B737568E1A12AB56EA091427B691B0FB5391997EBBDC4353C4ABDD2786E110B
SHA-512:	52149492ED4FF37115CB8D16203BE2419B692074824EDE86647CBC1B9CAA46D23E04C9C9D8979E512EE09933D46F69B7B384678E05B74ABEDB81BB9AB6917263
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="1b065fdf0cb8516b0553128eae4af39c5f8eeb46"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Vy8CgQgbu3qH5JHTK0op4kR8114=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="45d3027d87eade77317e92994790598c755b3920"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

C:\Program Files\AhnLab\Safe Transaction\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	5.368010340567118
Encrypted:	false
SSDEEP:	48:3SlK++U6gdeB09kkKLzs09kkKDIzZOs09kkKJnzE09kkKK3MgzY:CltFD6Xk24XkBUsXkEnwXkpMg8
MD5:	EF0ED5B8F33C0B526101778EB14651F4
SHA1:	59FC443FE4A93669ACE0F59FA7986BC9A04A400A
SHA-256:	0E840B3AEA14A2DD7F84E0E6A923ED4B40EB139BECC2941C2D67A395DA26879C
SHA-512:	C0AEB711A3DC8C074577EB64433545A05DFD7BAB1259AECDD10FE2DC54BFC45463CE62D70C21302F3F136FF10E4FF48DDEE4F51CF018CD162D7FBC3834802BB4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="7a86bbafeb8fab5ec5e6b34f226cde1ce9a1ae9b"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>jknaTCuYm0hCeoiYG7L8EtQPel4=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="1817389f2b3d7b9fe5c4468c6592c536a5c2b842"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipprt.rul

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	7.988215448875895
Encrypted:	false
SSDEEP:	384:7MwJ7JA2eVbEzFph4XQ24X7tooM+XJybmwDbFtSZQ2kC:7M87JAQbh4XtI7tooITDbFtSZQ2kC
MD5:	3A28B4C88E01A18E52E35D3D7B55C6E4
SHA1:	0BC5BE2CC060D68810FEAC1EDF8A1943B1429E5D
SHA-256:	48F8CA22A0FE2FE2B7B89FF415E04F83C893E231DA1199C065810D71BA52D564
SHA-512:	B685ED4CE23174F1200AEC65BEC10D9064617F75002E5DBC4DB2687C3EB6FFE03F4E5E6976E04A1F518C06B054436641D9BA26F0FDCF42A421D0C69D90C8769F
Malicious:	false
Preview:	.P..&kc.w3.d).u.....@ .....7~I......8.....z..I.W...+#)gS.aL.............~..2............].ly^.jm..`l..d<%5~.6.h:....Fy8<<w..Y...z.."..E#{.L.....Mb./.../;.[...&N..\|.pI.9.i.t...#.6.v-..EU.G4.W\|.$P.\N...l.v).$}.. .y&.m..e.$....ZN..@...eB.....rL..^..<K.....z.l.n...G.C..l..i..A..t.z.......rV=Sn.'j_......t>......x..1}..5...&."K9....QM....=.R.....p..?..`.V..... ..[..&.yE....!..(5.9.h(:k.). #..O#^...t..'c.N..*...@Exy..-...d..P.(G/......6...Q.(.q.c..J..2.=..2C.W.A.~...D....jL~.GY4....f..I..)..`..],..T.3!6AM.:.vXg3~.....\.g..~......W.Qmp.B.@y=aO."".......pq>-r..........1..\|q..2.E..!DPCV".........\|{1c.ySL~..v.D...<QN=........8Rl..T...._..!..1..=..lp..3.Q..>.r..\|.P...".L..h...G.....S.v.....>.z.s.$...G.!......v~.@{.1w.o...@.....;.}.w..[-l:a.E.[..........j......&...].7(..p9....A.[8].-.......Pq....R-.)U.m....h'..."...+....G.....j..r4...3.p.......s.c....Dn.q"...nZ.a.......0`.H...P.j.1..ln..1........Z..P4.......q....c...\.e......i....r.....G.{

C:\Program Files\AhnLab\Safe Transaction\NetRule\tnnipsig.rul

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.998582722595543
Encrypted:	true
SSDEEP:	3072:IYNBriFUd4hT3TTblAs0DUwA0Jv4QEEv4+chBAFsqOVYRWe7r:BNVizTpAsIUwAUwQlEhBe06RBr
MD5:	4F6ECE9FE521269B3D94F2B8698CB12E
SHA1:	3FDD3955E05BE86F2A65FEB9AEE173A81E88B56D
SHA-256:	0E1A8E296DAAB3623FBDBE25142741DA0DEF87DB226C980FFAE88F97CCBF999D
SHA-512:	7B7FE7EECB936203532BC6281AA38A3F9E0A0301EA032B3CCA6FE28FC1E25690C5F15533B79BFE1A6346CFEB0FBF221D30B201BB38D1693F0015EDDBC3E8DB1B
Malicious:	true
Preview:	) .@.M.....#...&.....@ ..Q...+.JxX...{...Iz#... ......5Mq..p.[..]A......K..l.ji..C}rN.u.[.Op.y....:K..".....0.O....;.q.0,.....A.......(l.-.......xsy,u..i'q....\|...?.....#...~..Dw-.M../9........iiZ.G..2...u.g...,>....S..K...J..O..9.4x.....g~z.%%......F..o.....P.sKY..-.^..(n.....l....&.gn.(...K.............%..0.k...G;Q.!v....'gd\|.xy..q...3[.(..E..Nt..[.O..).Je...{......!..<(..B..u.K.!...EP..x...$.......l...ED.T..e=.C.."..M'y.......FT....D$.,......nj.D.1.s.-w"...V..$....)...E.(p..&e..N<^..q&?b.r..+c.`.YS......EL.Sceh...v..zV.......\..f...[(..........4..z.#4-.....B.{.:....6.m..@......?.....r.........../........5..p.8.k.t.k.{.d..IB>.......O....c.......TX......./..[#...w....+...,..9.Gf[...-.Q...T.)6....W]....q5.p4sj.].....28d...\5.x..K8.P..+.+z.^...V..UO.v.>...n.FE.4-.@.._X...>G...@....V.....w..$R1=A.ek`x..oW].d?......BB.".....~..5.........'.....`D.fTBH1R..9_.7.}...R.R9\|.../..#.B...0.;.lD.8....td$.....$.lbk..h0s.(.vNO..l.kT.<Z....0]c....

C:\Program Files\AhnLab\Safe Transaction\Nz32\AhnI2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1341696
Entropy (8bit):	6.755727956102957
Encrypted:	false
SSDEEP:	24576:gXxVXQRORodg5Dmc9rBSxgQsymAKwWWK8fL+mKRaKFz8B:ghods4O8QCGxFz8B
MD5:	0808F116CC20A018B1CFB4B146220826
SHA1:	0B2351965546E478C399906211ABAE0C0D8F5FEA
SHA-256:	0328537F8E3D9520D6EA6C7F226A996B7987070792E2AB717DBC0CDFDA762653
SHA-512:	4BCC4F54AC9397AF559917865DFA5B6426178E1975B77CA7679A18FF8A7B66BF6E2A8A2EB969D2F4DB5B5AFD45E3459C090B9A0EA5765890E46B49FB30D4BB7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#...p...p...p...p...p;..p...p...p...p...p[..p.X.p...p...p...p...pP..p...p...p...p...p...p...pRich...p........................PE..L...=e9b...........!.........\|......................................................F.....@.................................Ty..x....................Z..........p...P................................o..@............... ............................text............................... ..`.rdata..............................@..@.data....S..........................@....rsrc...............................@..@.reloc..n...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\HsbCtl32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1699352
Entropy (8bit):	6.78854889801263
Encrypted:	false
SSDEEP:	24576:Sh254bNhfyVXbW5cCnYEYSOc8ctKSYn3bzMXpwWruZp1pSrdfkCG3NDZnPPM+GhL:STGOYF6CQwriGvxZnPP5GhPE+9
MD5:	969D634F75112D9203FB678C3CD7BB5B
SHA1:	AA65079E33DF01C519F94610A4EFA2B8006E9791
SHA-256:	2CC8C83DCAFC45438B15C2AFD8C122F24C0BA623AB30BBF00F5962FC339D859E
SHA-512:	3C8A3B6DA004179416F1198646575FD047D674ACF6BE00E577EA871F13B5B75F3577CE61589A1E1ACD179E7C328304D0D0BAFB6599E2C265A5F339AECCB2C0FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(g{.l...l...l...e~..h....I..m...e~..`...e~......K.n.}...l.......e~..q...e~..m...rT..m...e~..m...Richl...........................PE..L......c...........!.....x...H.......b.......................................P..........................................W............p...................*......T......................................@............................................text...nv.......x.................. ..`.rdata...R.......T...\|..............@..@.data...Dz..........................@....rsrc........p......................@..@.reloc..v...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\IAccessible2Proxy32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39448
Entropy (8bit):	6.349725786408787
Encrypted:	false
SSDEEP:	384:saTPLFr83naeA5z7VbbQ0SKvB2S8MgHHrKIYitv7tvXG8E9VF0NysI:saPFraa1ztbQDCPRgr3YitDdXlE
MD5:	6B53A59AD800614B3866D24472C41C22
SHA1:	FC470149F8E81D952A84AEF0AEE7663BE4386DD3
SHA-256:	6B2B3B3186177EE9366DDA6FC274B1F0F9443C8474C8B125CB3232F2F6C8EC5C
SHA-512:	ADE1DAAB764D21814AAEC1A72CACB12549D3E1EE332ECA8A17615EC665FA9278AA794AC9D0094ABFA77038A8F4FB836C34F2C0DE6D94309138207656C85E6D9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........".R.C...C...C...;,..C...;..C...;;..C.......C.......C...C...C...;<..C...;-..C....+..C...;...C..Rich.C..................PE..L...X.(c...........!.........^...............0......................................K................................q.......j..x.......(............p.........`...01...............................i..@............0...............................text............................... ..`.orpc...u.... ...................... ..`.rdata..NB...0...D..................@..@.data................V..............@....rsrc...(............^..............@..@.reloc..\|............h..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHS.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35648
Entropy (8bit):	5.581929500429887
Encrypted:	false
SSDEEP:	384:cwxPHe7hDWEWy5uxcx37Xtqh5iHulR1uwTvh6dKe/VD9OLH1GLz4Z1jEa:HShL2ctXtqPvRhvhynOLUz4Z1jZ
MD5:	62E39B9DADCD8C3AE989BF448EEBE25A
SHA1:	C66508EDA007BAA02221A9549D04C075778B3793
SHA-256:	2C0F0DF9EDA903CF3CE8246DF5B8CE8F083E28532B3EDA5153E50BC7DBC124B2
SHA-512:	B5951A6E89A93D7A018EDD0AE135712BCC1C71155B8DF7992B43640AD717C93A2FE513A4C206DB7A42EB7B5BFA65F543A084D61D0E6538E44A1D23E777FE6137
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!.........r....................6]......................................@..............................................q...........t..@............................................................................................rsrc....q.......r..................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90CHT.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36688
Entropy (8bit):	5.586891090741567
Encrypted:	false
SSDEEP:	384:wdPwznjqQOl6HyLW7WyJMU9sNCR0OL5AlKwKTF1ECAiJJGLz4qjXHUdT:iki8SS19sy1KKwQ1ECDJoz4qjXHUdT
MD5:	11BF5AB1B544480558AE86F104E9CE40
SHA1:	687EC93FB11D6CE44ACACFC9F9D3C412D65EEF74
SHA-256:	4EDCC083BF994C959FE5D15E511E19998ABE2E99E7943D3E5C8D757CAEB4F7EA
SHA-512:	80F85DFFD8C6A90FB65AF7F752521B1A5D0721909FC39DFAE73AB2E8BD49870DCEB453C41A0E188312627740229EB9213546DCD0C996215F214A30C9E2FD0142
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!.........v....................6]................................0z....@..............................................u...........x..P............................................................................................rsrc....u.......v..................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90DEU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63296
Entropy (8bit):	4.144504605677493
Encrypted:	false
SSDEEP:	1536:NAhosbkV8vJVQPu6V4Z+e0petNSaQhp0vcsjsrAGeoDsaKXZ//:yhosbkV8vJVQPu6V4ZX0bhp0vcsjsrAd
MD5:	255742E72E7A4C331620F9601C29344E
SHA1:	799B1706A9518B276478A52A8E00D3C5562695C6
SHA-256:	4BE5532F6EFA7D7B08613437B64DE9C1594A670299E9E9CA9FD7F4CE0A0DA2F3
SHA-512:	607DCB24F3D93C932A733D095B8323FA7EDDC9632EB85100380AA086677D1EE1BE63EB366967EE663BFEC649B70154C7A3C345A125502E712A79DC48F989CD75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6].....................................@.............................................................@............................................................................................rsrc...............................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ENU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53568
Entropy (8bit):	4.230872047159334
Encrypted:	false
SSDEEP:	768:iUrE5Ev1Y6BwLPLNq5f/nWHBN1eOU2fd5Zz4Z/j9:i01Y6BkPLNYf/nWH5TdcZ/R
MD5:	2A632A95433E9719F37AE06BA00543AC
SHA1:	D0ED27F2F000EBD2EF403C6E9F9DE18F01661CD3
SHA-256:	889704C5556AEC2C5BC1D09BAD9B1910C66A6D040AB5DE021375BA861A16FA19
SHA-512:	B7415A6BE36AAFD8DC47EEEE1241186358289A92D81F02750DB6107595AD9C941F4BB789533CCEB235DF1F28ECF770DD6D28B1D6E9D6D9BA8822FED1C403D685
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6]................................d.....@.............................................P...............@............................................................................................rsrc...P...........................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61776
Entropy (8bit):	4.107379160171213
Encrypted:	false
SSDEEP:	768:nOmcQ3ulNtMFZEGBFCDCDheB5xaV59+IIN5sz4qjpvq:alNtqZEGBFM0heB5+99IPq5q
MD5:	60D3901BFF6F3FADB755278A0B9EFEAD
SHA1:	50C0FD28748B55BDA6BDCA06B298591130CDF6F3
SHA-256:	1D20F5FB7F190ECC8131D9D15A8D8358DC4E849AA627837DB9B70320DAF9F01C
SHA-512:	5CF999BF5BC12CC786F6B447F723A54D0A2701AE70AC39BB0DC6427C6447736A13D44E481F81919EF643F3396BABBB7327F513B78B502C01067713DBA2A38CF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6]................................}=....@.............................................................P............................................................................................rsrc...............................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ESP.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61760
Entropy (8bit):	4.105659672766041
Encrypted:	false
SSDEEP:	768:yOmcQ3u7TtMFZEGBFCDCDheB5xaV59+IIN5bz4Z1jggqp:z7TtqZEGBFM0heB5+99I0Z107p
MD5:	FB735E49921054792B30070C396514AB
SHA1:	4A2013FF70CFB084F55860CFB84987ACEF375811
SHA-256:	9146F89AFB0494F753CBDBF6E4B0DFB1C53BE4C5F22EF4F468CA25EC654F3843
SHA-512:	3BEC6685E454C2FADA9666A221439050A18A5270843E60B5B182899F572F4E2499312979538206C01B851A744034CE07BB4617840518ADD18B8C07ADA847E2B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6].................................Y....@.............................................................@............................................................................................rsrc...............................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90FRA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62800
Entropy (8bit):	4.12124282325554
Encrypted:	false
SSDEEP:	768:rWcDf8GOQOj7e3RAaTaPCeyGdZmZ5fyyyyyyyyyyyyyyyafyLVyWong3+Nz4qjp2:lgQZA2SCeB0vQzq5O
MD5:	80AFEB839F3FED8148A8171C3331A880
SHA1:	23A4DD1A8B0DCAC492E1E5C628A27AECC6A6D602
SHA-256:	8E11B2B4A9CB5B6CD39F432065238D5A7E6C96CC36E8D0522582AEB4780FCA47
SHA-512:	BCB99D283AD5B6F409EFED64C37328C6B076F2CE05BDB79305490759CC6807976B52D8657FE26334B759CC2F6240EF5FFBF5F1B4145A34B1CCF3C47DC4036197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6].................................(....@.............................................`...............P............................................................................................rsrc...`...........................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90ITA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61264
Entropy (8bit):	4.102174866033272
Encrypted:	false
SSDEEP:	768:wfhqLysnKliCz7PxdIlWXgiCnPOCeFO/hDsiZUWTraz4qjpvb1:PJuiCz7PxdIlWX/APpBTtq5B
MD5:	699FEA384F1C636C750F623D33692023
SHA1:	58853E6C51E84E591528C91D0238AB79928AD417
SHA-256:	0AF6F9075E2276104F3E80C1C52F42BE0218202D0AF2DFDBB4B2A73948CC0EE5
SHA-512:	95C0F5BCE10C29B01C657CB0B47D9B28E5610144A8276C99B84C9E84DF7CCE6C132666C67539B37604C6F5F1989E6603A7EA4FF1F07E6706773F0B0481FC54D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6]......................................@.............................................................P............................................................................................rsrc...............................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90JPN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43344
Entropy (8bit):	5.432577737350424
Encrypted:	false
SSDEEP:	384:uIxeR48c4rAmWoWyI6JMQ7axr10ahVIpbhYZTZ+LLz4qjpvlg:FARcEI6JM1r10OIth3z4qjpvlg
MD5:	603CF1B16DC86062428BD211F1218A87
SHA1:	EC905EEBB58E1F612FAE611298DFB1FF2235AB32
SHA-256:	79AE48230DFB0E34970720274DEFE019A8650C9E7B1A96512D1747261D81CA21
SHA-512:	DF215A5D8F3687C47DEC9A99A54328849A159593A2206EBBB68B583187F4A35ABA0C78778FD1B5F6311D9126762C312AE634F41593F9890531A2E45C930A48ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6].................................m....@.............................................8...............P............................................................................................rsrc...8...........................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\MFC90KOR.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42832
Entropy (8bit):	5.535010573036924
Encrypted:	false
SSDEEP:	768:tekmG+rCzaraHn9vxB2c7Cvqjz4qjXHU38r:tEGlzDn9vD2c7CvqgqrHUMr
MD5:	87EAFB13C4179B62895994DB9B53059E
SHA1:	82C4227258D2F458B28C08DEAE5BEBA829AAF1E0
SHA-256:	A5AF115104F961195DC90554B37BF8979F49E37ED5E8B405654AF5B38044849D
SHA-512:	D2046223EAB83E07486DB4FF4FDFBDACACEDFB0D8AE845773A131F9ECFD78535247A6A6B3F90A3F731276F21130F7CCFD2DDC74914E35EB2FD010B7420DF99B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L....lYJ...........!..............................6].................................t....@.............................................................P............................................................................................rsrc...............................@..@............................................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Program Files\AhnLab\Safe Transaction\Nz32\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Program Files\AhnLab\Safe Transaction\Nz32\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.378158011805663
Encrypted:	false
SSDEEP:	48:3SlK++U6g4A09kkKNzx09kkKJpzSgd909kkKzZuzl09kkKTzY:CltFCAXkgNXkKGgd9XkxZXke8
MD5:	0323AF0C3E694D85650AE55AA27EEFB3
SHA1:	672079C9564B4EC16EFB24DC80DE3EBEAF2A9F27
SHA-256:	1FED2074AB9F90D9FCCC5A49B6AA42C917674C2B5C7B1BB93FB67B0E0C944818
SHA-512:	5DF2D8B07B3ED0CAE3536C09AECA714B56EB75BC76668447C45917E890F5D22EF14B6059BD5782FD06D075A8497BC39A89F809E413C637405AE9BE4193C66FE1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="ec50bf1691888076202d5831599ac75ba0d35977"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>WuUqeI7Lf0+bhIfTm0T6Pv1L13g=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="c752d2a42c0b82d2145cebcda60c7e5a43245cf4"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig

C:\Program Files\AhnLab\Safe Transaction\Nz32\NzBrcom32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1985560
Entropy (8bit):	6.652362960735125
Encrypted:	false
SSDEEP:	24576:488wU8fI8ovSKAtdRGKWgVXwzxJzxOQY4txcbo/l8yMYJB6DPmo03wfrXeLQZ2+k:mw0hKDQNCo/MJ83IeLQZRJDLJW1
MD5:	5BB25B99733CF293B853B58166ACDF2F
SHA1:	FADE410FB456F900CDB34BD9B214F4E063D2DF88
SHA-256:	3CAEC4E2997E45A96FF2BBE050B63F71D12D8E40B6E16CB1DBBB1435601762A0
SHA-512:	950DF8A08978E8E22E18008D661AEA3C9FCFD8F2104871DA9841876123A664D5046090650CF498D6ABD06D14C35D0977140A781740D6696D442846F21CE86AFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........g{Y..(Y..(Y..(G..(\..(~3d(P..(.(Z..(P..(V..(P..(_..(P..(...(P..(F..(o..(X..(o..(]..(~3r(~..(Y..(...(P..(...(P..(X..(G..(X..(P..(X..(RichY..(........................PE..L....2c...........!.....H...........g.......`......................................0`....@.........................P...S....~..\|...................."...*..........`j...............................................`..d............................text....F.......H.................. ..`.rdata...F...`...H...L..............@..@.data...............................@....BrcoSha.@...@...@..................@....rsrc...............................@..@.reloc...M.......N..................@..B........................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\NzInst32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776216
Entropy (8bit):	7.0387779534461155
Encrypted:	false
SSDEEP:	12288:bw8eWpY4zGbdHs7gWSqqn6HZBh5jyuFWRY2SpgHjbf5h2ke408WJKTWiGPYJetX+:t0dMxSq+6HZB7jyEF0ybLdJIQYJgO
MD5:	F38A5F8A996CDE64121406D00E927DC2
SHA1:	9FC677351A1E3ED2E1DCF310CE73C874F7E70FC4
SHA-256:	01321265ED83F52933F27116FC805EAD378689A26DC612F04E6DA227129366D0
SHA-512:	9D20ACD4561C4022BAC58400E4B378D767DBCA65F9A81EB159FAD6B0C28F286FF45945D94A19F06B50346E63E35A70C1D8DCCF8E8190BBC3D573A24993AAE54E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t...j.1.q...Ss.r.....#.r...}. .}...}.6.{...}.&.r...B...u...B...p...Ss.i...t...c...}.1.F...}.?.0...}.'.u...j.!.u...}.$.u...Richt...........PE..L......c...........!................6........ ...............................p......%{....@.......................................... ...................*.......4...%............................................... ...............................text...\|........................... ..`.rdata.. .... ......................@..@.data...8^..........................@....rsrc........ .......j..............@..@.reloc...T.......V...X..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\ScrMon32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175448
Entropy (8bit):	5.709803202914344
Encrypted:	false
SSDEEP:	3072:c49ibPhtasusSfMxbXMqqDL2/LOt1hVaoQnPT/TzTi/NH:c49ibPXusqqqDL6LOt1hpQPT7zTu
MD5:	21D4A7595C7AEB3D2FBF862A2C30E9E9
SHA1:	CEB75CA163673088C0C57AFA8B4CED38BC760448
SHA-256:	B6C6812B01E0CA9CF4FEBA0E5904DCFB6C967F776C0C805450A86C420856F502
SHA-512:	F0CAE14EEC7D964A0B80C6C2CDBE915A591F45484288589BBEA218148DAB7A428091B118EDDE699A2B39FE6C5F819E59C38E4A1E607025ECECF5DB388E061757
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.^<...<...<....V........e.=...5.f.>...5.p.,...5.`.;...<...K...5.w.7...5.y.....5.a.=...".g.=...5.b.=...Rich<...........PE..L.....yb...........!......................................................................@.........................0.......Dn..........................X#......d...P................................\..@...............$............................text............................... ..`.rdata.............................@..@.data...H............n..............@....ScrmonS.P...0...R..................@....rsrc................`..............@..@.reloc........... ...j..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\StCtl32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1649176
Entropy (8bit):	6.732347194366768
Encrypted:	false
SSDEEP:	24576:l9ZzvHSTYVXBjmK5ZEuj4r3YCjPmt8picRWAUr3p2J8K+v9qzf+Ym+6KZRiSiiVJ:Nz/SY5S8kRPB91Yk6vwf+YBVZUSMW
MD5:	E7D02E228137AC2C5E58D9C88B3EB734
SHA1:	5F80460F2F341FBB6A3234D80B1A7FCA37AC287C
SHA-256:	DDA3B19D05EEA3D7C312E17180C8228B6B7C5FE3BB56665146D814AF58DB448F
SHA-512:	06CC0963FA36BABFE5ABAE741EF8A0281E5BF5F50D3A81A48B65E158D8E5541EF2F20E2FDF378F5A771EA8BB25467D7A18577896D64704392C23C281DEBE3766
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E?...^.V.^.V.^.V&..V.^.V..LV.^.V.&OV.^.V.&IV.^.V.^.VM].V&..V.^.V.&YV._.V.&^V%^.V.&PVL^.V.&HV.^.V..NV.^.V.&KV.^.VRich.^.V................PE..L...6..c...........!.....`..........k=.......p......................................q.....@.........................@0......h...,.......t!...............*...........{..................................@............p..,............................text...._.......`.................. ..`.rdata.......p.......d..............@..@.data....p...@.......&..............@....rsrc...t!......."..................@..@.reloc..b...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\StSdk32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2687000
Entropy (8bit):	6.7111248929166045
Encrypted:	false
SSDEEP:	49152:Xz4sEXrL69DT+PkB6+/MJ1QYzp0xZZGBnWUN/vC54:XkbXa9DT+P7+/MJHixKl
MD5:	D5919888A83C386DAC463F8BB943161F
SHA1:	92B2E200643127F1265EB2FBEF9DC52D6D6C9917
SHA-256:	44561D2D5FB6C5797D716A839D2FACAF8B6B4AE0C9C140547099BFF008E28FE0
SHA-512:	005A2A7BE00FE3FEE0A691F8F3AD21672131A1245F6717D839142F4194D0685D0648EA4AAA73ED899221560B50F0299EC70695AEDC86829C20C11916518CA9F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\...\...\......\...1...\.b....\.....\.....\.....\...]...\...'...\.....\...}.\.....\......\.....\.Rich..\.................PE..L.....'c...........!.....f...l................................................).....].)...@..........................d$.....<4$.T....`&.@.............(..*...P(.LL..................................H.#.@............................................text...se.......f.................. ..`.rdata..P............j..............@..@.data........p$......R$.............@....rsrc...@....`&......n%.............@..@.reloc.......P(......T'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\StSess32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332824
Entropy (8bit):	6.166551546859396
Encrypted:	false
SSDEEP:	6144:TPXtx4i+1SqqDL65OQHrwPTE97W2WY/ey:TPXtxr+Zqn6dH75t/h
MD5:	7F2ABD5AEA61B3DD4E1798E6DD1E542B
SHA1:	5A2C48F924F80B0175BC72B9E1AC632B47119190
SHA-256:	F163B5ABEEED2E4D1D909DE5366329DA21B8D3551C64BE7BD7E24D653D151B5F
SHA-512:	602D682C242591EF004885FC9DB79952F822A3C6DECF85C219C81A8EE88E0BBBB6397CFFBF7F11931C5E007E2DF518C122F4810E806F480ADBFD613A39699E36
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x&B..uB..uB..u\.uF..ueN{uG..u..uC..uK..uF..uK.uT..uK.uE..uK..uD..ueNmu_..uB..u~..uK.u...u\.uC..uK..uC..uRichB..u........PE..L...+..c.................L...........B.......`....@.......................... ............@..............................................................*....... ...f..................................@............`...............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data........0......................@....rsrc...............................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\aostrust32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62456
Entropy (8bit):	7.0262724518425435
Encrypted:	false
SSDEEP:	1536:ilHPEY1pLigcXI+/Uxxe0qncZiodfOtEpMij1:mEY1pLigc4+/OI0scZio9OtEpL
MD5:	2AB6F2A73BFC656016ECAD8B167B7367
SHA1:	896A354BB46F4295CEAF720DE3E8468FFD770A79
SHA-256:	839236E93DB47C8B345E7969CC9830DA1868AB64EE6CE9B9FA490F58F2770A1E
SHA-512:	9B03D4BC83D8C0A0DAB06965B21BF0552BF64B71CC28260519160C8CFBF2C1012DCDEAD60DB06B00BF9908F67D758B2C468828EFCE703131A06CDBB5A84B85F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q.q.q.....q..>p..q..s..q..e..q..b..q..u..q.q.wq..l..q..t..q.#r..q..w..q.Rich.q.........................PE..L.....H`...........!.....z...6......'.....................................................@.............................M...h...d.......8................?.............................................@............................................text...Uy.......z.................. ..`.rdata...............~..............@..@.data...............................@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\libacm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188632
Entropy (8bit):	6.842404249580737
Encrypted:	false
SSDEEP:	3072:DhhjJhcoAxnr0ZxoTNSl2fnKvOQsOKEfe7g5wZodxmunPIdqwar0610O:DhhjJhc1xr0Zx0NSlPZygSWPId9XO
MD5:	D9FC3032858CDC43CF80A60DFBCE9594
SHA1:	E343F566DA08B94161795CE49CAE80FDDC0322BA
SHA-256:	BCF685BB7FBA267AA00B76128C7E43EFAC71E52317B2C999F2000878E143B3BD
SHA-512:	F28C6003A5971CF7D301785F5779089CA4066B0711614585C3379C8A6BFF874660B127EBD0D94F0D8998B30D33879FFBFFD526F004AC7162AB89172BBC944E4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._A...A...A...H...C...H...B...H...L...H...C...fl..H...A...x...H...d...H...@..._...@...H...@...RichA...........PE..L...?..\...........!.....H...V.......R.......`............................................@.................................,...x.......L...............P>...........a.................................@............`...............................text....G.......H.................. ..`.rdata..c-...`.......L..............@..@.data................z..............@....rsrc...L...........................@..@.reloc..n...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\mfc90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3780424
Entropy (8bit):	7.003874574636043
Encrypted:	false
SSDEEP:	98304:ph1NbYycFYeGTgo6jK8cauthOpYYCUEKn5+2SzRNl44pEZZFLOAkGkzdnEVEFoKx:phD+YeGTxhKId4LZZFLOyEFoKG4v
MD5:	423069307FB726E51E2A66F1C3F738FE
SHA1:	15291382B200A7BAFAC53C432ABC7502088936BC
SHA-256:	314EF0E1C636AC553C0E09F992B34573DA4A89ACCB759BDA27335E8125C08E35
SHA-512:	B91E2B9CD852EFEF772EDFF13020FE515F9860845E8B2D32A52D4F624F7355E03F4059B80220C52142A3E6A7FEBF9B325E61DB1EA8A055E45B841CA13CFF1446
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..w...w...w..\....w...T...w..\....w.......w.!.....w.......w.......w.......w..\....w...v.A.w.......w.......w.......w.......w.Rich..w.................PE..L...JmYJ...........!......%..,.......K!.......%....x..........................:..... .:...@...........................$.......$.......&. l............9.H.... 7...... ..............................H...@.....................$......................text.....%.......%................. ..`.data.........%.......%.............@....rsrc... l....&..n...@&.............@..@.reloc....... 7.......6.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569664
Entropy (8bit):	6.521726174641651
Encrypted:	false
SSDEEP:	12288:iZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8bw:iZSZ13iwJmgLq83Ooc8SHkC2efw
MD5:	B2EEE3DEE31F50E082E9C720A6D7757D
SHA1:	3322840FEF43C92FB55DC31E682D19970DAF159D
SHA-256:	4608BEEDD8CF9C3FC5AB03716B4AB6F01C7B7D65A7C072AF04F514FFB0E02D01
SHA-512:	8B1854E80045001E7AB3A978FB4AA1DE19A3C9FC206013D7BC43AEC919F45E46BB7555F667D9F7D7833AB8BAA55C9098AF8872006FF277FC364A5E6F99EE25D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<.......................@.......43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653120
Entropy (8bit):	6.883968356674239
Encrypted:	false
SSDEEP:	12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
MD5:	7538050656FE5D63CB4B80349DD1CFE3
SHA1:	F825C40FEE87CC9952A61C8C34E9F6EEE8DA742D
SHA-256:	E16BC9B66642151DE612EE045C2810CA6146975015BD9679A354567F56DA2099
SHA-512:	843E22630254D222DFD12166C701F6CD1DCA4A8DC216C7A8C9C0AB1AFC90189CFA8B6499BBC46408008A1D985394EB8A660B1FA1991059A65C09E8D6481A3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(.......................@........3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Nz32\powapi32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127000
Entropy (8bit):	6.637451680799637
Encrypted:	false
SSDEEP:	3072:OxFkfiu6gJJj/wqkx+t9uuMqqDL2/VvzOKhhi/tP8lIkjxb:CN89w+QqqDL6lOKhhilElLb
MD5:	C383051A03F98927B6317CB9A4C17EAC
SHA1:	524D1941CEE98A11DD080E0176B9628D4680A69B
SHA-256:	56A1302A9C8CC143386E4F8BD886938F2014E9851CDF3F8FCE8F411AFABDE7F7
SHA-512:	8C37C593CDBD105782C360ED8E6C7E53A99281E37B1947092D12E48AA56C9032032D46AD9C94B6A08AC0BEBF2B6F65E9B863852DA8C5D3D33ED59E8B1A8D875D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.3Fw.].w.].w.].P.&.a.]....v.].~...t.].~...g.].~...\|.].~...p.].w.\...].~...`.].~...v.].i...v.].~...v.].Richw.].........PE..L...!..c...........!......................................................................@............................L................................*..........p...................................@...............D............................text............................... ..`.rdata..<...........................@..@.data...`...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\NzBrcom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2347024
Entropy (8bit):	6.3669123532265175
Encrypted:	false
SSDEEP:	49152:PmWZah+WDtlQGm0r3CMASFJC0nesPYQxDC:1iIqFJxPYQU
MD5:	1E2A026243354636BA47D92280C9EA08
SHA1:	589BF434C3396EB7587DD6091BFB8BB4C14CA2A3
SHA-256:	C0BC98F6BEC4833980DFBD8D85192B9AD9AF77DC6C80DFEF52A58025DE312543
SHA-512:	ADDD97A337E5C89BCD088CBDC09746A4DEDF07796A676B29BFC8347EF576A1E637430634261D7EC0F98C92F45EBDC4CFFE70DDC201E27545F5A881275589DE13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........}=...S..S..S.....S.N...S..>..S..S...S.d...S.d...S.d..p.S.d...S..=..S..>..S..(..S..R.O.S.d....S.d...S.N...S.d...S.Rich..S.........................PE..d...(.2c.........." ................l.........................................$......A$...@.........................................P. .Q.... .\|.....$......."..C....#..*... $..C.. 4............................................... ..@............................text............................... ..`.rdata....... ......................@..@.data........ ....... .............@....pdata...C...."..D....!.............@..@.BrcoSha.@....#..@....#.............@....rsrc.........$......B#.............@..@.reloc...X... $..Z...L#.............@..B........................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\NzInst.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	950296
Entropy (8bit):	6.715241814776746
Encrypted:	false
SSDEEP:	24576:+HEScP9+67jL5XqjowYEF0ybLdJIQYJQo:zEEjL5ajPFfGQYJv
MD5:	F380128EFE73C2896CC50ABC0BEB5FDE
SHA1:	FFF334A03B7D3B67F4C8C9BFF31C2DE1626FBC80
SHA-256:	5AF161C4FB7C3522FAB909AD03A05456C05DFD968A328CF317B3FADD3EB9C933
SHA-512:	A4438839C43FE61F86D843746C4B3B02AC52E20DF6175EEFCDBC8B3714816EA672B3E69B94CB5D0133AC1BF817D6B5AA671D43FAABA1FC3A47BC62B9DA4C9D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........r.I..}I..}I..}W.}L..}nxq}J..}nx.}J..}..}O..}@.}K..}@.}F..}@.}O..}?#r}H..}?#q}M..}nxg}T..}I..}X..}@.}{..}@.}...}@.}H..}W.}H..}@.}H..}RichI..}................PE..d......c.........." .........:............................................... ......4L....@..........................................G......(#....... ...........6...V...*......@....<...............................................0..h............................text...~........................... ..`.rdata.......0......................@..@.data...H....P.......8..............@....pdata...6.......8..."..............@..@.rsrc........ .......Z..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\NzPlugin.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2103832
Entropy (8bit):	6.377059327231297
Encrypted:	false
SSDEEP:	24576:kgZXygXGzym/nTzSxXOmXxgn4N4+CmSc07tDDEZP4RJY5FGLO+6H5AxZNf8:fZ2y5XOmBgn/zmkxDPRO5FGLJ45UZu
MD5:	359AC0FD7970DA4E5C4F66A45C027031
SHA1:	46252ABC6B70393B9D25E5F1CE50C9CB1AF14D51
SHA-256:	7717124CB6F5D87E64E20F97510CB14CF2BEC36F7D560C85852D2704FC502413
SHA-512:	87CB2C4C50C6902E49F270F8C7C63C6F5A3880B58EB39E6F7C50F1AC526490B55EE506AF4168BD359E1EF60C14A5EFD0B2D610884661832B3D3B19D927BCAAC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........W. .6.s.6.s.6.s.d s.6.s...s.6.s..$s.6.s...s.6.sFy2s.6.s.N1s.6.s...s.6.s...s.6.s.N's-7.s.N7s.6.s.6.s.4.s.N s.6.s.N.s.6.s.N6s.6.s.d0s.6.s.N5s.6.sRich.6.s................PE..d...&..c.........." ................P\|....................................... !....... ...@.............................................u...(n........ ..................*.... .H=..`...................................................(............................text...N........................... ..`.rdata..u...........................@..@.data... ...........................@....pdata...............x..............@..@.rsrc......... .....................@..@.reloc..fP.... ..R..................@..B........................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\PdCfg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	349720
Entropy (8bit):	6.0144852370364505
Encrypted:	false
SSDEEP:	6144:AuiF2ruN1L+6j8ndDCpJTXjUHe87ucxERWvfpqqDL6B2JoRtoPOpOPdpwSBR5K:7ruN1h8ndDCpZXjUHeUHxe+Eqn6Bg2og
MD5:	F25184FB0FE43527E1C5CBE7E0C63781
SHA1:	6014C15E299E173F3E746DAEA0522A12598DE792
SHA-256:	894351DA16B15ED251441A9C859AFB812491AE1ACD91A3F39829E52714A7FB23
SHA-512:	B29DCBE612D8A51C520A8996B49FE21EDCB969EDF12730CA27E717335EC706BF3371AA386FBA98B86B7A61E22D25CAB2A10E045A77262C49A7EC9726D6EE4FAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.......................................................-O......-O.................. ...........................Rich............................PE..d...^..c.........." ................D`.......................................0.......r....@.............................................................L........3...,...*... ...... ................................................................................text.............................. ..`.rdata...C.......D..................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...L...........................@..@.reloc..\.... .......&..............@..B................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Product.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.8552326097808525
Encrypted:	false
SSDEEP:	24:PCkwvMK2CHxb6CLiDQ9p7iVqVQrd8opv6lVooaS+xQW27IJa1RwYcT:qkEsCADIxiiQrino4+R00rT
MD5:	54586C0C3EE89A612B34B782E0CEDAA3
SHA1:	0920E756DCFDA141B0E5FA47054B9765EBEEBF36
SHA-256:	6ADC304A183015DE1FBA7B5CBB76CED2D6AD59C999B80824603F3DFE4949B2C9
SHA-512:	814A68A5080B59DC00B5A89203D63B74358E6EEF0371348E4DDBE2230B93BB0486768FD73353E8CBC433B6652B19A5219A8DAC489274C42CC8B9E858BC43C689
Malicious:	false
Preview:	...@....3..=6F:....bM .,....s..L..../kP...W"...!....gu.Zm=......M.r...;..80..QF;.YmM..uL.=TNS....Y>....4.....o....s12C.......f.......#...,.G`._....g.7.m..H. \|.=.pRWX.\.2.)^..J.,....v.....;..c.A..H5..{bz3...Ih@.bq........"}e..a.....j..#.4[.....v...7l....8L....oa..Tc....qd{..{.g......u..r..}.S.........52 .!..so.........s.PI.....e].....+..+..4e.C6h.....}KU..d..h...:9>[2bq[E....q..f..%W~.f..W...e...<.d....[A....o........K....$H[......[.s....@..".4O.......rh.Z......6.I.7....P\|.....].qJ..-5."0S....V.4...J<.L1I=...W....3./".+j..Qt../X.....X.(..r...'Lo.1pX8 Gt..D/..K6:...M..i.....}..V..x...q...crK.....c..w..]..)m.....=.....`.F)...mG/......}{[.4X..(.\%..=.}I.h.#],.....u.....Z...S...Y....,J9..Ld9.....~..m.}ZW\.2$...2.&.=u.=rC4v'.?}.,_h..3!4S/L...6H.)......!....9......&..L.t....T.lG1V..1.I.O.c.......,.`.....h.tl7sD.4...$.Y.....S..;G.....Z..2CMB......W.n;W4.l-@..S....4....H...5.p....g.(..e...{'..j.........v.I..L.Z.k..V...5./..3m.).. .....U.~

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ASTX10_ico.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	121112
Entropy (8bit):	5.587285050501772
Encrypted:	false
SSDEEP:	1536:gG7lJ2F0jYqHou3B8+xwpyYkkSg1zyoCU9kkkkkkkLkkkmkkkXkkkkkkk2Ykkkks:J7/WC93B83Sg1dClk
MD5:	BA7259E0EEDEB95B685B2D8E76D93F22
SHA1:	E866C8670F9DA7F5B8CB775B0FB63B27A13B267A
SHA-256:	E0A29D0DDEDCC1DFA933B8535AC99CC9EE2F3979118747641D3B0B43EE68A591
SHA-512:	9A5819F67B60F39DB3141E1CF7D88CA550AA3086C3A242A05386B197D965417DAD8F7E7C58FC3D417B10B1D453A9B76F00530B32335B583346DDD648E5673B5A
Malicious:	false
Preview:	............ ..J..v......... .(....J..@@.... .(B...R..00.... ..%..... .... ............... .....(......... .h........PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y..U.......L.e..$$..J.%./."....W^AP6.._......uy.WT.UD.....-..}..d.....Z......0].=..S....%U}.n.s.=..s.\|.....R8.S.}:.EML.[h4..#.G H.8t...Y-bC...e.P8...>..x-.O.P-V.%./lI.s...e.......$.>;..f..W.#......\|.P.D.6..av...l0.......f e..L..e.fl.u......s...AI@."....Arn..>...R..=c.T>..W.%.f.....51\|.b..`X.0...M..>.....(...H(K+..@;2._.SFn.8...#..1..(.l........%a.....)t.'.2...,.+.." ....:.D.us..3%.........(r.S.......:...pJGw,..f..7....p.e.......)...&......._..).&... .mK.}.........Dj.d......<.`N..mI....'{.L.....@.a.Lyk.].f.]m2(...P..Mx&Scy.UA..%.....G....JT......(..cdK.}f...=f......:.q....o..h(.!.p..a.m'E..g..C..7.G.1.W.E@.....o...c...t..T.4.k....$.&. ,9..&...ZI/...;...s.\|.P.$LV..}.8...2L.'R...u.[..2..2d...6?D....^..I..........f.a.....t.a..O..w(.h.3!.BU..6.)b...,#w....2...@..-a..b....i....5..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO36BV73cxy8aV73DJRa9l:g/Qlcm6E9aV7PaH
MD5:	0A8EDCE22FF490E137225C706A3E41F3
SHA1:	6E5DF9FEEE9D7735AD1EBF60EA10064760CA6F6D
SHA-256:	2F886663C91032D8871CB76616A4CC8B0B756E3C1D89261ABC76B9A52C0130F1
SHA-512:	6AD691DA44AAC10AC383D664D53586E3F380EF1986181E3FC434963CABD7D353D3D6219FB5BBE4276B0F66EB2F5452F0C626FCA54BD79B08DE0870B2B226DDCF
Malicious:	false
Preview:	BM........6...(...................b....................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_bottom_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO3693UuAaaaOAThGaD93Al:g/Qlcm6yhRajNJw
MD5:	91E32D587544FC0AD138BD76FF8AED1F
SHA1:	2D298AADB0439C65D03525546AD1A9093F0DE8B3
SHA-256:	0D2E0B12341F27286497C2EE641B64D1C267CB194C4F1287A88390C96557C9A2
SHA-512:	74A55ECF3147E438F1779FDF71DE799F702642F2733C2F22D280B4B348DFD8AEF5BAF7EC39FA962D11A6BFECC771264AC0A744F5BC9FAACDED64B94C460B92E3
Malicious:	false
Preview:	BM........6...(...................b................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO369VJRak73cxy8aVAAhQl:g/Qlcm67ak7c9aVAX
MD5:	19B62D084E7B7FFE5ED40F2C1FA30B61
SHA1:	E15FF3A6BB37752292148A084ADA079687559578
SHA-256:	268EFADFB7302EE7FE26358C5AA7CDAEC8479907EE2063411F2B98C6F8D921AC
SHA-512:	9BC407471F5F127CB237ABA2EA8FEFF9A9F626CDBC409D2A70B8BFE5DE5B78FBEDE69B58E25E1F95D3E435E1EA7C9963EE67759FC116E97D920468A373BDFE2B
Malicious:	false
Preview:	BM........6...(...................b....................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\b_bg_top_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO36XRD93SRaOATh/hUXln:g/Qlcm6BJi8jW1n
MD5:	DB687C87ECAB5F7B7BFC13A25994E718
SHA1:	60F7B0F092D543BC6D7D29A291BEBCD1A7249874
SHA-256:	2D9807A38A7F5D2D13CED17BB14C3046311E183BD843DB743DE478F74CF27223
SHA-512:	238503A4C74C63B29C5CAA75BC8C07BF2ADBBC86E39BA191125B5548BA768B6741F9309801B3629CD74A24B965AB0213FB30B03257F24F69448D267A6EABE290
Malicious:	false
Preview:	BM........6...(...................b................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.78218338746202
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGp:Gsl/Btat6C
MD5:	0C669304959B0E005088171373BE7D2B
SHA1:	EA1CF8E78126DE55BAF1E6EB37D563656FF76574
SHA-256:	C9AC041743E12EE00D0C5F371C406968E3765BD023EC60227DA34B9FA920807E
SHA-512:	5F02B7753688BE6903F08E5B8D877F11BE3C39929457CEDF867FF1834D28A7E0A64BE72F6E57E141417B6F5D5E2744C3E0F57AC94BE0C7B1BE650460740784D5
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	0.7779465119582321
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal369B33BBBBBBBBbXBBBBBBBBbXBBBBBBBBbXBBBBBBBBbXBBBBBBBL:Gsl/Btat6B
MD5:	1E2812D4B6D7FF3C739A1E58944A5A6B
SHA1:	173E9DBEFE63A302E422F011B1AB18B2D437C51C
SHA-256:	73A9D29DD03E3AA89A3B98F50DA4C5489C7DD784CA9B2A6760AEBB5DF9225B1F
SHA-512:	42A4299E3F0F655D01637BFE847B0C27BD315E9D0D1BD1E0F9060DC1A40105126434ED15B028C3C035954DFB10829F38809969554DCC0B4A4C109FF235CDB262
Malicious:	false
Preview:	BM........6...(.......%...........R.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.074935388906103
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rDaGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXJ:Gsl/Btat6ynnnnnnnnnnnnnnnZ
MD5:	228C9ED5F5F8FADFCC562E343A37C629
SHA1:	65C6B39BCA3D352F62CAFCBFCD3AC13F159360F6
SHA-256:	BABD7DDB01F396F4579E6D8A4F76C8455DA1AD1C0DCA400B10DC75F42BFD2F29
SHA-512:	8299438FAA4EE9851D85EB07D5BD44D3EC29D487FFDA7B2E2EF28A6D9E877DFB896880B1113D8AEFC566F60369097C96F5E923771D07BD93FB37FE729266939D
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[.....[.....[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[.....[...[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.9196884314547396
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36Dp1+YGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGep1+D:Gsl/Btat6Dp1+wp1+D
MD5:	F97D2BA217D1CD1206F5C1E305E491C7
SHA1:	3AB391DA4E065E813A10DBEB2B52BD15C1AE50A3
SHA-256:	572B5AB11F5BF412C30AA672B2E2D7C641BED207F4E511CEDC49AF7A27466A7E
SHA-512:	FFF2DBA0C5FAE84A2F06A9CE7A09870A3F34EEC23B1FB1C6BE139F89F80116B1B1CE5E25355E6110D2183EE2F3941600EA060EEC58A4F1D21124768FD6CAF0EC
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[......[.....[......[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[......[.....[......[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_focus_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.074935388906103
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rDaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaJ:Gsl/Btat6TnnnnnnnnnnnnnnnO
MD5:	34D285EE702AD7337766D48B9B89B4A5
SHA1:	A45F41B430BC7339B8EA41918620BE56E4E7B056
SHA-256:	1432D8F447CAA86346A851447966685A969564A63CF0A7F76C5887D512F1C7B6
SHA-512:	4E2EB85957FF43892372CAF22A65FEAEC223FC1B5E4D897F644D54252BE3050E6C77F18550305A6C843ECA1611CCE25EE7A7F68F86550798009BA1CA47369768
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[.....[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[.....[.....[...[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.1354375426684813
Encrypted:	false
SSDEEP:	6:Gsl/Btat6XN99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f9h:HDa0V
MD5:	AC907DDD7C77EF70FEADA699976328EB
SHA1:	AC0F084BB34A18E637096E2278936219CBAA2A28
SHA-256:	5E17B51F5D7E7746C861F1FB15D1CF8C32030114F0A37E7B9D1A9197F620233D
SHA-512:	7515BFE1421BEE89864361E193C6F82B7FC270EEAB26583FD72E1B5434C0FA76A6E0FE4A462CBCEF8AA9921C137B4A1003A8FB456DFAA5DD0F78D102F80FB083
Malicious:	false
Preview:	BM........6...(.......%...........R....................q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.490758125797811
Encrypted:	false
SSDEEP:	12:HDa0bYTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTb:F0TaTaTaTaTaTaTaTaTaTaTaTaTaTaTT
MD5:	21D41041002BF6520553A0DFEEBBE9B6
SHA1:	8C6626DB82D28D6737C4E8A1EE3861EBB737E69A
SHA-256:	3562EDC5AAD22669A371DFAD95196C85918A2BDBBDEEEC81FDD094D5DE5A74EE
SHA-512:	18A0EC39F9D5A3DBB3873ACAB8292730BB1F90ECE31ED62870D4DECAEB7832C6BDAEC9F431DA0B172B54BEA4D8FB8E6973ED0938E864B424491A9BF6E04A8839
Malicious:	false
Preview:	BM........6...(.......%...........R......................................bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA....................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.32189457817207
Encrypted:	false
SSDEEP:	12:HDa0OGTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLn:F9TTLTTLTTLTTLTTLTTLTTLTTLTTLTT/
MD5:	840FA729BFC218E9AFB3359CFB864ECA
SHA1:	AACC6E16439DD6B8C1F5E03CA9198848E488989C
SHA-256:	45B811120755F8A66B33D68FADC1ECF698D089665508EB9E611E30E092AFD2DA
SHA-512:	3F6E3920D2AF1678666473598D496C2CE2D9231A879F21176BF5A76BF3BCE4699038B683A9E2081188411B58FF64546174B726C7917A499D4B2C164866386FA0
Malicious:	false
Preview:	BM........6...(.......%...........R...................................bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA....................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_b_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.490758125797811
Encrypted:	false
SSDEEP:	12:HDa0OGT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9Gn:F9TQTQTQTQTQTQTQTQTQTQTQTQTQTQTg
MD5:	7038636964FBFD44D0ED8CACB4C66B9B
SHA1:	5B35CEF809618E6A7585B05257DFEDB87313A503
SHA-256:	6D1517B6876451C65FE8D47E5BF1D444261753DA190C22717340F06A85645428
SHA-512:	81EC32FDAB789E836BC1DE4901E0C54C814F0AB359FC267B7BE2902C277A74D3DB82C5952C258A0DD659C70E16590D381333F1ADAB42473609C1DB69D541E858
Malicious:	false
Preview:	BM........6...(.......%...........R...................................bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.......................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.146114628422807
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6E9QQQQQQQnEQQIQQQQeuQQQQQQQQQQWAQQQQQQJP8uQQQQQQEnr/:AAf0tuiEkuklk7
MD5:	D6228A67D9F3723E6F665B5CB07DD4D7
SHA1:	20924AB5FE9D77DF4255079E9882D02B44002380
SHA-256:	E0731984C1B08864575B7041C1723378F89C3333B288D4CD70CAFB2A9E0AED8F
SHA-512:	5A20AAF6B6274D1EEDC55ECF2145E32E7FB05A4441982DDFCFA348E50BD1ADF7FDF1A41C52C8816AF6D2136EA77763551C618A41EF1365F19CFD9B7CA86A62DA
Malicious:	false
Preview:	BM........6...(.............................................r..r..r..................r...............r...............r...............r.............k.r...............r............._.r...............r...............r...............r...............r...............r...............r...............r...............r.............i.r.............G.r...............r...............r...............r.............E.r.............~.r...............r...............r............................h.....r..r..r.r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.3217741176743427
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6mIIIMYINIIIImIIcIIIgxP:AAf0tuiih
MD5:	F8294C11F0697389FEE965D45D0E95E0
SHA1:	7C006B0FB0529A26DCF298D57619EAFA073D607F
SHA-256:	9DE0BB6EEE4DD4E5893C6481925C8095D642307F7E14C5C577BCF40ADF6CF6D3
SHA-512:	9FDC89FE0C225E5FFB2DA1E48944DD0D9E21355B80DB0DC042A4BC96D805926EF299BD58A53760BAFFE6F89461BEAD1966C642128B7BB393D8B06D34C41995CC
Malicious:	false
Preview:	BM........6...(........................................r..r..r..r..r.................................................................................k..............................._...............................................................................................................................................i...............G...............................................................E...............~...............................................................h.r..r..r..r..r.r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_default_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.1585445143483835
Encrypted:	false
SSDEEP:	12:AAf0tuiShHHHmHZgHHFvHHHHHgxgHHHhqRvHHF7l/:uxPvmyf
MD5:	2E0C5DA75913F835E953DFFE5DE024AC
SHA1:	B840992BB01B3EFD6A13804ED5AF5DA4DCA6A64B
SHA-256:	21C9EF6966C2C854BABB55661075A9E12E9FA8C907224C1FCC222542A61C5792
SHA-512:	B06D3935E4F6813593EDF70F5DC83BF11200A638EA875AD1CC067C125441CA64528EDE13C3068CA7686FD1E411CB7E5580EE9580040AF8F2D06DE079100A7F7F
Malicious:	false
Preview:	BM........6...(........................................r..r..r..................................r...............r...............r...............r.k.............r...............r._.............r...............r...............r...............r...............r...............r...............r...............r...............r.i.............r.G.............r...............r...............r...............r.E.............r.~.............r...............r...............r................h.r..r..r.....r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	0.876713498644841
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36pfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDf1:BGl/Ilf0tu/6F
MD5:	9EEC002E066D080166C75241C1EECB3D
SHA1:	F6271391232FFEB9A224FD6003D29E88C67BCCB0
SHA-256:	86B925C99E7D87F7C43EB37869ED97588A13E8281162944CEB373C8B9293FA30
SHA-512:	EE640EB5F48F0153A31976C1416CEE1EDFF19B6965BC506244276D3865A6B527F04C4F114B706EAF9622D10757183DF5CC4FE9F07DD904554E0A7863C26751B2
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.1139938619440177
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull363flrthpDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDf:BGl/Ilf0tu/6l
MD5:	968FB5030152ED4722DD54F4C877F379
SHA1:	47F03710AB8EBE2E2539153EFA099C888758CDA8
SHA-256:	8A01C3B8DED40415688133975FB8769E876346BCAECFA77F3340BC069B8A81F0
SHA-512:	B8C9323E3DC6D38D0398969BD412C22336B876B9E34D404679DD6493201D711C9683E4DB5B6872F124DDC5ECF3E6E43A878F0D495C463DFC952DC40814406F3C
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_disable_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.1139938619440177
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36pfDLfZDffXPhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfr:BGl/Ilf0tu/6F
MD5:	5C4D9F9D56C5BE80E97247E26D59008E
SHA1:	C01C30831E3B197C9C46104695AE97CC0D79E722
SHA-256:	F7F8F4A60B6C3BCE7333A8A24FB4F5CBF628265FE51449F66BA7E55598933575
SHA-512:	996D17C7CFBCF9BEEC95046EC2F6F7A922FE51463CADAA3D795847C64B9147B957284A3EE18829251C1E3BB0C2EF5BE98020552E1369679387EFA146463B558B
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.8281748739020824
Encrypted:	false
SSDEEP:	12:HDa0ifm2m2m2m2m2m2m2m2m2m2m2m2m2m2m2fn:Fifm2m2m2m2m2m2m2m2m2m2m2m2m2m2X
MD5:	A765F45CF5550B470B1C6CA60DD6BA79
SHA1:	7BB0A42AF9838723512DF775416E280E33CED9FB
SHA-256:	BDDDA96EE6491C30D9B7A115EEEA9C6EACD23129DF824475A07C19059B5BB158
SHA-512:	64773351932569254C80DEBB693B0F18F18A5F2B9720706C7E4E774A3CA538654698593E69B950A277170738E959B49A51112A97E1D1851C085B1719D660F782
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[...............[.....[.....[...[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.....[...[...............[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.1249435938072896
Encrypted:	false
SSDEEP:	6:Gsl/Btat6DpAIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIAI0D:HDa0DGfv
MD5:	9BFD19E781FB55E2510DB8E14D031874
SHA1:	F283E55E565C8A6845790072D49DB6A072CAC0E9
SHA-256:	DF9A02BA65CF55A93A541D77D926B21BA70676E09D74314EB6736D5B575F95A4
SHA-512:	F0314F6A48FDC53984B2E844FCDB3C11E73D12457FA21C3FD6EBCAA9DE408B28C12819539EAB739FA2E1460A4404922E5E8E4062C4C0C7FBDBB820FE303A4E6B
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[......................[.....[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[.....[......................[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focus_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.8281748739020824
Encrypted:	false
SSDEEP:	12:HDa0DZRZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03u+:FVveOeOeOeOeOeOeOeOeOeOeOeOeOeOw
MD5:	C034729302951F97326375995F44E1F3
SHA1:	8562A0353BD277EEBA481E1DA5F8A7F8B117E887
SHA-256:	D36E78CA3016C16E3DC43849906E9564DCDFD154EA5DA00D8BD38BAA447F1C72
SHA-512:	19969B91ADC5A4040BF2050CE04C10AC06744ACDB70A14E8D4B9B572B230B4FC914AEE3BFEDAE0FDA8F073E1881C2D9ABEADC0322A38BC8735578D795BD496DF
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...............[...[.....[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[...[.....[.....[...............[...[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.276527418542755
Encrypted:	false
SSDEEP:	12:2+feikM6lrCfmCfmCfmCfmCfmCfmCfmCfmCfmCT2CT2UZx2:2HikjlWLLLLLLLLLTDT5x2
MD5:	3F454D2430A8F1113ECA4FA57549B1B9
SHA1:	B74093256B89FDC2D1DD7AA25F48BB60196F8972
SHA-256:	1BEE9A3930A5D2E49CB715CCDC23A69E15DB52073B173A0A4A9B7797540D3448
SHA-512:	8C92B2F1F47B8A226B67BA954299DD95B6CB13D9B8696122E15A4CD3B56493003D7DC71D5485E6834A0CA147DE78FD51E2932AD249CF5B333FC8954E00D1F51F
Malicious:	false
Preview:	BMh.......6...(...................2.........................r..r..r..r.......................r.....[.....[.......r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.....[..............................r..r..r..r.....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.4266194565886572
Encrypted:	false
SSDEEP:	12:2+feiLla8pppppppppppppppppplSalS6qb:2HiLldSKS6C
MD5:	86F5359594726377CCBA1A3619BF9EC0
SHA1:	856E22D5A422F1FCE7502F36BE4C89828D9F7545
SHA-256:	9702F274A0727CA55A5F5C1D8C8D4AF37ED9877F7A8A58D12DD54BB7870FB75B
SHA-512:	77D8588C7186B015B3EC8B3F8D5DE13EACF4FBD375B901E56EC577088AE538A5E570CD609624833591365325FDDAB83C866E956B318D2190FC05FF8476B85E85
Malicious:	false
Preview:	BMh.......6...(...................2....................r..r..r..r..r..r........................[.....[.....[...............................................................................................................................................................................................................................................................................................................................................................................................................................................................[.....[.....[...........................r..r..r..r..r..r.....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_focused_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.286697325209135
Encrypted:	false
SSDEEP:	12:2+feiI8LMdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4MQ/ad4MQ/ad4HzfF/:2HiI2MduMduMduMduMduMduMduMduMd6
MD5:	88BE733905207D774F2FDE2C5D7F2616
SHA1:	20039A715E52FB996A24407F0EA3FE5426825E07
SHA-256:	0E322BAF5D1478252A21A2ACF308D311CCD7C38977E3A73ADF65212C40BA6C07
SHA-512:	0842C53BACD507303E28D8BCF8C2B732AD886A593EE1B7086C7C73942744EEE03BF87DBDDDC7898E524BA1DB26D78B390AFC39246A9AD1A119D45CD24F932D85
Malicious:	false
Preview:	BMh.......6...(...................2....................r..r..r..r..............................[.....[.....r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.......[.....[.....r.......................r..r..r..r.........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.180304508432754
Encrypted:	false
SSDEEP:	12:AAf0tuiuSSZilkMidilkMidilkMidilkMidiuMidilkMidiS7MidilkMidilkMiE:uxufRRR1RtRymRRRR3RRWRD/
MD5:	A82EBC9BC91035DF4E944061B03C3564
SHA1:	B0F346AEA3F69A962EB48887C15F03E92D3DC3FB
SHA-256:	E575B01625BCD8360D30CAEC6249E76C85B4BA502CBA1739580D4402A346E4FC
SHA-512:	08170053A1457AC5EE4B0F1E5C1100F20BDF5D29013DA87E84363F53C4F7C29929AF73AFA49473DCEA8289FD28FD57915D14431E1B4789E47881623F50B9E6F7
Malicious:	false
Preview:	BM........6...(...................................................................................................................................l...............................F...............................................................................................................................................i...............G...............................................................E...............~..............................................................h.............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.622750727369089
Encrypted:	false
SSDEEP:	12:AAf0tuirididil7ididil7ididil7ididil7ididiY4ididil7ididieZididilg:uxNp
MD5:	2DAA645EB6BF45EDB4564245B07456CD
SHA1:	5384B8BF5BBB0C1DCE97BEA43D313B2BB20FEA7B
SHA-256:	FB2B626C05C11EABD9DAAA61BBF6890FA44C8B1BEDFE0A3B58A458EF6D02A282
SHA-512:	2198F4D2C40BB150489AEF3EBF1F9B0ED2F7EEB7B5F5601B0897CEF255620D3D3CBE85D33FBF4DABDC3A8BFFC992439547BE47F87219AC731ED9E901A06ACEF2
Malicious:	false
Preview:	BM........6...(......................................................................................................................................l...............................7...............................................................................................................................................i...............G...............................................................E...............~...............................................................h...............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1922092703375164
Encrypted:	false
SSDEEP:	12:AAf0tuiJMiZIidiFridiFridiFridiFq4idiFridiF9didiFridiFridiF9RdidQ:uxJj0kjQ
MD5:	DBFA60EBF427ED32D34F477F288E184C
SHA1:	2EC5F17A934C6C37F494F44DB929D63F3ECBB39A
SHA-256:	C70207ED01307045353F5F096A6E16E8A8D7E0F85744AA66272D642E3D03AC65
SHA-512:	B53239EBAC06A040D6996D35D064C097216B16128EEA0DEC4D662F1D91A9CFCDBB5A6321BDDC7FC5AA57B59DAD8CF15B7681D71C9F4ED631ABB9E3244617C09F
Malicious:	false
Preview:	BM........6...(...................................................................................................................................l...............................D...............................................................................................................................................i...............G...............................................................E...............~..............................................................h.............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.2694963705894335
Encrypted:	false
SSDEEP:	12:AAf0tuiuSUNNNLtdrjZNDZNNNN3NNw5jZNX/:uxuZzi5H/
MD5:	C389AA45303F5AC6927D115D327A320C
SHA1:	5428394462E57E49D47DAE7DE18BF3395D309794
SHA-256:	802E5A9C85BECEB56A01CA20E806B6CD33C2FCC1D01DC97DE0AA98A367ED1293
SHA-512:	0EE4DD7C4D71278D54450D8B39EDFE09691DE857A1EDB13FCB7AAE595B3E42F0343AD7A05E6CEF22E7139E3357CA594B683DF894831D561CDA6EA68C34B076FA
Malicious:	false
Preview:	BM........6...(..................................................................................................................................l...............................6...............................................................................................................................................i...............G...............................................................E...............~.............................................................h.............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.6355892144875552
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36tf3NZtQMt5T5T5T5TyxMt5TTNT5TVDT5T5T5T5TdxMt+T5q:BGl/Ilf0tu/6DZJZts1xv
MD5:	33584E1CE52E751980F93997612C3478
SHA1:	7C79847ADCC60D38D0E8888CAA25E29EB58F261B
SHA-256:	55AAA22455FF6E056BA95E4093C6E86B586CD108828BD52FEA8CF69E77C3E248
SHA-512:	6F54F4AD66EFD77114A4BEB4DD713FC80E2F6C323EC0D003FAA3FEA6DF0AF46FDC10A20DA1A72F63A01D4E73088317FF47D7D528178AB3D526AFD7A4E6CA5039
Malicious:	false
Preview:	BM........6...(......................................................................................................................................l...............................6...............................................................................................................................................i...............G...............................................................E...............~...............................................................h...............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_basic_w_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.2853693864624494
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6yK1mrsZwsZwsZwsZTsZfsZwsZis2sZwsZwsZwsZwsZ6sZwsZwsZm:AAf0tuiJmrsZwFFWqFQ2FFFFLFFkFFjQ
MD5:	9E76E83DAF58AE7D1AD96DB27D43160A
SHA1:	D12E5AED535CF76F0E1DE4F8DC450E735F4EA2AF
SHA-256:	074E20B5C5D0A2D5E6C3F7D8D4745EBCC2D66DB9081EF43DB339A1A09E65186C
SHA-512:	7CA2210AC51253E76FA566967F339DD0720ED85CBCA2D0E7E5F7945CDA4150526180F45D6120D481C3A62AE7F8B53AABE7609DF7AF814B086F4A45CAA1E146EF
Malicious:	false
Preview:	BM........6...(..................................................................................................................................k..............................._...............................................................................................................................................i...............G...............................................................E...............~.............................................................h.............r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.078279029642031
Encrypted:	false
SSDEEP:	12:lEKrsMididididididididididididididiFiMididididididididididididiJ:mYssoCJ9fi6
MD5:	6ABFDD8DBE54E091566EB3AD13F514B6
SHA1:	A91A309DFDE63F9B908BD97FCFF5A94138B20665
SHA-256:	9A26F5C64A83964703DF28DE6CF968AB87D3555CC329923D1816B0021F93BE2B
SHA-512:	EEA5B0390BB44402E1A0CBB5E2C23C7BDEA34749DF0F035FAE86F035CCEB82D3C338E8349F034CD1CE58A4FD13A8DF119CA22EFC787F57CAA3E32A45B8150E3F
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t..........r...................................r............Q.............r.............................r................................r.......................r......................................r.................r...................A.O......................r...........r........................J.........................r.....r.........................S.4............................r.............................,.........................r.....r..................................................r...........r........................R...................r.................r....................F................r.......................r................3.2.............r.............................r.............. *..........r...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	1.0750005735157324
Encrypted:	false
SSDEEP:	6:ll+Wtu6B6jGCuRa7PR4PRaAuRpjqq8aG7aDRaeLOp8t:lEKrdDSG8AuRjL0aD8ecs
MD5:	7E0EA93273F65AE76B6A5D124A56E4E5
SHA1:	E8E8A09668CDF78B4B69AE87537ABE65F214FFEB
SHA-256:	A4EC465156FE80385998E78FB223FBB4C439004978601F8B015AF1084FD59912
SHA-512:	1A63BAF9A975888E6C4BBC461152679BD9032D52E798B15C2D825324DEE2248B298D7D54C9EB2606A34A58603B57906AFF180E59A6A6309328054E8D9F8DB59A
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t.........333.................................333...........Q............333...........................333..............................333.....................333....................................333...............333..................A.O.....................333.........333.......................J........................333...333........................S.4...........................333............................,........................333...333................................................333.........333.......................R..................333...............333...................F...............333.....................333...............3.2............333...........................333............. *.........333.................................3

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_close_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.078279029642031
Encrypted:	false
SSDEEP:	12:lEKrUllBA/56RqJ9hRZU5cRZPh5JyRGV5NlB+Qq6:mYUllBy56RqJ9hRZOmZPh5JyRi5nB+P6
MD5:	7DFC3348F19C49B07B56FD79641C8775
SHA1:	DEBA9A034548B5FBA47B6FB0799265DBBFAB2A94
SHA-256:	991B37D235A67EBAC998AE644E3354F27A6A897F1EE6E0861BEBFE61DEF24E6D
SHA-512:	2DA164AE305EC66C5247C6AD3C811A3534E58EEA8A2901DA5372951351FD2415EC98E7699E9F7D5D6A8DF0B66111105717F87AF942FD52CC3B210AB7208E260C
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t..........r...................................r............Q.............r.............................r................................r.......................r......................................r.................r...................A.O......................r...........r........................J.........................r.....r.........................S.4............................r.............................,.........................r.....r..................................................r...........r........................R...................r.................r....................F................r.......................r................3.2.............r.............................r.............. *..........r...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	3.3179872123314142
Encrypted:	false
SSDEEP:	12:2+feiL9eeL85L5+885a5+885a5+885a5+885a5+885a5+885a5+885a5+885a5+6:2HiQU8V888888888888888888888888R
MD5:	686EB610127E25FFFC62BE1CA97993EF
SHA1:	3B964F895DD10D171A8F1231133E7A2BCE8F5B5A
SHA-256:	87C85DEDAC9B0D3070445EF090FD188F1DD7A015CE1E8AFF2B71E7D576394F1E
SHA-512:	6FE480F278B12A3648EC6A05C7BEFCF377206AC6EB28E3375F6B37EE1CB9CB445B3367098EC1D8AAD46F5A7DD4B6CDFBDB41CFA496079813180D1133FABA6170
Malicious:	false
Preview:	BMh.......6...(...................2.......................>.......?.-..................................................................................................................................................................................................................................................................................................................................................?.-..............?........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.678949889807071
Encrypted:	false
SSDEEP:	12:2+feiBHG999u888dk888i888i888i888i888i888i888i888i888i888i888i888:2HiBV888dk888i888i888i888i888i8B
MD5:	AA8BE9125E8F4FDF47F181F815E5729F
SHA1:	4E3A132F661FBC9D0356C08A65E6D2200369E6DF
SHA-256:	E97B11AC0DF159D71EB8022E10097BF9169D7002D1B55302C4B4D879789B3241
SHA-512:	A1163B840FBCD88C0C1BB5BA2F671540FEECCFA8CB225F5F1F59D9A8CE71250D79C618CCE842349586785E5F7265A611D48414C26FB657243A8D3FDC7C9AB45D
Malicious:	false
Preview:	BMh.......6...(...................2.......................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_focused_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	3.321663612504288
Encrypted:	false
SSDEEP:	12:2+feiBHG90M8MIA88MA88MA88MA88MA88MA88MA88MA88MA88MA88MA88M87G955:2HiBjM8MIA88MA88MA88MA88MA88MA8H
MD5:	631BB1BF7FB0EF53416128AE9043DB64
SHA1:	32C60B80FFFB2B1CA2E1351C01740E8F377F16F7
SHA-256:	0FB9ACD8A640CF9E6FAFB251985ADCE8EF5A13BEDDC3073660D4D3CCBE314243
SHA-512:	A51BAFCFBD1022CA02B2E14CB8A583392A4219EC9E4C7799E01EA665D074B98C18E6319FB17518243812F1E77C35A317E848B2B516AD912AF494E39B404C1C0B
Malicious:	false
Preview:	BMh.......6...(...................2........................>..............-.>..................................................................................................................................................................................................................................................................................................................................................-.?.......?.......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1591264880599934
Encrypted:	false
SSDEEP:	12:AAf0tuiLPaeLo8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8eeLD:uxDaUo8o8o8o8o8o8o8o8o8o8o8o8o8N
MD5:	ADF7B3A1D082A37F0188C79630F4DB86
SHA1:	798B5C1E5AFB87D16E71D1A38650DB2B61C55001
SHA-256:	C389431ECADF0900053C9D605EFA6CFF7547DB370D4E678160E038E6915A7CE6
SHA-512:	E2ABC17FDBCD99FF2C0522EE4771FDFECE622C1DA66AD6A5F0157C8BB99905E165EE83141D75B37C0283094C87A2EC8A073AA07BCDF7B3C57D4471EDEFE7C1F7
Malicious:	false
Preview:	BM........6...(...........................................>.....?.-........................................................................................................................................................................................................................................................?.-...........?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.5068758547798673
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG998x88u88u88u88u88u88u88u88u88u88u88u88u88u88u88u88u80:uxBxx88u88u88u88u88u88u88u88u881
MD5:	191A8C46C6D80A2577A3CF686CA61BEE
SHA1:	642E86F2BDFB04F520114C11231BABE7844E3293
SHA-256:	3C19807A7D819D9F911D93747619116E1A3D0E8514D865B14ECDBA18BDD6AA92
SHA-512:	694BD0D6D945C2E038969ADC1334B194B4C369749786F70A50E1C758F75FAEAE52094CB4A4028A046100C0559835AA56CC96508B1B45B534EAD847CF2320A6CE
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_normal_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.163619866049062
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG08Pw88888888888888888888888888888888888888888888888841:uxBr8Y8888888888888888888888888L
MD5:	814ECFFF15216053BCAD77B15C0DBF47
SHA1:	8D08664A38B6CEA4CDE338A514AB365146DD2ACE
SHA-256:	219A7818027654A14F5CE9D2C016BA540D184C42733CBA95E3C1F023C0923A4E
SHA-512:	7313D835E5EC647DC7B8E1FA07E74E61434C6B6846249AF8B9FB205FF6F2A61D450C45F6120AB092D3C44DC2D8099DA7705ACDFC3FCBD1E9F0E0C923655A9F18
Malicious:	false
Preview:	BM........6...(...........................................>...........-.>........................................................................................................................................................................................................................................................-.?.....?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1511899801234855
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6suPGz76676676676676676676676676676676676676676676670:AAf0tuiLPCEmW
MD5:	D0ADB75C535C33441D58B30476F59153
SHA1:	25DFBBF7ABDB73C0BD44F54FEBCA3E61839EA4E6
SHA-256:	C3630F44043CCE1054FD6FD0F675F7A7F754081E49343650C2B99C67F6AB43A8
SHA-512:	4C49786D68E02DC85A50B60F605DA8C91FA4B856E62C611D5138EE8ADF7D4936C5EBD5DCEC71DB129A00503F22EE73E75CACA6766F01205F1787A2400E0D8473
Malicious:	false
Preview:	BM........6...(...........................................>.....?..........................................................................................................................................................................................................................................................?.............?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.5068758547798677
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6BHG990d66o66o66o66o66o66o66o66o66o66o66o66o66o66o66N:AAf0tuiBHG990i99W
MD5:	FEF55576BA6DF8D9E8DDD3F3A248AA6A
SHA1:	70D1C75928F1A7CCC5FA26D633C9DB760282F940
SHA-256:	87263D53FDF0305F2FDF9414EFF7511BE21C36869F1676ABD2020D1A46484290
SHA-512:	C6AD6759B6E7F5FA75430EB397700736E21CEE427C7ECD1F13DB702C5381EBB266E5DFCE5E810710ADF226DB227B06ED1585EE0A1C03C08FD75F6478EC00C88D
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.155683358112554
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG0cZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZz5D:uxBrwD
MD5:	103FFAD69F809CA954F63AEE5CACEFF0
SHA1:	03C606C0779423FF6D6C003B5234CBF6A7D5C1C1
SHA-256:	AFD4D14DE45DFBC9FA432A9C9632D15E19B52FF7A9A8AFDF1503E3E1A77F2E81
SHA-512:	D54C1A1F451FDFE0FF2919D88F597597E919C097E2DDDB60A7F95AB10B625BC847EADFDD9CDFADAB4BBE522BD9A60D3BBAEF8F260349A1E5E44C2DD8C32BE505
Malicious:	false
Preview:	BM........6...(...........................................>.............>..........................................................................................................................................................................................................................................................?.....?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.831623311359014
Encrypted:	false
SSDEEP:	12:AAf0tuiLP+ty36y36y36y36y36y36y36y36y36y36y36y36y36y36y36y36y36yj:uxD+ty36y36y36y36y36y36y36y36y3x
MD5:	B7EB369527DC360E4D2DFF873EE53834
SHA1:	FDD0BA19D7F8159F0BF73F1987B6FC1885114959
SHA-256:	757A1E027FEE5EB5237603F7ED3A65527B183C71F7B38F92F8D8C13F7EFE2847
SHA-512:	8BE5E9ABFE0080FF7D5C5083F47FA8C3D5ACD740E1302B731EA70048E37B396E531D11AE982679C283C3BE36D6AFD63B1CED57A96409DD49A24803D97F7B5B11
Malicious:	false
Preview:	BM........6...(...........................................>.....?..........................................................................................................................................................................................................................................................?.............?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.142277993912724
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG99066yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66v:uxBp66yv66yv66yv66yv66yv66yv66y2
MD5:	49780B0D4D38F59750E1F9850C319D66
SHA1:	A8A2291325A8348378CDEF30139E0A7B9EB682E6
SHA-256:	1B8DE47AC5EB946316CD700128C8B9354DCD2161AFFF89917E80D3B21B0F0CFD
SHA-512:	73180985D587E3435D9D62E5E11880C4EA022BF6A395F5E4BBEBBDB9E71196FCFE37968BB46C494493E75E651BDD6B7770F8C556F0CA7E305682B3AB736A7E77
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_default_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.8361166893480827
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG0qHJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6c:uxBrqHJ6K6K6K6K6K6K6K6K6K6K6K6Kh
MD5:	729E722D8059285A7CAB6809EC0B4420
SHA1:	881C61AE2FC7246D5699940AA58890F8D707EF00
SHA-256:	8C9D8663881C49901C2393C2573D873E1596B79767AC5723EC990B547586E359
SHA-512:	8E58E8181D3D466CB45FD08A069450B3B89EEE18505A8AA718173F4930B425FD1467AB9A5011EF17626E8BC8A601E3976B9E01ED693D9FB058FBA02E7D494E2A
Malicious:	false
Preview:	BM........6...(...........................................>.............>..........................................................................................................................................................................................................................................................?.....?......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0556239707913395
Encrypted:	false
SSDEEP:	12:lEKrsMididididididididididididididiFiMidididididi5idididididiFE6:mYssslCcJ0si6
MD5:	B0E9CC4D2D37934CC67C6B5667A4E3B3
SHA1:	CECBE25F64DDC0F95AC0E74062E610C210B0392F
SHA-256:	6E5A77DA15ED13E4D93AD716E179E0A93BE5D1F5F960161723A76F7827C439FE
SHA-512:	7A077CC7EF1D6DD0CE53E890830924DAAA94272395EDA4B9A71221C270DC2F74DB8A30DDA4E752CCDB92044355DFD9C745D00D73B4C261B76B9D0054DAB50BCA
Malicious:	false
Preview:	BM........6...(...................v......................................................................................................................................................................r............................S.t............................r..............................T........................................................................................r...........................................................r............................A.O............................r..............................S...............................r.........................S.4..................................r.......................,.....................................r......................................r.......................r..................R................r.......................r.................F................r.......................r................3.2...................r.................r....................X*......................r..r..r..r..r...........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	1.0362883229418132
Encrypted:	false
SSDEEP:	6:ll+Wtu6B6joI18lDRSs80YR3jiS8a27afaRDLOp8t:lEKrvOIc0YRxLkafaRDcs
MD5:	41B88B28CB736532445F59219B525786
SHA1:	E7E5BDC9A4B3B0C44C3B3AA983BC4B649E3AE266
SHA-256:	D875A8F4333F0D60AF63A9E1D3308F40809448C0FFF84DE824E71583A5CB7659
SHA-512:	A06B8EF9C58CF28C521359629E68CA4FA751CB2F72A7F78AE6538483FAAE12359B5A36DE94C75850FAF4A41C594762F6CD2849AD422BE5C5380F96D3B4FD4AB6
Malicious:	false
Preview:	BM........6...(...................v.....................................................................................................................................................................UUU...........................S.t...........................UUU.............................T.......................................................................................UUU.........................................................UUU...........................A.O...........................UUU.............................S..............................UUU........................S.4.................................UUU......................,....................................UUU....................................UUU.....................UUU.................R...............UUU.....................UUU................F...............UUU.....................UUU...............3.2..................UUU...............UUU...................X*.....................UUUUUUUUUUUUUUU..........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_help_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0556239707913404
Encrypted:	false
SSDEEP:	6:ll+Wtu6UgaNWZtN4l5gg25UBs1B3R1Rk1RGVtVJKTxUHZQq6:lEKrUgaNQkJwUBUB3R1R2RGNJgAQq6
MD5:	52D839832657CF74D3B28E412B5E8931
SHA1:	02A4C88F8431256E209D2006A41CD58A1B8A54AF
SHA-256:	5D378EA3E3CE5AAD48FAEB161F456069100702E18565B42747421D258147F23A
SHA-512:	125F6BE3B33AC9F551228927DFCA36C5D87681EC1155E7F056E04DA95B19254C90C108FE4016FFD7568E841B54CB667ECAE4B9215BA454C63D1B418EBFE1FE8D
Malicious:	false
Preview:	BM........6...(...................v......................................................................................................................................................................r............................S.t............................r..............................T........................................................................................r...........................................................r............................A.O............................r..............................S...............................r.........................S.4..................................r.......................,.....................................r......................................r.......................r..................R................r.......................r.................F................r.......................r................3.2...................r.................r....................X*......................r..r..r..r..r...........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0141196290884955
Encrypted:	false
SSDEEP:	12:lEKr8MididididididididididididididiFiMididididididididididididie:mY8sb6C1JSBi6
MD5:	AF3BE9968D309E226DF97FFD7EF1159B
SHA1:	369810E340961CAB5E4804B8B9EBBB90C00054EE
SHA-256:	89EACDD7643AAD7A7C2DB3DB82C64E6642460493E690B2EA9CCEFD71925C2882
SHA-512:	D6DAA7908E2F56D31E584CD602D3A586F15ECE77FC0C0D1D272F2596AC4210394E09EDCC8B9F19A29AF6B437D126D88A9F785A93530FF1B5D8247202C753B233
Malicious:	false
Preview:	BM........6...(...................v............................................................................p......................................................................................................................S.t...........................................................V.......r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	0.9850017914518017
Encrypted:	false
SSDEEP:	6:ll+Wtu6ByLp6yHRgs8qqRhjiS8aW7ab8VLOp8t:lEKrwlTiqqRzLEa+cs
MD5:	841EEBDCDC27657BD8587FA08F14062F
SHA1:	8D35A1E3CBD43793E1F344A0F0D52A12A4C41F08
SHA-256:	4DE8099D3E975D04C664A283A0EA1B44CB0A89D5AF39326CFEF975F7062FAEE6
SHA-512:	55DFB35D7D863291A3BCE66E518996ACE30C21A8772AFEFD0021A0778A372300B4F9564CBF06EED31F7BDB33527C0FA733003E141F644EDE3818FC7D41F2F44D
Malicious:	false
Preview:	BM........6...(...................v............................................................................m.p....................................................................................................................S.t...........................................................V......UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_minimize_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0141196290884955
Encrypted:	false
SSDEEP:	6:ll+Wtu6Mlb1jUBZtMloxMc12SVtuTMZQq6:lEKrMlPkbGTqQq6
MD5:	2B6CC1E2F02AB71D925740B4F9E61C0D
SHA1:	DA8C21EA42A089072ABA5C7089CF148B7B251CA6
SHA-256:	65F83408EC0C31415ADE59C9E46A09E1C0423A50B15CC20AD4522B5BCED9C724
SHA-512:	91F67D0CCC47C074B300ED1A5B66235E19FCC5F6B613DAFB1F05B06FA5A851A1D9DA52699F5C6C4666948AF690371E4E2D50EA9F824DFE06B1064D7DB2BBD439
Malicious:	false
Preview:	BM........6...(...................v.............................................................................8.....................................................................................................................S.t...........................................................V.......r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dafault.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	2.094902798504834
Encrypted:	false
SSDEEP:	6:4lclgWtSt6RtRJKRJKRh/aIKRcaxKRlCxKR7KRGrQFRmKR3jaNFRJKRJK5:4lU7S0RtOOLaTaagD9IwQFHpaNFOO5
MD5:	C3E712EA16D620CFC55939D256EBD989
SHA1:	48B7A845D19469BA6FF80050EF5B22F5F70C6974
SHA-256:	9B682D3D13CD981DD554DFE27A1A78C96F47A73C10D4780D869D9649C7F3CDC3
SHA-512:	25068C52C2E643A42DFBEE4673F15567A386FF789A09A3BF638D3023321D74A0F7D15789FC6D298840AEF3FBC9DBBBCCA42F615F084C4D086A0B88E90A1ED65E
Malicious:	false
Preview:	BM@.......6...(.......................................UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUU............UUU..................UUU.UUU............UUUUUU\|\|\|............UUU.UUU............UUUUUUUUU............UUU.UUU............UUUUUU{{{............UUU.UUU............UUU..................UUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_dim.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	1.5175968046789927
Encrypted:	false
SSDEEP:	6:4lclgWtSt6kTyvyvyUy87ylIyDyZEyr7y8yvyvyv/:4lU7S0RqqrRpuBSjqqH
MD5:	32A31E7DEA045F0E17F3DC6796CD218B
SHA1:	7ECBDF7D352102CC1846B8F5E0F57D156243E6AA
SHA-256:	C988D6AB51E291C77BB5DD1EED6F9056F4B641042B74E2B9B8F0480D23C7FF7D
SHA-512:	81F6ED8363F0F83E7A7BBE5887938E3F85198E7E38E7CE2D0112F488F1D9B97A962FC69B7B7690038CCA2E56B6DBB09F0FE0BC20A37E43543BC89E7B65692BE3
Malicious:	false
Preview:	BM@.......6...(.....................................................................................................................................................................................................................www.....................................wwwwww..................................wwwwwwwww...............................wwwwww..................................www.......................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.7161727633034305
Encrypted:	false
SSDEEP:	6:4lclgWtSt6L2QeFggiQeDec8gk76Qemq8gxqHVQe1wbg2yi:4lU7S0SqlHcHWuuIRwbVh
MD5:	19C4BCB07FD3E99301B9D41E91DA8DCD
SHA1:	639248EA3D0D38768309CC53615BEC164249DA66
SHA-256:	7A811C8315488B4A8162A12ED78F01094C9A6C3CE08349D5B1FA9685235D734A
SHA-512:	09CDD5A1CBE1E0CBB9AF96F49B9F30E5387CC75A0EEBFD2B6D1BA65DA33BA83EB1C28FAFAAF187C6C24FF5435AEE37506A6AEE4DE55434B582F8E80EDBC1F307
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..@....@....@....@....@....@.[...[..................................[...[..@.........n................@.[...[.............U...Q...............[...[..@.........U..U..{8..........@.[...[.............U..U..U...G.........[...[..@.........U..U..z6..........@.[...[.............U...O...............[...[..@.........k................@.[...[..................................[...[..@....@....@....@....@....@.[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.2218862614670023
Encrypted:	false
SSDEEP:	12:4lU7S0+7MididididididididiM7MididididididididiM7MidiDm+ididiM7MY:4lQEIIfIEv6LlZ2zIx
MD5:	0942C181CF63E2451B78D894B8B0AAB6
SHA1:	288195A8C68301F0E0541063E455819D364EA18A
SHA-256:	50260F36405FE5353E8D636081F12EC2B1A4E69D215865D644BFC0750D08EC6D
SHA-512:	BE6321FD6B8617949ADC05B6FF419B0E4975CA0BA10CE0BEFA9ED5F7D58E1CDBA97BE69BBC7133717B02661DE43731547B8129E3AD4E657A6C614F07268DBA33
Malicious:	false
Preview:	BM@.......6...(........................................r..r..r..r..r..r..r..r..r..r..r..r..r...r...................................r...r...................................r...r..............d...................r...r..............r..J................r...r..............r..r..3.............r...r..............r..r..r..A..........r...r..............r..r..2.............r...r..............r..H................r...r..............b...................r...r...................................r...r...................................r...r..r..r..r..r..r..r..r..r..r..r..r..r....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_next_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.360314059244064
Encrypted:	false
SSDEEP:	6:4lclgWtSt6/2eYioecck76XqcxqHViw122i:4lU7S0/2rio8kWzxIiw122i
MD5:	D9D9145099E15D68DB3A93E63F42AB0B
SHA1:	E226C3604D568B1ACB67629ECE2405F899955338
SHA-256:	4EDAF8703A2AD7E617B82298BD955D97D174FBD233C929D350DDB90E31D4C327
SHA-512:	391264F6096C13AC41D028742FC670AA1B8EE26564A24C6EC8E608ECD47FB528D315ED9231DADF309BDCA51DB08AD8B02A2787240E695414AA5476C2E61AF18B
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..................................[...[..................................[...[.............n..................[...[.............U...Q...............[...[.............U..U..{8............[...[.............U..U..U...G.........[...[.............U..U..z6............[...[.............U...O...............[...[.............k..................[...[..................................[...[..................................[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dafault.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	2.085997984437489
Encrypted:	false
SSDEEP:	6:4lclgWtSt6RtRJKRJKRCa8axKRDaIKRnKRrKReOKw1KRw/KRALFRJKRJK5:4lU7S0RtOOUagpck4hKwU3eLFOO5
MD5:	CD0BEF50D9FF5ABF0A59690B17478F8E
SHA1:	5920EA3C9788BBA5D052D89D2917095FA481C110
SHA-256:	5C555E86A21650026DCEA2BEE1AC316A1F3D873BE520BFF06856E89A36CBEBBB
SHA-512:	032E4A7DF19EF50A45D894CCA86739A846C213BD7B4F9C3D4E6E1AB19900F9CA31B0900E53E47CB851AE97FFB8807703B976664C0B7E1EFA8A00EEBEB181D815
Malicious:	false
Preview:	BM@.......6...(.......................................UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUU..................UUU............UUU.UUU............}}}UUUUUU............UUU.UUU............UUUUUUUUU............UUU.UUU............\|\|\|UUUUUU............UUU.UUU..................UUU............UUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_dim.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	1.5175968046789927
Encrypted:	false
SSDEEP:	6:4lclgWtSt6kTyvyvyryjx8yUW71yryVyjvnywtyayvyvyv/:4lU7S0Rqqmdjl74mYLywtCqqH
MD5:	F36896B880336C006F5040FFADF50857
SHA1:	713F7D373040363B94BAEB21149303B9BA98D28B
SHA-256:	8FD35668E48D685A5A92A43691F1AB05BC6ADF1FC8144F75375F356288B61558
SHA-512:	1DFC59E907F5A93101641021B31AE8272BD48578A56A1DBC3EC8E9FCC52F6F0B65360E80E6E8F7CC50A978F0DCFB78EEF6DC3DA54E26CD88DCDB3557C2781589
Malicious:	false
Preview:	BM@.......6...(..........................................................................................................................................................................................................................www.................................wwwwww..............................wwwwwwwww.................................wwwwww....................................www.................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.719644985525653
Encrypted:	false
SSDEEP:	6:4lclgWtSt6L2QerKmbghuVQeV7gsHwVQeSA7gw68VVQe9Hqg2yi:4lU7S0SfKMCuV573HwVX75VVNqVh
MD5:	FD6F7307BBFE70F597D9BC914DD94B98
SHA1:	BE5EE51889D4572FB23E03EBD1CBF86C7505D44B
SHA-256:	796BDEAC0A3B0CD6E0D0B62D35D8EA3D738D2F7499E42381D6ECA4CF25C92708
SHA-512:	79B2E69CA673BD372CC9E21E6FF124691AADD54A18DCF96E7809479D0191F4689EC79F3D582637B1D36EB02FAFF89B48F8AECBC8B624FAB6DC7A10CC9125168C
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..@....@....@....@....@....@.[...[..................................[...[..@...............o..........@.[...[................Q.U.............[...[..@.........\|9.U..U...........@.[...[..........G.U..U..U.............[...[..@.........{7.U..U...........@.[...[................O.U.............[...[..@...............k..........@.[...[..................................[...[..@....@....@....@....@....@.[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.2503961889914077
Encrypted:	false
SSDEEP:	12:4lU7S0+7MididididididididiM7MididididididididiM7MidididridiM7MiY:4lQEIIoJo3SnSwn3tSnVnhl
MD5:	5C835038A958F017848BC55A82A7756D
SHA1:	11ECAEB5901A65D15B14712E76D76DD3FA870C79
SHA-256:	E7CB595146B9A8A45B4E941BFB5BA64C1F5A615F84201B3178F5640F9753DC84
SHA-512:	073D64A2AC4E3040841F466F9480DEDB8404503F41488E05563D2D68DEADBB0EBA7D3BA63E94E9CBD2B043E54070689069888FADE904A887A690C816A56B32C5
Malicious:	false
Preview:	BM@.......6...(........................................r..r..r..r..r..r..r..r..r..r..r..r..r...r...................................r...r...................................r...r....................e.............r...r.................J.r..............r...r..............4.r..r..............r...r...........A.r..r..r..............r...r..............2.r..r..............r...r.................H.r..............r...r....................b.............r...r...................................r...r...................................r...r..r..r..r..r..r..r..r..r..r..r..r..r.T..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_pre_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.3637862814662864
Encrypted:	false
SSDEEP:	6:4lclgWtSt6/2kKm1huV0VsHwVNAVw68VVgH622i:4lU7S0/2kKMhuV0VsHwV+VKVVm622i
MD5:	61E1CC0D3492A57C33976E53951BD2AB
SHA1:	5848BEB16BF9C243B38FC146A2AFD0CF8B58BE8B
SHA-256:	E8B3CCB3843B24821E9755B18D44ED0ABE5A0DCEDDE2F9E8BA721AD01B65FD12
SHA-512:	818F62A4D9BA4EF0D0E960F7D7DFBF2F0D30B8D5773FC76F638AF90C00AB2294D556CAD8E707ACCED8E191BB4CA9E832735EAE18E68F80C9E1FA62FA5ECE6F1B
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..................................[...[..................................[...[...................o............[...[................Q.U.............[...[.............\|9.U..U.............[...[..........G.U..U..U.............[...[.............{7.U..U.............[...[................O.U.............[...[...................k............[...[..................................[...[..................................[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.9372957110766484
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY63flrVfRXRfDfDcffDHfDfDUlD6HxfDfDaX6XNfDfDdDODfvfF:gz/mlqlfa6QTcl+UqaDfGDfGRDfw+/
MD5:	7BE9737638C4E9A27BB0E31418105B1D
SHA1:	28E3F91CFE4F8C46668096473EC34E7E7DB01768
SHA-256:	E3FB1EA02D595C4A57901E0D3BC95A476A5E1101C9E29A2E6721FC147CC15E71
SHA-512:	AEE8293ECF7F520B962DFA0160681FA9CBE21BFE47831B0E146C61AC99485C1000F3CF9B61EE682B0AAF65A6FB1137312045F841E9A88F4CF04734B66EBF6AEE
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.796526113707809
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6pfDDDrDDtfDfD+DkvMDXJfDfDVDrfJfDfDZrB1XpDrfdfDfDY:gz/mlqlfa67vMTvrisX+D2XK/
MD5:	2F337CC87C5DF691C92AAFD8E2126E50
SHA1:	C3E4A932467B4BF53418E3CDA22325FFDE9D8443
SHA-256:	512549234AF795E57E879EE95A89EC61E901A22286DC839B203FEBBE2C470D3A
SHA-512:	6259D0278C10F9D88492D9C2755E1DEA9B6CF9E0399929FB4BCD9E6083EF1C4CEEC0BDFDB7FBA2A97BB23646079CB876E613F5B90A8134426F2D49705139B50B
Malicious:	false
Preview:	BMX.......6...(...................".................................................................b..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_disable_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.9372957110766484
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6pfDjf/lDXDvLXDcffDHfDfDUlD6HxfDfDaX6XNfDfDdDODfvV:gz/mlqlfa6QTcl+UqaDfGDfGRDfwu
MD5:	965B96AA9ADB0E07B101AE8775249553
SHA1:	9B6D01F6E558702A68AE4A118F00C2822CAE6F81
SHA-256:	21755B3BFDE596DB9D9F7823AF30E3C965D74FFDAAABC387EAE3B61DAEFC1F1A
SHA-512:	B55436A9148643A766535B2C7ACC1785BECE9B545789563AB4B7B8040793A07D50709D3529F84BF8A130D8E3917C7D39C38E5883C665CD4ACE640D9FC4E97621
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.478915649491828
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6qOh4eeuCR6azM3JgGtUG1RQGUGfRY7zKrUBA5QYKoj:grmYXqOh4Jc3OPF9wI3Qj
MD5:	8EACCBC6E435F7AEB69B26D176A8A4F2
SHA1:	53BFCBBFA2501E87C8022E7E442CBE38CFC4C8F5
SHA-256:	46ACFE46B1780135202E692015512E3C4654CFC2E3C860850461856F4EF4C8B4
SHA-512:	DF8A204920EBD686192DC234AB40B1EB219F17D200B97DAF7040F426ADB9EEA54CC834E28DA329D552F47AAC50FCEF162A00F087F58C0983CB9996C2AC6DF5FF
Malicious:	false
Preview:	BMX.......6...(..................."...............................................................a..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<...............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.1860063448699476
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6+aaMiRazMRMPGWjGfdK/GjGDC7IK4jWdAudQudr:grmYX+hRagRdUUv
MD5:	D215E9B4CA76DD8835311CC559468D9E
SHA1:	F23EEA8BE216EA11212FBD96772B7C8B3F471894
SHA-256:	C95E50767F60DBDC2B1E53DE4DB8A7909AB62F3B574DBFF48D952F3AE6ABCBBC
SHA-512:	E7F0A4A51C2664322F74279A1FC8DD3F5C0FEB83721ACF11BC6860416A10DCE1E5C1158928B203E38162AEF983DB582EDD4C525B80D484E8105743CABE73897E
Malicious:	false
Preview:	BMX.......6...(...................".................................................................a..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<...............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_normal_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.489896767274784
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY693iKRaaCuRa1VR8rzR4QVrf1x8rY+4f1eR4w1sR441P1gaau3:gz/mlqlfa6LRoVUhrmoUFW9dtQZLUtl
MD5:	4C6F07F920A2D69D5F27031E34D8E159
SHA1:	CBE1BF87E04165784E35E66A89EE135B38030A11
SHA-256:	10A0D77F8437F42D525C4020E297BFC9E77AB8CE48CF04D320CC02FD085CB570
SHA-512:	22093CBF38D1A90832D677105AD01A2ADC9C4CF4CDCF6F3B88CA6BB3FE728AEA58AC59E34E56EB5A684F91272D28A7BD008A7B7B64F9A4FF9284B21B23CC5725
Malicious:	false
Preview:	BMX.......6...(..................."................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.867680005219824
Encrypted:	false
SSDEEP:	12:grmYXWuZididididididididididilum7MidididididididididididirMididy:grmqWEM297HO6nTHxqkGEEy
MD5:	A6D481306B52D313F94057F13F16B3D0
SHA1:	E6F63259859A4955C0D34BE38FD734265183C538
SHA-256:	E27EFBD310548D910DC3F6DE53255B88B57094535AF27A2296B4F81EE9A981FE
SHA-512:	C525F007E89DE0D5C95820C436928473352F28DA7B572FA3ECFB514FCFBB02F1948C0BA2563976AFEBBCDF461C5B324EDEB4B2835792FCC6226F0C49332772CF
Malicious:	false
Preview:	BMX.......6...(..................."................................................................_.............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.5988776359796097
Encrypted:	false
SSDEEP:	12:grmYXIididididididididididididilvididididididididididididiaididG:grmq1Ut
MD5:	B5AC58DA24885D754ABF20C1804D9863
SHA1:	6AAF7324960AB9976E8255D24DD89CC36160BC35
SHA-256:	19429A4B17353CF9CBE0FF1A01756DD916F919C1E6D098E413650F34218FCC86
SHA-512:	DEFF83C6A6EEF44B98BDB27BCF982458C98CB76F54179C6F6DDF0C60405EBE1F8DAB08E84F7B40421C41F48F9B8178AD97FE43FDCECD2E53315EBD8C1245D80D
Malicious:	false
Preview:	BMX.......6...(..................."................................................................._..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.879339978670193
Encrypted:	false
SSDEEP:	12:grmYXINididididididididididiSlidididididididididididiF2FidididiE:grmqIPGv2eIp
MD5:	E0B1A674099639FF6C2FD97D5617A754
SHA1:	C8179FE97C5A0D1214F1C464B5DD8B0C9E48AB6E
SHA-256:	22671E5A1C2A5232DF4D345DD561191724D2D943C1EF828FF33DE66C87BA506E
SHA-512:	6969D39C293ABD142F6987F3F5F24D0B179B5FB1937FF50E2FFBD0BF8495360598DE5CF78727ED5F3B8076E958DC9F8FD253D285382AE02D45DA8C83AF20B20D
Malicious:	false
Preview:	BMX.......6...(..................."................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.888247390617478
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6MPEe3QweRd7iSJdbFisi0vvCEFGy:grmYXoeRdLJdC0SsGy
MD5:	21AFE7C59EB3934E206EBF1D3597D9CB
SHA1:	04760C107262199EDF1BB8BF32654DC2D7C08D30
SHA-256:	D015D4FF8F083753365149EC5C44A2A3D71D578E9072038217505B824FF96817
SHA-512:	58FBED6BAAF73D8678D030DA84908540AB7C2AD50AF2743BB8A3730A5BA79D9F26C87A62C0C70FD4B19B837D03E1A124ACBB1A3E4E77183485A5CC94AF42EB31
Malicious:	false
Preview:	BMX.......6...(..................."................................................................s............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.608060192611487
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6FHTZjuTZEoTZdHTZ9k92TZf9Hwl:grmYXRoTWoXHw2Bpwl
MD5:	FB431E9A35C18579C7125A7AF6708F1F
SHA1:	7E48F1EC8737EE4094079D8A80F1B7FFD4B98EBB
SHA-256:	5727D23AB4526F1EC54D2F0815A69D90F38829ACBCF2C34783ABD51C52BF1671
SHA-512:	7422573BB211E5D07E4AE88068FBD3579109F34D139648783C6DA84B97D6D2EB5DA77F70C4DF046BFADA10B70C8881CC2C56E3A7C4D6209EC1A5BD3A84C611BB
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_setting_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.892270499376391
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6tf3YTaMtd05viMtHlK3ftsLM9yMtHtQsZlyMtX6KtHNugKtHY:gz/mlqlfa6IH4HCJlVYK5KK/QsisOKlp
MD5:	2E26EAC4E3C8557E999494B76B2E85EC
SHA1:	8ACF2AA1518795BA5376ECE04EA12B5A53DEDA05
SHA-256:	EF8F2316005AB422888CB567BD8CEC8C42FDF21D06642DF56031EC455C359E36
SHA-512:	789B685F1DA9DDE318ECD0D153AAB08442A2AE1B5C0B0C0C1D6C0F47D20F7B8DDEA5F2056EF590CCBBEFE589E5EE8EC622533957DCBE2706A4D1CBD6D12D4C1F
Malicious:	false
Preview:	BMX.......6...(..................."...............................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_f.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4007668065858567
Encrypted:	false
SSDEEP:	12:TuX26VI8IFVIFnrI1lNGdfbltQvIzNGlmI7XvIItT2uI1lnrIFCIFCIx:yGAI8I7IFIFGdAIxGsIjI4IjIcIcIx
MD5:	5AE7172988B9D98404EE22F2F7711A37
SHA1:	8CE13017EA6ED24E88C2DD20B94E1B47B64CCFA0
SHA-256:	423ED52A2D6ECC0749E28A7B8B38186542937F60093148E16C8A90D41752F94C
SHA-512:	8642488D2D1F1F6F5D8ACA0EF78AA8773C1A3FA581CB13D151531776B8BED0FE610ADAB14B10D8FA3301F35533AB4FC4D2A6D0CA126F97507EF295DF1F52966E
Malicious:	false
Preview:	BM........6...(...................n..................................................................................................fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...................................................................................fff...............................................................fff...K...............................................................................fff...............................................................fff....................................\|\|\|iii\|\|\|.....................................fff...................hhhfffffffffffffffhhh.....................fff............................ffffff.............ffffff............................fff...............hhhfffffffff.......fffffffffhhh...............fff.........................ffffffffffff.......ffffffffffff.........................fff............\|\|\|ffffffffffff.......ffffffffffff\|\|\|............fff......................iiiffffffffffff.

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4790348333166086
Encrypted:	false
SSDEEP:	12:TuX26iAA4zD2l1cgelBa18BHjw90GpEB57smlBa1iK1OD2l4UAAF:yGvAA4HI3YYgjU0GpI7sgYj1aI4UAAF
MD5:	F20747F650D1C1604F2A05E89178BF81
SHA1:	A3883CB0A53A8CD62B727F723D7F21D14EFFE51D
SHA-256:	EA0C9B29343FA9623C96D0DD21427366982405EC1019B430551BD32E13F06343
SHA-512:	DF1C998246E2DE2DA68624021E15CD7D9723F7708D4FC5CAE06F541B77EA5EA01AD21936C6BC0FF80A58FD0DF419AEF199B85B52A6D96BA3750B8D76A89FC894
Malicious:	false
Preview:	BM........6...(...................n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^.&.u..&.^.......................................................n.t..r..r..r..r..r..t..n...............................................n.r..r.............O.r..r..n...........................................t..r..r..r..........r..r..r..t.........................................^.r..r..r..r..........r..r..r..r..^......................................&.r..r..r..r..........r..r..r..r..&......................................u..r..r..r..r..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.2516710234164274
Encrypted:	false
SSDEEP:	24:yGAPPPPPXcEGYbq27K2+mY2rMEPYcXPPPPPe:BAPPPPPXcE7b77K2fdrMEgcXPPPPPe
MD5:	82B0EEAD9B27F4AE7F1EEFE5602DA161
SHA1:	9018D96F64B75B5138661094856324E5916A8FBE
SHA-256:	715594900F2F7811D30FF341DA4F1C9CFF14B45D517433FB15ED3CF49991285F
SHA-512:	2C9BE104A9B9727AC116DB430C0433587AFB661282C62D4E8E1F163397924C444185CF6DEA10BC7E4995DB7C8E95FF05D82B965DD50C14A75AAD417FD611C847
Malicious:	false
Preview:	BM........6...(...................n.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_info_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4512075346811657
Encrypted:	false
SSDEEP:	24:yGAPPPPPYABsx8rWdwQSUvWV58UFkTBYAPPPPPe:BAPPPPPtBUU8wQXv2HWTBtPPPPPe
MD5:	42551379EB404DBCEA6D57E2365A8660
SHA1:	5561919CEE888C15E58A76E2F3B0302532EA16C3
SHA-256:	FDDBDDA93A9627021FC74AE61B853DE75072FACEE9356B06BCB5EFF3AAF84C0F
SHA-512:	8473D5E937B0588ED07CC6F494257F48D550430D9772845B1F2AA8684A9F1902A0153CC53FEE5B3FD126801B0DDE69BD0EF9FA247BCAA7E6837BFCD94BD4D5FE
Malicious:	false
Preview:	BM........6...(...................n..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^.]&.D..]&..^........................................................n.C..A..A..A..A..A..C...n................................................n.A..A.............oO.A..A...n...........................................C..A..A..A..........A..A..A..C..........................................^.A..A..A..A..........A..A..A..A...^......................................]&.A..A..A..A..........A..A..A..A..]&......................................D..A..A..A..A..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.123616472262714
Encrypted:	false
SSDEEP:	12:CedlXZMididididididididididilXidididididididididididilVFidididix:jfXZIgV
MD5:	C78306F200AB60EDA0D51710BA16AAF6
SHA1:	7E85845BD1425319A0C8543F5CB530F1800536B7
SHA-256:	F405690EA841E777FDCDEEFC5D5F43E374FE5991B2A5358424714A34F93658E7
SHA-512:	3105873009F957FD7F3C27E415249F7760DA9D703CD0A9522E4F663F2A9419E4745B33170CB6EE7E80B3B8AAA4B849E77D50D64BEDADB169C45CDE76D95534D2
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	0.6872327444755697
Encrypted:	false
SSDEEP:	3:ClltUllP/lRlY6mRQXXnXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/lRcXXXXXXX+:C/mlPs6AQtlE3HkuXXWNEjHOXGILQm/l
MD5:	40F826E6FD8CE60D305E04B3A963A3D7
SHA1:	117A70BE0F9F4D0FCAAA02F9A4C657EEAF2AAE19
SHA-256:	70AF7297480D74D86C527D263EF215B5ED135419B85EFED95714775FDB94AEA9
SHA-512:	7B24DEBDEAA64EE0E90D6EB0D269B72ED6BAEFA38DCA423C80B45195146265C560BAF18EA5C6BC4EE0D2A008772B5609188AB1A9AECD381ED4324B7AAD8C59DF
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_left_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.122396960067592
Encrypted:	false
SSDEEP:	12:CedlNCI2MpppfZPpppppk+Ppp8cypppppppCI0:jf4nyZfQyT
MD5:	5AA7CFD3E62496218D76A4C6DC2259B4
SHA1:	5C47D548AE2306E2494EA42FF6EA016D5DFC1662
SHA-256:	EF602B5F633DAFF858DC13980714FECA1D13145F7010B7BE0AFBE5B128BFA9C8
SHA-512:	B86AAC76EAD328398123E675DA031A77361CEB715B5DEBAD72419AEA600A7DB38079962E51F36CD8F251BD099E0A5BEA6007545C16303A44D1EB16C70D45A60B
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.0267057339023324
Encrypted:	false
SSDEEP:	12:CedldididididididididididididilVFididididididididididididilVFidl:jfQgG
MD5:	F97913082272921F3A2B3D81E839E944
SHA1:	6A31B89E61246CAD46C3C5E9958E3B2C09FF9E10
SHA-256:	19B3FDF8E9D7E118F028265E968E5A8B279900B8A2869C5A9EF92A960E558086
SHA-512:	347848B90101227631C7140121506BE6E82683F2D60DED4D1EE52629ABFF8CF78D0D92F94BC1CC4DFFDF1B22DEAF4F20FD673D1B24AF61C9562E03383B878D90
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	0.5915415183103097
Encrypted:	false
SSDEEP:	3:ClltUllP/lRlY6VXXHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/l3XXHXt:C/mlPs6QlE3HkuXXWNEjHOXGI4/l
MD5:	D6BFB4A609328BFEE4B44FD12E91F205
SHA1:	243F3FFA3F38BD0912F9B7B4A9455EBEE866456F
SHA-256:	8E5EF7E130574E12DB005D3EE2F40573ADEF65514AC6DDEE4DF6D5E658E829E3
SHA-512:	42CFBE1C7775D0E8DB77D6B0027170D84DEE8BD2910427E8DAE37948B939D983EE0AF9FA4C2A7F8A83CBC28A34DB6F4186D48063E57932B093F65A1A7433276E
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_mid_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.0267057339023324
Encrypted:	false
SSDEEP:	12:CedlXp2MpppfZPpppppk+Ppp8cyppppppppm:jfMyZfQk
MD5:	AB7CE2A0FEACB8378C6BF45898AF29CF
SHA1:	6DFCB4622BC76C7196968EDC3AC2A621962C0E18
SHA-256:	BDC51AB0EB12FACE9EB67C3FF15F1AEC7E3289028F430C37F674BABE8C410692
SHA-512:	CE92E8D4028B1C4DF7F86A7A0E8A337417271EAA5D290D75A9C5392A87EA7D502795E72F1852770BABFDCADB6E7197843789141D51C018C2F629009C9A23057B
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	3.104878109579758
Encrypted:	false
SSDEEP:	12:sV3didididididididididididididididididiHbididididididididididid+:+WorjrN9+WVVo2/VQ5bJMd
MD5:	1001F157E3309F0E33E7F8F3677E514E
SHA1:	713AF48CFDADAE7B39D22630292D6D73D24CE650
SHA-256:	E73A52635071ABB400B5BAF30B28A2C287C855183B9F8D3102208B4AE826610D
SHA-512:	7E808F8D5591D755BB85220D002D7B50DB6E06A8AB2FD0E0D1D366AE03C1BB7A5F47EC15655464018F9FDD43826CA31D00AD3E9D8E5169886B3842BA9A955AD7
Malicious:	false
Preview:	BM........6...(.......!..................................................................................................A...................................................................w...................................................................G...................................................................A...................................................................A...................................................................+...................................................................G...................................................................A...................................................................A...................................................................J............V.#.t..#.V.......................................D.......e.s..r..r..r..r..r..s..e..................................A....e.r..r..u..........H.r..r..e...............................g...s..r..r..r........r..r..r..s..........................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	1.6629111162336814
Encrypted:	false
SSDEEP:	6:M/Olc660j+93CvUAV8uc4Mf8WpfzMMfVfFMIvtGo2/L8Q9wV8RHHqvU2uJ2dsk/n:sV3FsUWVQ8W5LNFvtGp/L8QHH6UZfk/n
MD5:	8C1C9E4719C215DBC51CBCC17073CCBC
SHA1:	2185C803D8B2AF9829EC4DC7F5EBD7E0F350649A
SHA-256:	7EAF68A70E2907CE9690332EBAC629FA9F1F07356EE674607AB6C1D73A11E96F
SHA-512:	0C40CE77441A28A14B749FC30DC4BB9A135840523B2510854F9CFF37E882728078F1E4995A141C195CAD6B8AA6157F6A7EE1AEAE94E072F44CAC0F0E13D2DEE4
Malicious:	false
Preview:	BM........6...(.......!.................................................................................................................................................................................................................................................................................................................................................................................U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\btn_web_link_right_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	3.1781604284685496
Encrypted:	false
SSDEEP:	12:sV3kY4WmmN+OMCtljYYDnljxc7MJUI+xQ5OJmmY4K0QMbi:+l4Wm65MCtl0Gz7JeQ5OJmb4Bbi
MD5:	7935A7BF085B751CDCB3DEA3EF18DA0B
SHA1:	055326051394CEA13E676DB39BD971D4926D0B14
SHA-256:	72E533DA7EE05594432BC36F8BFA0FF8D466614F791FAD7331EA0A45AD8FC498
SHA-512:	A2D2E2474E9CBF70CE3D072307B89638A2A547A061D5C4F770605DDE720B66B46705647461D2EF01CEEE33943F69D7AE6C81936EF7AB99D595F541F583C6785B
Malicious:	false
Preview:	BM........6...(.......!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................du........................................................................................................................................................................................................................N...t....N..............................................[.s..r..r..r..r..r..s..[................................d.....[.r..r..u..........H.r..r..[..............................e....s..r..r..r........r..r..r..s..........................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\checkboxes.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 48 x 16 x 8, image size 768, cbSize 1846, bits offset 1078
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	3.4036315259400927
Encrypted:	false
SSDEEP:	24:UzOtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiXcijsQI0xVgMxFWx:qOta08t7E/gbN1pv6uPjsQIWVgeFWx
MD5:	0BFEBA3584311E9927A5E68435180C01
SHA1:	7BF61462441626B88BFD5936CCF9DE2E6DF6AA64
SHA-256:	7A1BBF8282930794CB23128CBB9FEC83A6DF2798BB7FA9D8984E70FC2B2354CB
SHA-512:	415A7CFFE7A6C94DFF4469722CF6A29E67B071E06E19735DA3BC8ED2CE519ECD6B4F5F0807AE23F2FA45DF0E00D1AF2CDE7693A399E5B317398BCB4E715435BE
Malicious:	false
Preview:	BM6.......6...(...0..................................................................................................""".))).UUU.MMM.BBB.999..\|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...___.www...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\custom_logo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 142 x 21 x 24, image size 8990, resolution 2834 x 2834 px/m, cbSize 9044, bits offset 54
Category:	dropped
Size (bytes):	9044
Entropy (8bit):	2.3235630161564798
Encrypted:	false
SSDEEP:	48:mR2kJzO8RW3bg+SjrXugfSyQfH6cMdimADByYeI85R/l+VBob:mX9PWC2wzQycMdimYkI85GVeb
MD5:	572C9E8C978E3D79225C17AD8DF23EDE
SHA1:	ABE53B2774C1667F05DBE1DB1798223FF7095523
SHA-256:	D827C59274E5E4334607D42665750C85DC1861441B795234C37B44A44026A224
SHA-512:	E4AC60998DEE603BC48A433AF41DB32BA251C73BA0BD38A79980209536DC7D3F8F817CE510730A6707A6A103C218DBEDD145E3D48DDC5B28EA3763B71F27BDFD
Malicious:	false
Preview:	BMT#......6...(....................#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0188970795941468
Encrypted:	false
SSDEEP:	12:lEKrVKkQE3lTPiLauGCxLayITjOhP3gWn:mYVK7E3ljiLZPL5ITSh1
MD5:	2CA10AFA11F3E00918951B8B77A8B29E
SHA1:	536F0CDB2CA9AFADCFEFB189946AE16E9A5C02A6
SHA-256:	80B7D2F4DD4D173B0DE3C89F256D453D7CD0FE4EF68A9D3873C18B1D3C7D127C
SHA-512:	951FA9830FA6DEE6AEE87E4673F3FCBB004BF2A4D25776B3FEC155E747E1BF63F10256069B1E0716599932DFF41B3B159A0D61F5F66DABCB4B0953A76E18F622
Malicious:	false
Preview:	BM........6...(...................v..................................................................................333...333...333...333...333...333...333...333...333..................................................................333..........................................333................................333.................................333.....................333...................333....................................................................333.....................333.....................333.................................333.................................333.....................www\\\..................333.......................................\\\...........................333...........................\\\...............333......................................AAA...........................333..................\\\333333www.............333....................................................................333.....................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_hover.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	4.459613288102141
Encrypted:	false
SSDEEP:	12:lEKr80Iz+iRpjmRa/gOy7DrsRzYwGM7P6LeHeKb67I2GUrwUEiRwexgTyqaaL/lV:mYdjiDHYOMXes+juYylw8rOTjR58lc/
MD5:	985622AFD8BEEE8A30430EAE029084D9
SHA1:	7169C3A143CA087418231B13CECB09E3933AF0B3
SHA-256:	A36D6D62F141D354C5E712D6F7888EFC9F60C16EAA66E6C22E0B3F5BC7C47C2C
SHA-512:	7E7C6C1C9EB09C7F7D9F7663FEDCC22B49088F25E30B8A30CD61EDB554913B849EB751DFC10A263462EF2E5CF2FE45BF34ECE824DDE9A5DC4A0B809CDB9806CB
Malicious:	false
Preview:	BM........6...(...................v........................................................................................................y..............................................................................;vj...............................................................................r...........................9.........................r................................................................................................................r...........................e...........................r................................{......................Q.0...................{...................................a.0.......................................................0.q.........................................a.........{..q..........................................0.r..r..Q............................................................................. .........................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_normal.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.1310887508565135
Encrypted:	false
SSDEEP:	12:lEKrta3KkQQ3ZTYMRaNGKhRay2sVOtz3g8FaKn:mYtiK7Q3Z8MRarR52skt55
MD5:	E4968ABD99D1E2D60A9273BFC2A6ED2A
SHA1:	F8437202EF4E216A672A3D31E52489D176FBB96E
SHA-256:	8900BF402C58807A6E6F1622FAFFEBF05CFD2E93AE06E44D4F1ADA4EEC0B7F0C
SHA-512:	55303F4ACA890473A2926E503D6DA9A0D9024414F94677C7DEBD2522BACEA6BA380A4AC857AE1112E7A1C0742C612481568E9DE4B19BFF49D278420795D3269B
Malicious:	false
Preview:	BM........6...(...................v.............................................................................. .......................................................................................................................................................................................................333.........................................................333..................................................................................................................333.......................................................333.........................................................www\\\............................................................\\\.........................................................\\\......................................................AAA................................................\\\333333www............................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\help_btn_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	4.411017190668682
Encrypted:	false
SSDEEP:	12:lEKrZPkn8/ZXw90Me2wgUXwel78rrOI/HYYZ5rQD8ze2wgMoel+t1ifTu7p:mYZPJBgCfVLg6lI/HYYZKVj4jp
MD5:	98A14AAC3586CAD76E0B6F37C6FA9A61
SHA1:	6B89568BACBACF10653621ABF576E01E79F211EC
SHA-256:	C3BC38019099D32FFA094CA7FF716C36FFE1AFBA4D972293F4BB509830686855
SHA-512:	1F6891431692A4BF0D19125AFE2E8670B6A41A15BB8AB627E62268D01D0BDD5367B1E1E3116AE536F048C7133128AFCFC386C82914B9524250F8C4FD6713E583
Malicious:	false
Preview:	BM........6...(...................v............................................................................9b/......................o.f.o........................................s................s..............................s..........................s........................s...............r..z.............t...................s.................r..z...............q......................................................................................r...............................s....................r......................s..........i......................D.)..................i..........s.........................R.)...............s.....................................)._.....................................R........z.._.........................s..............).r..r..D...........q...................s..................................s........................u..........................u.

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.871186763385942
Encrypted:	false
SSDEEP:	24:yGtlGYvKB/+VXRd1NV68fI/N08xNh96Ikd8uEesmBoEekTc7Pnl31BtV:B6PBWVXr18NhsIkNZBoEhuPXbV
MD5:	6D58D2DC750C651A90131C77DDEBE932
SHA1:	F0D04B5B8BF4297F14B4EE86C234198884C7188C
SHA-256:	0398A3659EC6FCC6E110A776587DB7160200BED44C15EDE20C414E01F0545EE0
SHA-512:	DD159DB334B1D699F0109BEDE101AF9E619796A036B0865267D547C49D7B9F5168533A87DDFFB269859E7246721A5AB502DDA27CE1DB3D065F19DE618BB9F963
Malicious:	false
Preview:	BM........6...(...................n.......................................................................................................................................................................... ..........................W.Q<.,0.)......#..B..~..........................g.....................2.....0.5=.HI..5.w...............~....................................V.U...;.DH.UF.UF.VG.SL.9..................>..............................Q.P..&G.TG.WF.WF.WF.XF.[N.AA.\..................7........................z.z..%H.VF.WF.WG.XH.YB.T7.K1.G?. #....................a.....................#.+B.RF.WG.XH.YH.Y1.B=.Zj.y.m.@.=....................................f.j*.8H.XF.XH.YG.X..Ak.......}....[...................?...............6.BA.RF.XG.XI.Z/.@r.....z-.^..[..]......K................................(.8G.XG.XG.X>.NJ.h....{..r........o..\|.................................(.9G.XG.XG.Y/.>...{.y............w...h[.................x...........'.:G.XG.YK.L%.V.....U.....

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_cr_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.192154208054499
Encrypted:	false
SSDEEP:	24:yGGaVMUOnkNivxZgeUQtQc4TsGDFmtsv063CuGG4incBJAWABTBndIX:BSkG4QtQVrDFmtsv0PrGZcIWEU
MD5:	9202BD204077773A9A03521232FFDCB5
SHA1:	32C8AD8E8EF7BFE44671F677B75DE079A63F4542
SHA-256:	92C608FBE7CC340F589B348576122B91D47506A772F8F5FCF05A0B1E9B154002
SHA-512:	54A7210E83805EC43441D6CA117243E4D1C7758401BB223DAA77A0D6A277958128AC231ECA12DC6F4CAFAAA57360D3F250580EDE6BAEA36E32EF2614B714B900
Malicious:	false
Preview:	BM........6...(...................n..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................?....................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.913965669437315
Encrypted:	false
SSDEEP:	48:BUdjFuXO2D5tgJiqvLu7d4FsGLVmklINq:BIEXtD5tgJ5vYd7GLVmkl4q
MD5:	59AB9B0CC79344B8EF847055ABF8A33E
SHA1:	A5F8AFB081FB52765227DFA99F7A2C0B77157574
SHA-256:	DA8B0866C04DF4BC77C5E7A1F20197CFE97A036C1743A2A3415FCCB7FC0DC723
SHA-512:	59DBCFA288A7D36E4BBAD5DFBC4D8A9E4CE48F1987AB404F33EAF68D20C29721CB068CFEEB22D26A959D3080E629B447EA7E57BB69B6F4F3D2C937DD0D482FB8
Malicious:	false
Preview:	BM........6...(...................n.................................................................................................................................z.............................................................GQ..............%..1..K..j.\.......................................................2..I..V..Z..\..]..W..1..5...................................CH...q.......M..\.._.._..`.._..`..m.....`..n............................8A...i....=..T..Z..^..`..f..l..f..R..^..l.....~..}......................z....w....D..Y..^..g..z..{..b..V..a..x........{..}..R..g...........................4..]..d..o....0f.X>Nu .;.......4.Q...........w...vlq.......?......Zj.......V..h..m..t..H.+.DM......)..!.a..y..P95..........d.%N...............-.....L..c..a..^..H..)..T..a..K.Q2L.A..G.n .\..!x...........w..................7.._..^..>..C..\..\|.<\|.-w..y....a..J.o-.n..EZd...!......\|..............!..D..^..Q.....2.#p.vL.`.._..kY.....E.K.p3.z/.h.9..2.. .....d............./..E..V..].......h85.\..o..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ff_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.519754196022519
Encrypted:	false
SSDEEP:	24:yGdG5egXurW8qy2706KBBZPzye3NWyJGL2yyi8xhoz6z8V:BE5eSurW1C53NdrbJXozRV
MD5:	CB6E30F86372C7F1940D393A0591F74A
SHA1:	1E44A8BB204BEDC89545A91BB42F0792689EC288
SHA-256:	C94CFF7804F0FAF334F1DCDB5079FCBAC6AE99A12DABA06F84B329E7C0237D3C
SHA-512:	BA666AB3092C9F86E0EB147B11C0AAAAB5C173ABCF42AAE78CAD284669D591BFE9FE026C98F65DFAFBE0555F2C8022FD652ED7D7B25632F2C0239E852DD04569
Malicious:	false
Preview:	BM........6...(...................n...............................................................................................................................................................................................................................................................................................................................2...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 26 x 25 x 24, image size 2002, resolution 2834 x 2834 px/m, cbSize 2056, bits offset 54
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.31914215766045
Encrypted:	false
SSDEEP:	48:wYQtLV3gaalDTWSwxKQfj2Sey2JeuREK3s/yPsUxVZX:DC0l/WrEQyjP9ZX
MD5:	C4B6AEF7DC48CA154C645553D46CA1B9
SHA1:	D7A443157E6D82732B9B14CA44F34A2954F61A48
SHA-256:	F1686C269F47E24B853296C5B60649F7BA6912E1B8A888C25691AA1AFCAB5651
SHA-512:	5581DB6507B11FF861D10971D4F84BFF07B9DB6387056015AD4EA3D875AABA9F4228C025D625A5BF13A1C895A2B29FCBA215DB8D0704B516CED81AB977480B0C
Malicious:	false
Preview:	BM........6...(..................................................................................................................... ......3..\.........................q.f.t............................... ......c..................s.2.#...,...+.'.%.A....................... ..........................I..e..j..m..m..j..d..W..:....8.................. ......................(.._..s....................r..f..U.!.y................ ...................5..a..r........{...............h..[.".w............. .............>..'.._..p.....t..........................k..X....O......... ...I..;........X..k.....v...........................w..i..X.B.o......... ..............(..f..x.....q................................................... .......#..'....j..].......}................................................... ......m.....m....h..............................{..t.i.^.F.c...... ........."...................................................w.._

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_browser_ie_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 26 x 25 x 24, image size 2002, resolution 2834 x 2834 px/m, cbSize 2056, bits offset 54
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.183495275377127
Encrypted:	false
SSDEEP:	24:wYybzGDDuyS1IJX3OSFrd+E8BPQc5bCLD14yEalWhUUjSxbM+t5SU:wYIz11IJXT1uQcFCZkCRh
MD5:	D5E2AC1A1FF513F1A535AF7E1F9A6732
SHA1:	40CBD65DD1DB73B9F4E3E272B6A49A21DA70F409
SHA-256:	97A5BF39F915AB9D5F7B17644EE8338D2D8EEE94FB49A424C1B71A6D9647782E
SHA-512:	4A2BE35F4C7708C38CAE32039DE450C89AE18F6D3A5EAF45532D21D348528ED8B2571D27D0862939D564A9BCC6CFCD35817ABDA2AF6A8BDF2D606127A4ED8D88
Malicious:	false
Preview:	BM........6...(....................................................................................................................................................................................................s.............................................................................i..............................................................................t............................................................................. ............................................................................. .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\ico_shel_check.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	3.0908868353926398
Encrypted:	false
SSDEEP:	24:K+2U8888888888888888888888888888888888888888888888888888s888888C:R7888888888888888888888888888882
MD5:	3E64FBDBBA71BCF30FFA52997E48DC70
SHA1:	62C8EAE2032F4D14029999047D91D97FE656A37E
SHA-256:	C6039CB9EEE68A5194997B667564DF434A57677CEB4FEF83FD8B459082F97AAD
SHA-512:	46E381C385E073303DA3857610A573B42D3A68538473B207D84F14D729B642E05EA7EC5249F08D6E6C6A082F49EE2E91388860F223EDC92287C5F75ED5543CFE
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................b............................;........}........................U..............}....................}....................b...........................U..U...........U.......................;......U...........U............;..............U...........U..........................U...........;..........................b.....}......................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_firewall.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.473185537263806
Encrypted:	false
SSDEEP:	192:eH+v8d88kh888Z8888L88888N888888j8888888Y888888888Q88888888G88888:eepGVPe
MD5:	0708018C81B6D2F22AC48F7D50B5B486
SHA1:	375D42619F82A01C8E550D153FA15D40B92A0F7E
SHA-256:	99F11865F16EDE20E7EBB383BFD6BD62C76A4249BF25B5B93D07CDBB82C83523
SHA-512:	C79FDC28CD123DBBF0032B226546023CA4C8055BEBDE93B14C25832FA111236722F09AD8C366411FCE852BB0C8E4FC1F8CA1A577C7D91BE6B34C012090CAAF6A
Malicious:	false
Preview:	BM........6...(...-...2..............................................................................................................................................................................................................................................................................................................................................................................5................................................................................................................................H...3....H......................................................................................................................0.0..>.....0.0..............................................................................................................j....>.1............J....j......................................................................................................O....E...................n....O..............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_log_viewer.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.1199255507557804
Encrypted:	false
SSDEEP:	192:en888888888888888888888uU8z88W888G8888N88888o88888888888888/O88Z:e1
MD5:	327B16CD52559922077D29D80117CA8A
SHA1:	DC3B272A33E50E1C0AACE7FEE042903EEADC8B1B
SHA-256:	F4D394C2E79912A9D6E7D9FC22359C75380368DCCF92B6725B7B698ABFBF7CD0
SHA-512:	D8766D49FBB2448BBD4EC0DDFC6F455ED244208C78A4FE1262AD2755A15015DD182A53E4B4386F35AF61DA720D9C390ECB1C2CF4ED7C775601690F95541AA90A
Malicious:	false
Preview:	BM........6...(...-...2..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.............................................................................................................5....=...............................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.9862845792107353
Encrypted:	false
SSDEEP:	96:sZr88A888888V8888888888a8888888888888f/8888888888888888a8888888H:sZr88A888888V8888888888a8888888L
MD5:	69B2861F911877DE07AD4D937E70B1AE
SHA1:	76E01A783322AC1441690246324849C18E6579EB
SHA-256:	C3A5583031305690E622AA87F5BBBB5E75DBE28482AA761122B21BDB08D547AB
SHA-512:	20E34D46CDFD2ADE0AE932B9CFAD5189394FF785F32114DBAF909F8F84D539ABA0CE72953FF8FC67AB4976ECF9FFCFEB7F630DE77345D2291554BF5902F8FBE4
Malicious:	false
Preview:	BM........6...(...$...)...........N.......................................................................E....E.............................................................................................@............@..................................................................................U....................U.......................................................................p............................p............................................................3...............................3...................................................@........................................@........................................U................................................U.............................p........................................................p..................3...............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_error.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.426621694845486
Encrypted:	false
SSDEEP:	24:KxR0fU66EHH666666rq66666666665P666666666666omfU6666666666666666x:KxafpbmfxPt/wgPGXtUqWpbS
MD5:	54B3C51C0BF333B29BE333B4FA096F43
SHA1:	C1891B7A9CBFF1804F557D9F96A5D3D17256D8BB
SHA-256:	CF5C838D5040F3B9743971D49964A08619A6A41E36DAB3FB222E580625A421E0
SHA-512:	D61F84AE7521586F77A7DD8EA9ABF1B6F9BBE12BBA92FEC93DF22FA9E330AC3D4672F79F2F1725BC3F16D79D98F3B99635D83018F24C891095155DB2C3534B51
Malicious:	false
Preview:	BM........6...(...$...)...........N...................................................................z...c..P..c.z............................................................................................._..P..P..P..P..P.._................................................................................../p..P..P..P..P..P..P..P..P..P./p......................................................................Q...P..P..P..P..P..P..P..P..P..P..P..P..P.Q...........................................................v...T..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..T.v..................................................._..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P.._......................................../p..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P./p............................Q...P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P.Q.................v...T..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_info.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	3.015665328654711
Encrypted:	false
SSDEEP:	96:sZr88A888888V8888888888a8888888888888f/8888888888888888a88888887:sZr88A888888V8888888888a8888888X
MD5:	F3BE0D0A228B3D18A222B9FFD6B7E552
SHA1:	AB5712FECD9FD0D082A3BFEF8648CDB50501F437
SHA-256:	9144CC19DED889CE43F80903BBAA593A8505E782A6D8D33EE0857C838FEF9E85
SHA-512:	0C3C9ED61C41C9E51362DC86514E493A05A1E7A76123EF7F31142A498562268FAF6211F8BEA542E3FCF2CA7A8DC44D8B9240C2FADA78FD909916F508548A4657
Malicious:	false
Preview:	BM........6...(...$...)...........N.......................................................................E....E.............................................................................................@............@..................................................................................U....................U.......................................................................p............................p............................................................3...............................3...................................................@........................................@........................................U................................................U.............................p........................................................p..................3...............................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_message_warning.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.856318470621809
Encrypted:	false
SSDEEP:	24:KxdCAcHkbHGehy+9FWJc10FvuaOa0UJMo1ywOoYh:KxdCAEMHGkj9FWJckvLtFJL1yloYh
MD5:	FDB1D9C618B8E7A6432F41BB09535312
SHA1:	99BC4E9759859CB838D6B6250438753CA2DEECBB
SHA-256:	FCD8E53276DD286A8F9AB5F503A709EFA1159F939827DB11E3FF534B8EA2163E
SHA-512:	30AAF1C2CB28BBB390C612BEE37B2501D7A60F29FB93AEE98C0AAD2F488DEDF0FE3F429981A0E5166F8B1A138443A8CF2FFF22B9FEE4E92C9FF754BBE65DF8BC
Malicious:	false
Preview:	BM........6...(...$...)...........N...................................................................z...........z................................................................................................................................................................................................../............................./.......................................................................Q.........................................Q...........................................................v.....................................................v......................................................................................................................................................../......................................................................./.............................Q...................................................................................Q.................v...........................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_on.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.3037271229406757
Encrypted:	false
SSDEEP:	12:4lU7S0C2NE8mV8mLNCQbzk88YK+lMJ9G8Dr4qaK:4lQITLVW+iJQ8DsqaK
MD5:	8FFDF37D683F209FD12346DC532A1015
SHA1:	66D30E1AAD005D1C54263FB2BCF01C878AD76C28
SHA-256:	7C06B94797C12DD4031FE299DB09DACD8E82A8190E8E4C333F7C1F824BF32C7B
SHA-512:	A0CD14C25568ADDF6C6CF5360B95169D7612FBC9710F78C4A5B06A1523BC3A3B0629DAC30D1ED51912AFD6D4FA8B7F0C3D52562FFDFA01A4030F4B1E45152034
Malicious:	false
Preview:	BM@.......6...(.............................................................................................m..G.................................g......g...........................g.....0........................._............=..................g.../..........J....l...............9.0...............0........................................0....................................^....?....................................A....E....................................6....D....................................I..A..........................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_product_tray.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 74 x 83 x 32, image size 24570, resolution 2834 x 2834 px/m, cbSize 24624, bits offset 54
Category:	dropped
Size (bytes):	24624
Entropy (8bit):	2.947000309927683
Encrypted:	false
SSDEEP:	96:FrZGRgEaL9WbsR9X1mxI4ztCWEI1zbDtReZkGopfop+5mu+ZQrgTLJ:9AjaxWbS9XAWQ1zveZHope+SMg3J
MD5:	D5B12EA13E2A819D17782AFAB568E1B5
SHA1:	49DF401CB9CDC2659FF7137F5E73CDC58B93B371
SHA-256:	E2E774909F599A0F45FBD0AADB53893663A873A2EC13C9822137280175C7D8D3
SHA-512:	6A4B80B9C6C7E064B29418A5AC940E983AECD83E5AE2AD6EE420412AC934FBB550B989E40E947268B1ED44FBD82345E7E0FD5BC6ACD820841C67ADF33A2C4475
Malicious:	false
Preview:	BM0`......6...(...J...S..... ......_............................................................................................................................................................y...E.........E...y...........................................................................................................................................................................................................................................................................i...........................i.............................................................................................................................................................................................................................................................1................................1......................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_quarantine.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.148425336469748
Encrypted:	false
SSDEEP:	192:e38888888888888888888888888888888888Y888F888F888F888F888w888+88/:es
MD5:	C1CD8163D7579661763FCE65FFF43664
SHA1:	4D890F9D02F080494B6AA60A8BFEFA422EDC618D
SHA-256:	B35499B253D7874AE14C5D8D7DEAA98AAD1E2E84FA0D504F91A2AA8B6681217D
SHA-512:	EB2B4DCB7F2F0C4889B779F31A8227118C58FDCB1B7B199638A656261571063613EC0732557537FA79FE73367A0F050942112354726EEBD7CE95839A600247F9
Malicious:	false
Preview:	BM........6...(...-...2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................................................................0......

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	1.5627219431921444
Encrypted:	false
SSDEEP:	24:+78XG31TgbTqooC9nqxlMDRCIOMId+XjrVuZv098aYCn7KtV8E6:+78XG31TgbuowU91K+TrV+ad+L87
MD5:	7B5B25C289CBA0977699F62C59C235FE
SHA1:	16B26F5B7E58D9124EEC0A08ACDAA500AC4344FD
SHA-256:	B5AC182504AB575A49004030AA45CCD9DA938E9E26C91578C81F3365CB2F8411
SHA-512:	881CDA5035552E9209C22E2982F60A20E748B12836525DF694A4EBCF617D3D94643B05F10C02CCD80E829B031E2E22A701317CDCFFA1631F06FC2F7B1F31D77E
Malicious:	false
Preview:	BM........6...(...-...2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.9824496363536044
Encrypted:	false
SSDEEP:	192:ez8aL888885888888888E888888888888l888888888888888D8888888888888M:ehpj
MD5:	BE9FF8D29525461F7719867D7C5C2BCC
SHA1:	AF50892BF0659EBD0A54E69E8B30F77717CB1471
SHA-256:	96F3CB26ACBE58E36FF67A83DB56B7249866CB1AEE90536672ACE24BFE20007C
SHA-512:	E3181D9A209229B92B6CADC9A744CCAAAF06F1D7706ED29C4771DB02D7958572D443B5ED1989DA4B745D50197B2AB8C47F0C15F6371EF5ABB9174AA356DFB097
Malicious:	false
Preview:	BM........6...(...-...2...............................................................................................................................................................................................................................;..........;.........................................................../.....................................................O..................O......................................................T...............................................l..........................l...........................................................................................2.............................2..................................................................................@......................................@.......................................................................V..............................................V............................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_scan_detect.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.0959539657113977
Encrypted:	false
SSDEEP:	24:+733O66KJ666666DUC6666666666zH666666666666sSuA6666666666666666T4:+73xICuF56nEfvnGHJwfw6u+PwR6
MD5:	D236AC433CCCF68BBEE08158087F1091
SHA1:	A24AAD0CDDCB0E902FF40435F4C4AEFF756361BB
SHA-256:	D4C419ED31473F5105BA8576C01E80BD4770FDE1B1A1AC7E3146255ECC8A16C4
SHA-512:	CC805BE6C6FD54ED193A55B5C45905C6F063EE6E10CCF03CF4201B83D8A067BC27886B1FE47930800901FD4B9D213C5AB28CEED2ABFB8CE4A39DB344D75AEEAC
Malicious:	false
Preview:	BM........6...(...-...2...................................................................................................................................................................................................................................j...`..P..`.j.........................................................................................................................X..P..P..P..P..P..X.............................................................................................................. f..P..P..P..P..P..P..P..P..P. f..................................................................................................=z..P..P..P..P..P..P..P..P..P..P..P..P..P.=z......................................................................................d...Q..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Q.d...............................................................................Z..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Z................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_setting.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.3589536312962265
Encrypted:	false
SSDEEP:	96:eDbqBy+s6iwB+AlIX3Xn8W86Y4/QKepUqQ:eXvGIX3Xn06wNpUN
MD5:	3AF977ACF7D3CD5A10719E7A03D97E26
SHA1:	74551E81BF663A6BDD3F7B477138236617CBDA8B
SHA-256:	E542DDCAFE43D1F0266645710831220985114AD07CCF15606A9B8D1F3CD13ADF
SHA-512:	EA75F476C5327B0F08D2E4294B1F7131196E0A58B7C553F74CA63680D8FE138081278AAFB6055A423098F544E414AC409A58663510C08F2AFA7346D08C41A2D2
Malicious:	false
Preview:	BM........6...(...-...2.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|.4./.3..h..........................H..9...4..\|..............................................................................[....;...........................................<....]..........................................................................z..............V..G...................5..{..............e..?............................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_stx_info.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 44 x 49 x 24, image size 6470, resolution 2834 x 2834 px/m, cbSize 6524, bits offset 54
Category:	dropped
Size (bytes):	6524
Entropy (8bit):	3.423184181999544
Encrypted:	false
SSDEEP:	192:sm8288888z888888888T8888888888889888888888888888s888888888888888:s0v0
MD5:	A6E501A32146E7855077957719607EE0
SHA1:	14D474B2A962030EF9255B800164B38A11B4A31B
SHA-256:	EB07EDC748A8041AC49676EC51B33AE97FF17CA7E8C68DE5C2517451FDB17F93
SHA-512:	ACD924934D2838597D1AEC1F70EB9387117B758DE937F584E8A54F6ED311462F2A8AF3C291FE56CB2442A3361CD5A28882AA5A4059364996C2E3D3FB7D77DAF1
Malicious:	false
Preview:	BM\|.......6...(...,...1...........F.................................................................................................................................................................................................................=..........=.............................................................................................................R..................R..................................................................................................p..........................p.......................................................................................4.............................4..............................................................................B......................................B...................................................................[..............................................[....................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_alert.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 27 x 24, image size 2054, resolution 2834 x 2834 px/m, cbSize 2108, bits offset 54
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	2.567045300078107
Encrypted:	false
SSDEEP:	24:x2EHaw/RnH666Lx666666+tG66666666Unx666666666666f66666v666666E66n:7HPyYZnm0LxHArkzlSS
MD5:	754BB7865438E4309A74D34873549D80
SHA1:	0F8C734567E7D3375FB0D7309DF838D2202DF8D9
SHA-256:	ECFFC5E8390B79BE8B3B048B8FD22DEB01C72AF7AFC6347313998FD929BCC229
SHA-512:	8E630BB1708288263266E1E94D4DA76E466F080AFE2ED755BA39EDDCA52472362D6019D61B0C4DE4EAEF41AD2A7999F33F8B511DB2BA3A0A42ABDF3B9498D3F5
Malicious:	false
Preview:	BM<.......6...(........................................................................m..P.m..............................................................5t..P..P..P..P..P.5t............................_.....................R...P..P..P..P..P..P..P..P..P.R.......................................n...S..P..P..P..P..P..P..P..P..P..P..P..S.n...............................Z..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Z....................!g..P..P..P..P..P..P..P..P.X.....W...P..P..P..P..P..P..P..P.!g.......S....P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P....U.\..P..P..P..P..P..P..P..P..P..P.G.....F...P..P..P..P..P..P..P..P..P..P..\...P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P...P..P..P..P..P..P..P..P..P..P..P.P.....J...P..P..P..P..P..P..P..P..P..P..P.1.P..P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P..P...P..P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P..P.P.P..P..P..P..P..P..P..P..P..P..P..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\icon_tray_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 27 x 32, image size 2702, resolution 2834 x 2834 px/m, cbSize 2756, bits offset 54
Category:	dropped
Size (bytes):	2756
Entropy (8bit):	3.363973142154021
Encrypted:	false
SSDEEP:	24:32i4+WS5OI4jyx6v6WoRl6sRyS1F18yd+G:P1W0OXGgloRl6sRyS177YG
MD5:	6FA89D31C61E0B4DF2EA623B96C1EE71
SHA1:	2548A98C4A2FDAD3978EBCFA77A0059D6CF04639
SHA-256:	251443477C2D8FC8BAC0BCE3E535DB71DB60FEC94E409380854B699405A38136
SHA-512:	6AF6627918D228CE2254032D3A3BE0ECC7E8CC7BB43218C25F2CE44C976FE0FDD621F92900836B3CA2281E44E5A417D027CC4C722B542BB6D52BB45C036F04B5
Malicious:	false
Preview:	BM........6...(............. ......................................................................P......P..................................................................................Y..................Y...................................................................q..............................q.....................................................2...................................2.........................................:................................................:.........................I............................................................I......................................................................................<...........................Q..........0....................................<...........................W.................3.........................................................[...............

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_listctrl_header.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 12 x 24, image size 48, resolution 3780 x 3780 px/m, cbSize 102, bits offset 54
Category:	dropped
Size (bytes):	102
Entropy (8bit):	2.8539791128607273
Encrypted:	false
SSDEEP:	3:uAlhl0lHXLjOSSAGD00dn:BlzcIV00dn
MD5:	99A0A3B1134D6F1ED215AF08AB6D710C
SHA1:	75A53759806F0E66D531F031B0C7098ACCD647C8
SHA-256:	5190352B2E7EB8807A55D9247703C0AF96F11A97B3F5D70803826C5EDBF870FF
SHA-512:	130D76E845EBF429262A950B917C4AAA67DEBEE90A496B43CB0B6C72C60EE814D0A84CEBD91A70766654CCD87F19443F6BF1B4FDABDDEDADDB3DEAF73F828054
Malicious:	false
Preview:	BMf.......6...(...................0...................ZZZ.........................................ZZZ.

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\img_popup_titlebar.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 22 x 24, image size 354, resolution 2834 x 2834 px/m, cbSize 408, bits offset 54
Category:	dropped
Size (bytes):	408
Entropy (8bit):	3.3017416286152836
Encrypted:	false
SSDEEP:	6:gl/ilfUto6HhDUHLdTEESllReQb8bIIIIIIII/:g2UtxBDMSDb8T
MD5:	D921D94B20F4A55855927CBCFE05BBE4
SHA1:	8E536AF43ED7F3CF3BB7DBE1DD65404E324693BD
SHA-256:	887DD7B7D0A41030C36A8EF304699C021F4819FD102DC3F2CABF54E01088B354
SHA-512:	AD66E5E0403C1832C02742BF44ECC8BFBD958E628AF8D9F5B2EE60028A3CA2A18358B0994202C011E323981D8A0B8DAB3AD52DC83CACFA3CED53521054194516
Malicious:	false
Preview:	BM........6...(...................b.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_safe.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1730, resolution 2834 x 2834 px/m, cbSize 1784, bits offset 54
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	2.6656149053485154
Encrypted:	false
SSDEEP:	6:/86T/4m/VU+WB4DMPvWB4viLDWB4vWB4uJT4WB4SP4WB40Jve6PVu9tE/:/1TZ/kPvGvvv654uP4x6PVCtE
MD5:	593C9D49415B36127FD3D12B2D9A30CF
SHA1:	DA9DAF645C1E719C84B241648BEF67EF32434616
SHA-256:	81AAFFB9F30CB34D7DBCA9CD60523C4860F6D9CB49E191E275C7A6CC9724F1C6
SHA-512:	C3BF356CAD9005074D0298835CB9E24776E450A308E05354151D6353242306C288C0DF36254C3C9AEDB2E19FBC4D62676FDC26AA671BDADE47BCCDB2B734D0F1
Malicious:	false
Preview:	BM........6...(.........................................Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..d-.o..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z<.y......<.y..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..ZZ...............d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z......................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..d.............................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z<.y.................di...............d..Z..Z..Z..Z..Z..Z..Z..Z..Z..ZZ..................Z..Z..Z................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..d.........i...Z..Z..Z..Z..Z.................d..Z..Z..Z..Z..Z..Z..Z..Z.

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\scan_ico_warning.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1730, resolution 2834 x 2834 px/m, cbSize 1784, bits offset 54
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	1.6978398005855406
Encrypted:	false
SSDEEP:	3:GvDllOlhlY6y0WxLW8f0SaaaaNtj0vW2Wejoz8RPeP8RPeO7aUl04aUl04aUl04D:/868fLmW2WejloEoOexxxNjs
MD5:	BBF8ABB3D8668E321485C5726EFF0AAB
SHA1:	ED0D96085A0DD20B7C749061BC3A2C0D1239647E
SHA-256:	E33E9A9E5C8EE616F4FE3C9899A7EFB26239711CBC2D69BA218FF9E89721CF55
SHA-512:	9A5AC6947A3455A6D50C90978B40B2FB577F52AC496F822D47E3805514C640EBEA03F6E37B4F0238A54D5D2086210B8C965C49BCF6369AA30BC689F4DE349425
Malicious:	false
Preview:	BM........6...(.............................................................................................................................................................................................................................................................................................................................................................................................................................................ss.......ss.......................................................................................................................................ss.ss........................................................................................................................................DD.......DD.............................................................DD.......DD.............................................................TT.......TT................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 28 x 24, image size 898, resolution 2834 x 2834 px/m, cbSize 952, bits offset 54
Category:	dropped
Size (bytes):	952
Entropy (8bit):	1.0784336760196316
Encrypted:	false
SSDEEP:	12:D8f22U8888888dXaEaRVVokZL2l7QvRVoCaJRVVM5YT:L2U8888888dT3kewAzqE
MD5:	C5130DA68CA6B2E12304A979E09DA751
SHA1:	10A97010FF7615553A5FE243B61E7EF341AACB3D
SHA-256:	AFD19CA20266AF5FBF98CBFFA66BB4D054E633002E11878BB86D50DE46CFBD63
SHA-512:	E4B10AADB881D70E3445E01F572B0102344C797AD5B4C92F932B1D23B7329A443AFBC93C2B12506A118ABF6DC938F50D99BBBE8983B6A7CA1EBDF8DA7B98C7DC
Malicious:	false
Preview:	BM........6...(............................................................................................n..............................X*...............................................................................................<...............................O..............................,J...............................................................................................0...............................P..............................E................................R...............................................................................................................................e...............................>...............................................................................................................................................................................................l..............................................................rs..................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_bg.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	1.1015848871604925
Encrypted:	false
SSDEEP:	3:illl/Pl/h+lFlxlY62Q/88888888888888888gXXXXXXXXXXXXXXXXXXXXXXXXX3:i/glfM62U88888888888888888gXagl
MD5:	EBDD73B25F0F819A1A91BAA1A4BC65B5
SHA1:	22F25AFFBAF50F3525E36198C160CF6005E04932
SHA-256:	6E8C06BA2F71473B6DF7F1BB2408BE9654DECF45F0E057CE1D9EB396EBE0E812
SHA-512:	3F43B03B2687345182AA3840F0B6AD7A1B3A315682F5D3CB0CE7D96253EA3B1F205CFA6F4520081B0E2C98F9D647D6AB02789AC54F9FCEA622C529E5EA120A59
Malicious:	false
Preview:	BM........6...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_normal_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 28 x 24, image size 114, resolution 2834 x 2834 px/m, cbSize 168, bits offset 54
Category:	dropped
Size (bytes):	168
Entropy (8bit):	2.1415728713599056
Encrypted:	false
SSDEEP:	3:wltSlxlslFlEl362l3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3d35Dlj3Q3xSe:QQljslfEt624BL/
MD5:	58AEC9446493E696D752408A2D55DD12
SHA1:	FB82079A3A7B86CCB4ADF8CFA8E0959DB40504E7
SHA-256:	6BCA57B6BF3D9FB74560BDEED11C50ABD3440A97DE322B076B67DB333364F6AB
SHA-512:	AE1A43EFC68D9FE3C41F02DB4ECEF253A8560139EB66847DED60F6DCB56E80BB6637AB1F74724B3BDAE8A7AA0AC089C72300FB699A21C460D95221699528A637
Malicious:	false
Preview:	BM........6...(...................r.................................................................................................~..................s...~..........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_bg.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	2.4677390617579165
Encrypted:	false
SSDEEP:	12:iIfF2U88888888888888888QidididididididididididididididididididiZ:F2U88888888888888888G
MD5:	0BECD73EB7B9BC3A87A7DF8A037B8343
SHA1:	8FCD4002804744CBC3FAD020BBDEE37F935C6C96
SHA-256:	C6B927CC0C8786DAB77406A4F5DFB80E6A657C16E855D9C5D926C95BA255D771
SHA-512:	08FD22552F7D4ECF0B3B0078B20766A05C78E8B6BDA7BB5FE95EA77041D8461A434A922FECF8B3F8338976B68705965B4F990047F319FD309629AADA826CA443
Malicious:	false
Preview:	BM........6...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_over_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 28 x 24, image size 114, resolution 2834 x 2834 px/m, cbSize 168, bits offset 54
Category:	dropped
Size (bytes):	168
Entropy (8bit):	2.8491454163247076
Encrypted:	false
SSDEEP:	3:wltSlxlslFlEl362Z9VfVfVfVfVfVfVfVfVfVfVfVfVfVfVfVfVfRt7Fl9Vfypae:QQljslfEt62IZ/
MD5:	71249226E88A1507D75F5DB49042E4F3
SHA1:	CD85CCCC8F5610E6A5EEB35B8377EF1607EF32E2
SHA-256:	9E56DA108ECB375DB4AFA639DD5922E8026FDC503E5FE34E552AE52C1DC464FB
SHA-512:	24FB2A3516E393E79326F9664855ACD0D2BF1CA2617F5A174EC3DEE8C6071965E1053FEBE16D6E6DA14BB9BFCC00E720D0D48A5A2888EC0012A43AAC1B1ED144
Malicious:	false
Preview:	BM........6...(...................r.................................................................................................~...................s...~..........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.7980352477030295
Encrypted:	false
SSDEEP:	48:FmBBBBBBBBBBBBBBBBBBBBBBBBBBw88888888888888888W:F588888888888888888W
MD5:	29ABEDFE5169B1A9E46E5E7167D0C776
SHA1:	8A4A853D4059B90859A36445CBDE90BA7744A395
SHA-256:	EFCF81C614FC9C6CA6307C05B1A4AA7F34CF8FA2C9A3B0FD59FC5F2D05B78EB7
SHA-512:	8BFB3F572D4DFDC167263AD8FB275739C50373CCFA53A475CDD68429D0B84A97BC390374251D4FDA9D002234F9AD71E56C215F5D3348D7E2C35F54D83DE529EC
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.5367394076291824
Encrypted:	false
SSDEEP:	3:illl/Pl/h+lFlxlY6XR6w88888888888888888Sl:i/glfM6B6w88888888888888888Sl
MD5:	17B9FEE7091D778279C27DBC503BB695
SHA1:	50AF5F25911D3F481A224D8B1E677892C7A3D2B3
SHA-256:	B1F18E3A3DF55967832E51D52D1FB7981E5681813E0C93EA9758F2EDE2EDF2F4
SHA-512:	10F45D4BEBEA3A92F461D2F01DEB2C8FFD938465AB7C0F5CCDDB3712AC86E88684C9241B709FDD0C8684AC89A844CF8CA77AF7A31425C8557716C09968FF57CE
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_sel_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.7980352477030295
Encrypted:	false
SSDEEP:	48:FrBBBBBBBBBBBBBBBBBBBBBBBBBBw888888888888888888W:Fc888888888888888888W
MD5:	0B5D2F38A99E85A1FCA16BE731C8F335
SHA1:	9C3981D4633FC6A1A377D6E531F42196997E490C
SHA-256:	BDD44ED295A1377CE3CA717212022D22A9343F2D1CA7FD3BBABCA44C3AC93EE9
SHA-512:	287EC282E429DDC2F00960DDCC864B153273A1ABD3CF131373E4D34EF45930432BE7B2F681E0FD7D04940D36D8A3E72763C9D3657339C1DC4F01C42B8FE3E8C1
Malicious:	false
Preview:	BM........6...(..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	0.995503138083669
Encrypted:	false
SSDEEP:	6:2Ul/C0e/6BsIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIINFFFT:28a0eifFFFT
MD5:	112B3D853BAEC9DCD7A5FD9708925F5B
SHA1:	17FF03B7881FAC1DBC3EB8DC6AA6258C243D356A
SHA-256:	DE83C89F151CAC8D1C3157AD3AD68CA6964C4456BAF3DCE51EC13328B3183E6F
SHA-512:	117272E8D2E2E230BA70EB1835B5128ECFED3F5A3668A8A4D22E71924F8C79204EBD6F7039F92D2827BB1FF800EA7ECA668B4F075D2FB1C0E81D3F6BDA5F92A1
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|..\|..\|..\|..\|...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_selected_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.7507102405026216
Encrypted:	false
SSDEEP:	6:2Ul/C0e/6BV8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8Wp:28a0eitFFT
MD5:	FBAD9DC94C04C38EF746E6B08B395FA0
SHA1:	860C527A746C02931F19586996F64FB6CC7DCD05
SHA-256:	B8527A97FACCF182CE6744FBC67952DC2A8A8BFD318787CD925DFE499AD5AEC8
SHA-512:	D79B674A041741D776DD7CD4276E8F63206048E169EBDF36B13843E02D2528725B099068E9C3759FF624C530AE20FC1996F68825A3869A8ECF79F7CCAF1D7E30
Malicious:	false
Preview:	BMh.......6...(.......#...........2.................................\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...\|..\|..\|..\|..\|...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.1438885235805132
Encrypted:	false
SSDEEP:	3:2tlEl/Cc/ldc/36QKFFFbFVVVVVVVVVVlVVVV/VVVVVVVVVlVVVV/VVVVVVVVVlz:2Ul/C0e/6fFFFECfFFFT
MD5:	A808E2A49AD21C93B33A335D9EC20D0F
SHA1:	367558A96E8BE6A960AD7FC8A5606232834CF750
SHA-256:	D9A9406E8872E6D685A50451B838EA4BD7A0B65AE89D0F88129A550DC98223EB
SHA-512:	902D9A4FD76F2E5152CAD76CB2A477CB867337CF2057A39F32C19EF038C99BAE2A01DCEA5C42DFCD9BFA82F9AA8635670244CA5152237AE700ED96A0FE675AA6
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................\|..\|..\|..\|..\|...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|..\|..\|..\|..\|...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\tab_unselected_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.8148794356700846
Encrypted:	false
SSDEEP:	12:28a0eiNFFFlVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lH:2d1iFVV7VV7VV7VV7VV7VV7VV7VV7VVb
MD5:	0F90820E88DCFDFCB79E4FC075F69EC0
SHA1:	BDCD5B75AB8D3ABE7A8E1E6FD5012634A42EE5E1
SHA-256:	A82AB1FBCD255C1500968750E3CAC1325F23187F3D64C312271EFED928543A3D
SHA-512:	93150AB82E4B4DF8FC41979263518B8A997B4E79F023A68194D522D8A2F364B787CE479BCC6AEE4E938E3F920EABA7A50DB567DF20E82B919765C7F5D19494CA
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................\|..\|..\|..\|..\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|...\|..\|..\|..\|..\|...

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 142 x 11 x 24, image size 4710, resolution 2834 x 2834 px/m, cbSize 4764, bits offset 54
Category:	dropped
Size (bytes):	4764
Entropy (8bit):	3.521267431098461
Encrypted:	false
SSDEEP:	24:boGyuI/uFkLzaaQ3Q9v101xo6MeafS8XFEvuM2P77xQt:s3uFkHaLiv1yxo6MPag+uVBw
MD5:	FEE2FE80EF2A157AF94C3FCA2E9F8AFC
SHA1:	062F4ABB886555CDCBE7A23CE91D205983839330
SHA-256:	224B00A9E7BCFB9AC00DFB2D0B7389FAFA12EDBB097905147BD48657A5E0800B
SHA-512:	62A4023CF71D6D954669B88DB6799A80DDD4BC70E5EF69E0932BAEAE02A45841520CA29FC6D0B36610956477E43022941E133C75E82387C1DED563D41982A893
Malicious:	false
Preview:	BM........6...(...................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................r....333...............EEEKKK...333.........WWW???...333ooo.........333......www444333333......AAA333333333UUU......aaa333333333<<<.....................III333III............III]]]}}}333......333]]]............III333nnn..................]]]333.........]]]333............III333...nnn]]]...333]]]......]]]333...nnn333333}}}......nnn333...nnn]]].........]]]333III......]]]333......333]]].........]]]333nnn......]]]333.........333]]]\....555kkk............333......333.........WWW???...333ooo.........333.....333hhh.........

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\title_logo_about.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 251 x 16 x 24, image size 12098, resolution 2834 x 2834 px/m, cbSize 12152, bits offset 54
Category:	dropped
Size (bytes):	12152
Entropy (8bit):	3.4699014505496284
Encrypted:	false
SSDEEP:	192:WF5ijgwx9R0WFCfNSBNapeWUsnPt1UB+RKEfZ:WF8drcl0ZWx11US
MD5:	42FE02A9E320890CF9A9CD0BEBC16EE4
SHA1:	4A9ADB6744E1B4A3116E957E7318935A8C9322B8
SHA-256:	685D316A58B90C72F759E3DA0220B01650C15226B56066B1B388D4E9592AE7A1
SHA-512:	2F632F22F8430E4779EE2239FCB7719433A9BE2C86DBF6B84C719857CBAF284577CD9D52D610D1393CF1DFBFE44D7599F419E496E71F2BFDEDF6AB5EA9D6EA9B
Malicious:	false
Preview:	BMx/......6...(...................B/.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................oN.jH..b........................jH.jH....d.jH..c..............y.jH.mM.......jH.jH...............jH.jH...............~a.mM.jH.jH.jH.........\|^.O(.H..H..P).}`...............~.\8.H..H..

C:\Program Files\AhnLab\Safe Transaction\Resource\default\image\warning_icon.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 47 x 40 x 24, image size 5762, resolution 2834 x 2834 px/m, cbSize 5816, bits offset 54
Category:	dropped
Size (bytes):	5816
Entropy (8bit):	1.698865887106523
Encrypted:	false
SSDEEP:	24:jqtsX22222222222222222222q2222222222222222222222wM22222222Pw222C:etspF4W6/RVTNXJ+get
MD5:	90DC3A9FD17DD7D229BB310FC3414293
SHA1:	0171E007FB42391702539EEB3CB4F8D734BCE8E0
SHA-256:	C83A0EF50D9C2237319BC34F6126579278B3E7691CC9B6C0CC5AAAD3EECCC3FB
SHA-512:	894B43E5C506F58D378F19395333E1CE247748C7D80A94B94384C21163F6DAFFC701FD25B16A9186632AC802A2B3A017793A55F696CF8D080831F11563859C61
Malicious:	false
Preview:	BM........6...(.../...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\Resource\default\table\V3ISStr.atb

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	92016
Entropy (8bit):	4.915160193368408
Encrypted:	false
SSDEEP:	1536:cyaWV4GJ7Ebwur9LMJlUyBQi9j3jDalTy3Z83xQq36AxHtRzvQqk4imAzMeiU1:oWWSOtHtRzT/0MeiU1
MD5:	68299F91C732426142AFA455ABF1CFE7
SHA1:	FB57073B5D1D4750EFC29FDCF2DC85CE78878FAB
SHA-256:	74F1E800CE9DA1E1D56016565AF17AF0BCBD18DC5388C73CCBAB764E891F6F08
SHA-512:	4910278AC47874FDB6CFD80806EF2CA844A41383CC6764555A155DC1D177D72092F50E2E146EC287E18CEE810AA465BE866DA083568D18D8F39C21F73D3CE49A
Malicious:	false
Preview:	1C7344A8-924A-4981-A212-69091163CB30_RESV10.....9s#...i..../..>...H.........................................................ko_kr....................... ...AhnLab Safe Transaction.............................................................................................................................................................................................................................................0.......0...~.............................................F...~.......l.......^...........\|...........2...l..............`...................$...J...t...................:...Z................... ...b...........6 ... ...!..^!..4"..^"..."..."...#..~#...#...$...$..P%...%...%...%..:&..~&...&..2'...'...'...(..@(..`(...(...(..R)...)............+..j,...-......N...t...............F/..v/.../...0..J0...0...0...1..1..P1...1...2..83..`3...3...3...4...5..P5...5...5...6..~6...6..<7...7...7..$8..`8...8...9..X9...9...9..":..f:...:...:..2;..f;...;...;...<..=..x=...=...>..D>...>...>...?..

C:\Program Files\AhnLab\Safe Transaction\Resource\en_us\table\V3ISStr.atb

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	120204
Entropy (8bit):	3.8017798349445084
Encrypted:	false
SSDEEP:	1536:U+ftrCxjZtfn9jU9h+VY2V4vp+A0bAsqCeLXIAme8wb:UCrwPj6b
MD5:	40016985276293F6D84939788542A175
SHA1:	8FE83A2A9210E3B49BE0705C7B74E0ADFFF3AB64
SHA-256:	549142F68D8324B4D8D75B1A4BD762460ED58EB474573ADC65BB137D396B2D49
SHA-512:	BB53102A67F7703B36269B73E7AF57FD46F982FEB143BFA9DCD7378948E24095412C3917D200E196B352616FA30A6662AC4CCAB0D7A3863BC1B3115ACAEDF415
Malicious:	false
Preview:	1C7344A8-924A-4981-A212-69091163CB30_RESV10.......tJ.Qj..q..yW.............................................................en_us....................... ...AhnLab Safe Transaction.............................................................................................................................................................................................................................................0...2.......V...........P...................8...........T...........>...^...............T...........B............ ..Z ... ... ...!..0!..\!...!...!...!..."..L"..\|"..."..."..."...#..H#..\|#...#...#...#..\$...$...$..L%...%...&..t&..r'...'...'..8(...(..F).....<+...,...,...-..>-...-...-..D...........h/.../.../...0..R0...0..81...1..\2..j3...4...4..25...7...9..l:...:...:...;..J;..~;...;...<..F<...<..X=..F>...>...>...>...?...?...@..\A...A...A.. B..HC...C...C...D..BD..\|D...E..`E...F...F...F..6G..xG...G..6H..~H...H..8I..zI...I..dJ...J...K..<K..vK...L..M...M...N...N...N...O..tO...O...P..

C:\Program Files\AhnLab\Safe Transaction\SCTX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2078736
Entropy (8bit):	6.331672076007469
Encrypted:	false
SSDEEP:	24576:S4gMSMr6fXfdYS1GGiFpwGMvpWBinyEH5H+xXfVco6Uz+657oGSS81:TSl8AGiO2yEZexXfqRUCw7oGw
MD5:	56D6A30EB2B620A8D6A56B5875521C65
SHA1:	0D23D4A4B8682291986E026BDB3C1775FC0CD597
SHA-256:	7A6E934C3E2E6A2854168324F279716B5CCC5953B96315BC2E4B3BBAA6331612
SHA-512:	ED0F9BFFAEDF8447CB7F4BCAEB4DB4168EE5F2BEDAC33F355065AAF2FE609887BA6ED9AB9D36877E0E68A57655D3D19171CD03F36264E464618AC3B94B963C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l.sMl.sMl.sMK+.Mm.sMe..Mn.sM..Mm.sMe..Mn.sMK+.Mm.sMK+.Mc.sMl.rM..sMe..M..sMe..MM.sMe..MA.sMr..Mm.sMe..Mm.sMRichl.sM........PE..d...BN.b.........."............................@.............................` ...........@..............................................................G......,........*.... ..;..p................................................................................text............................... ..`.rdata..jE.......F..................@..@.data....t...@......."..............@....pdata..,...........................@..@.rsrc....G.......H..................@..@.reloc...M.... ..N...@..............@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\aspinfo.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	3.9811091355771175
Encrypted:	false
SSDEEP:	3:tXTLa2QwTfmVfLgSnTnRkdC1rW3UgyqhiEKmEdnMMPd3dhlhVUriaVmQUUn:pLRQwWMU/1rrgyqkEx6MMPdzlDGPU+
MD5:	EC34BE29301BA36F43F21ECCECCFE07F
SHA1:	12EA26CB9F1D974444BEB9D96FC806BB1DB364DA
SHA-256:	715285B4292DBFC6DE044A49CBE23B6218487AA627B5D2A9A2ECB474024A3233
SHA-512:	20FE2405D25C7193A5651DEF56C51202AFBD370EA6CE2EC6AEC6E61DF7833DFF7B44AD240B7C03D7E4B0E6319D2D81E47F96FC8C324446F63BC9058D558CCF98
Malicious:	false
Preview:	9905B3668E9BA61097F52338A6F05C0965C08A2AF012AE7BB6D553524902E0C647F2F2C34D6B37F98BF1D35342D2BCB01277C183048DBE474EA48167A8D70BC319BF0EC354E4270A8C80DEE8CA29D30C9D01E6DCD4C0154D3F9BA6E5DC6E011B

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	571920
Entropy (8bit):	6.671628577535569
Encrypted:	false
SSDEEP:	6144:Q75WD5X9srthVNv5Rb97JXJ+/6KXsDLsari6+hnKZcSjaERsMi5Y+kG/IPNqqDL1:80JMVjJXJ+/BmpfaE25zkpPwqn6miYrl
MD5:	C183D08777D542CFE28098867E0F2DDE
SHA1:	320FA6267BE6129F1E021F611E2FFA037B2B1DAC
SHA-256:	55C5F612E528C078CDCA7C1C31B335FB6EA6C47DC00059D5C2D81ACF0D56A646
SHA-512:	98B167AB38A0A5EFD193E73EA744197441573854D8B81669F4BEF893548119360EF1EF12961F598F04FA7CA79D77731313F577A087E581913F517718841E5968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......&..b...b...b...Ec..`...\|.p.g...k.g.`.....b.`...k.a.k...k.w.l...k.~.Y...Ec..x...;..a...b...)...T...c...T...f...k.p.X...k.f.c...\|.`.c...k.e.c...Richb...........PE..L.....;c...........!.....,...`......N........@............................... .......M...............................,..f.......@.......@ .....................db.. F...............................................@..h............................text...........,.................. ..`.rdata.......@.......0..............@..@.data....D...0......................@....rsrc...@ ......."..................@..@.reloc...d.......f...*..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25def.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427536
Entropy (8bit):	6.671052014150009
Encrypted:	false
SSDEEP:	12288:nsS6ZvuTiw44+/rC6K+jcWdbvqn6D5V4znT:nsfFI+jcov+6DzqT
MD5:	3007E804DE23491A96C3A681F56B569C
SHA1:	42F29A4B3805F7C9D59E37B050B28F59721EF395
SHA-256:	4584522D37CCC1EEDE115BFC6A34A0BF6EFE6D5AF3B0EC2444ED86E31F48BBE8
SHA-512:	79EF37C8D50637D867D19E4DA991CAD77AD74A7EE7059A8E1117922E171F3596EA7E3FDF6F1894D442F93BA7C89006842BF62BF1AE5106457B691C31472533F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Hy..Hy..Hy..o...Iy..V+c.Ly...6q.Iy..A.r.@y..A.d.Gy..A.t.Ly..A.m.sy..o...Qy..Hy..Ax..A.c.Vy..A.u.Iy..V+s.Iy..A.v.Iy..RichHy..........................PE..L.....;c...........!.....(...0......J........@......................................4c...............................,..R.......,....@..D............\...*...P...I...D..............................0...@............@..\............................text...Z'.......(.................. ..`.rdata.......@.......,..............@..@.data........0......................@....rsrc...D....@......................@..@.reloc..LK...P...L..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\mkd25sdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343056
Entropy (8bit):	6.646382184012647
Encrypted:	false
SSDEEP:	6144:Lk4wsI5/1WuC3Xz+/o4q1FiWqqDL6/e5UO12WPTp/h:LtrILWuIXz+/XTqn6/K/h
MD5:	3D13F50ECF41A48FA63530266080D951
SHA1:	545ACC5EC58D4C218AEAC56A8582E9836E968B7C
SHA-256:	B8144FA92B9DC000D7FC86450CBE9F74B629F75612D4F3C7C5744BD7D66C1FAE
SHA-512:	060084943340DB957D711DEF3106F2AE4719427B4860F98A163B639929019DA4B596BA3B7D80191A5D8436839B387F07762CF2BE3AB1A2A47A642AACF0998B17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..A$..A$..A-.1A&..A..4A%..A-.7A#..A-.!A+..A.\.A+..A$..A...A-.(A...A-.&A0..A-.0A%..A:.6A%..A-.3A%..ARich$..A................PE..L.....;c...........!.....,...................@...............................P..........................................................,.......................7..`C..................................@............@...............................text...........,.................. ..`.rdata..L....@.......0..............@..@.data...\|...........................@....rsrc...,...........................@..@.reloc...9.......:..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653120
Entropy (8bit):	6.883968356674239
Encrypted:	false
SSDEEP:	12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
MD5:	7538050656FE5D63CB4B80349DD1CFE3
SHA1:	F825C40FEE87CC9952A61C8C34E9F6EEE8DA742D
SHA-256:	E16BC9B66642151DE612EE045C2810CA6146975015BD9679A354567F56DA2099
SHA-512:	843E22630254D222DFD12166C701F6CD1DCA4A8DC216C7A8C9C0AB1AFC90189CFA8B6499BBC46408008A1D985394EB8A660B1FA1991059A65C09E8D6481A3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(.......................@........3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	5.38478122745935
Encrypted:	false
SSDEEP:	48:3SlK+vU6gaAg09kkKb+Ezo09kkK/zzbK5C09kkKsrzY:Clt8UAgXk8+E8Xkaz/MCXkJ8
MD5:	A806C2A878EBCAA97F095E204AD23527
SHA1:	83EB34D7CED2B9DC71DBB849AA21EA78EC45A78C
SHA-256:	6B737568E1A12AB56EA091427B691B0FB5391997EBBDC4353C4ABDD2786E110B
SHA-512:	52149492ED4FF37115CB8D16203BE2419B692074824EDE86647CBC1B9CAA46D23E04C9C9D8979E512EE09933D46F69B7B384678E05B74ABEDB81BB9AB6917263
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="1b065fdf0cb8516b0553128eae4af39c5f8eeb46"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Vy8CgQgbu3qH5JHTK0op4kR8114=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="45d3027d87eade77317e92994790598c755b3920"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	571920
Entropy (8bit):	6.671628577535569
Encrypted:	false
SSDEEP:	6144:Q75WD5X9srthVNv5Rb97JXJ+/6KXsDLsari6+hnKZcSjaERsMi5Y+kG/IPNqqDL1:80JMVjJXJ+/BmpfaE25zkpPwqn6miYrl
MD5:	C183D08777D542CFE28098867E0F2DDE
SHA1:	320FA6267BE6129F1E021F611E2FFA037B2B1DAC
SHA-256:	55C5F612E528C078CDCA7C1C31B335FB6EA6C47DC00059D5C2D81ACF0D56A646
SHA-512:	98B167AB38A0A5EFD193E73EA744197441573854D8B81669F4BEF893548119360EF1EF12961F598F04FA7CA79D77731313F577A087E581913F517718841E5968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......&..b...b...b...Ec..`...\|.p.g...k.g.`.....b.`...k.a.k...k.w.l...k.~.Y...Ec..x...;..a...b...)...T...c...T...f...k.p.X...k.f.c...\|.`.c...k.e.c...Richb...........PE..L.....;c...........!.....,...`......N........@............................... .......M...............................,..f.......@.......@ .....................db.. F...............................................@..h............................text...........,.................. ..`.rdata.......@.......0..............@..@.data....D...0......................@....rsrc...@ ......."..................@..@.reloc...d.......f...*..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd2564.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	476184
Entropy (8bit):	6.283492144559428
Encrypted:	false
SSDEEP:	12288:Sw4CZC80E00oTm3iQAtRW0/ODqn60YGkRS7:GCZC80E00oqLWRW0/A+60YGkRQ
MD5:	3B167AE252826FF85249B7CF5F104033
SHA1:	D889ED12176F76C81B15C9BA0AD3650E49793E57
SHA-256:	BB72645F36DB837107F226F3A835987EFFC5A863D283E5DAC1E7F07FDE430A78
SHA-512:	E7E97F9EB4453CE6018FC0A88303B8168092E75A2E937CBF5D6B5C691FE35659218A02C544143D58201DBF154F7EA81E870844A9C2E390F2CE032DD6BEDB8951
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......".d.f`..f`..f`..A...d`..x2..c`..o...d`.../..d`..o...d`..o...k`..A.q.}`..f`..,a....d.g`....g.b`..o...\`..o...\`..o...g`..x2..g`..o...g`..Richf`..................PE..d......c.........." .........(......l...............................................%...................................................h...p........P..@ ... .../.......*...........................................................................................text...>........................... ..`.rdata..H...........................@..@.data...H<..........................@....pdata.../... ...0..................@..@.rsrc...@ ...P..."..................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25def64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	537616
Entropy (8bit):	6.368155160902403
Encrypted:	false
SSDEEP:	12288:0iKzfU667slsP4sssssssfWgs0d6kNGccqn6erH2D8:0iKzfU66igs0hN1c+6e68
MD5:	952976C7CA9AEFD280D1FBDCD2D57FB1
SHA1:	94EE25A2C165318F5B5CA17B15C2E187265BD224
SHA-256:	62B803C81C3BE625D28EA74A679AA09A1F36EA3575F52AF43596A3CDB26F4520
SHA-512:	220EDDDE70B9DFD13CB1A25A72B3CACBAA0FB3B9F7BE82F917ECFE9D522EBD55967810BDA7413A0B8B6EC253DC1C9BB4938A7A469A2E17AD8550872CCDB89229
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[...\|.e.Z...E.a._....s.Z...R.p.Y...R.f.V...R.v._...\|...B...[...S...R.o.a...R.a.E...R.w.Z...E.q.Z...R.t.Z...Rich[...................PE..d.....;c.........." ........................................................`.....................................................p...T...0...,....@..D........K..........P..(....I...............................................@...............................text...l).......*.................. ..`.rdata......@......................@..@.data...............................@....pdata...K.......L..................@..@.rsrc...D....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\mkd25sdk64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	295952
Entropy (8bit):	6.292791397896024
Encrypted:	false
SSDEEP:	6144:vddgmt+uNBY4v4N+VxJJCKqqDL6TT6ZpOpezPTTp1X:vddgujogtA/qn6TEp1X
MD5:	810CD8841CE2C670F564F4D94977C9F2
SHA1:	61B5592FB4D77CBD306E2CF0ADF756FEEC2EBC55
SHA-256:	5EFC3B6ED3C93E4B8FAEF0A5C5500150ACBC914FB588E9B9BAB6127F2E974DBF
SHA-512:	322760286CD53ADD4ECB6165DEDAB0A50C26F10B6212CE65218971D6D5E342C40B2019A8793C51093A89E771EBCA6E9DE1572EA70A7A24B3AA0998522058643A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k:../[.P/[.P/[.P&#%P-[.P.. P.[.P&##P-[.P&#5P#[.P...P [.P/[.P.[.P&#<P.[.P&#2P;[.P&#$P.[.P1."P.[.P&#'P.[.PRich/[.P........................PE..d.....;c.........." ................Ly..............................................................................................`X......XK..x.......,....p..,....Z...*......4....................................................................................text............................... ..`.rdata..............................@..@.data........`.......N..............@....pdata..,....p.......2..............@..@.rsrc...,............J..............@..@.reloc..n............T..............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\SDK\AK\x64\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	624448
Entropy (8bit):	6.583477769791977
Encrypted:	false
SSDEEP:	12288:BIyThtSXwAnAJGaAx8eCte8P8qhzNZppK5E2WeAI99aWmqy7QMz:BIyThEXfn+G9zCtb0mpc5E2WeAI9mqyf
MD5:	E4C2344E31D3C577FB2723C961069858
SHA1:	572F0281081BBB7A87E491D32B4A29E2447CD75E
SHA-256:	4546EB9106E86E471CAF0870ACDD4D1FE34C2AD293F596FD55B82215B922AE14
SHA-512:	7F35D0F0BF6DCFB44A1CD7E07F95536010690722FD28D587450F158F87BE0913F210B06EFCEB87D63BDAF4DAD4ECC09A4CF7397F64C5284A36579A133CFD5BA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................'..........r....B.-....T......E.n....S......U......P.....Rich............PE..d...=NYJ.........." .....p...&.......&........bx.....................................\|....@..........................................q..Cx..._..(............`...D...p..@............................................................... ............................text....n.......p.................. ..`.rdata..Si.......j...t..............@..@.data....d.......<..................@....pdata...D...`...F..................@..@.rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StCli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804816
Entropy (8bit):	6.459209661172028
Encrypted:	false
SSDEEP:	24576:vH0zLS1GGiFp72aGXENzZbieYsEqHa+E3hc/XnN3EflL+6Rj/1r0Bz:4RL3GSzJTYs3H5EqnN0fl68jF8z
MD5:	C851706ADC35EF9E4B3C306CEC3B9435
SHA1:	EBD1F899BFBDB6EB475D706BEB0FC6DAFE1B7A45
SHA-256:	0CA7BFB5022796346780F441AC7DBE7369477F3FD8BEC75DE19F5BBA09328ADA
SHA-512:	9B98F1F87A8E95EE3DC6218AD30F0DD4B87DE021DB91C67762E754030472AC05BAA686C72F00D82D850F5E11AC32B29256A7D1CD0E3CCCDF1ACFC1E4C64391EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S.D=..D=..D=......D=..<...D=..<...D=..<...D=...F..D=..D<.GE=..<..uE=..<...D=......D=..<...D=.Rich.D=.................PE..d.....-c.........."............................@....................................(V....@.................................................8........................`.........t9...................................................................................text............................... ..`.rdata..............................@..@.data...(...........................@....pdata...............V..............@..@.rsrc..............................@..@.reloc...J.......L..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StCtInst.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	171864
Entropy (8bit):	6.116740185924319
Encrypted:	false
SSDEEP:	3072:gYGYC3LPOUSOCEKzRtp19RV+RiMqqDL2/9PtIMOlaXDUrD2uBj7v:gB3KUSOCEKltp19MqqDL69PtNOlaXDUV
MD5:	45D0972B1DA80A06A396A5413BE63F06
SHA1:	57C82B08BE11B3C4D176BF0FC9A52D986C066ACD
SHA-256:	F581E4492F3C8369BFB4D10AD63BBD5A1A56D86B6EAC84C27E760EC2A2B5C710
SHA-512:	B516E1ABA26A1D5F115CD9B7C538E71401ED75DAB19B4524C0A200854E770ADCEF6065B0F22DDFD921A7D6722B0A5A12AA708D676B32D0562DDF1B6085827FB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.H...&D..&D..&D%O]D..&D..D..&D..D..&D..D..&D..D..&D..D..&D..'D.&D..D..&D..D..&D..D..&D..D..&DRich..&D........PE..d...V.yb.........." .....@...8......X0...............................................8....@.........................................PF.......'...............p.......\|..X#..........@]...............................................P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P.......<..............@....pdata.......p.......D..............@..@.rsrc................X..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1981464
Entropy (8bit):	6.417695231214171
Encrypted:	false
SSDEEP:	49152:oGOBd4Jg6SNpVzvAVxw6AWIs8q1v5bP0v5gOSyl:3OdX6TjvhP0N
MD5:	EA18F7879E245EB444BC97FF0F5F9336
SHA1:	2C6B354BE2B9C361E5A2F10F10D6D3BAB57A74FF
SHA-256:	576756155AA576960F059E78B5AB7DE05889FE5CFC9DDF9714FD75B4ECFB53EB
SHA-512:	75DCD91B3022EAD5AAEBBB6A9497D19B09199A42ED5DA41BF56F5F49E3F4F02CCBDBAF6610FB328267DFC493BA41220EA37F3BACCC16D6BE4952C4BF14C3D706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?....K..>....K..>......>...6...=...6...9....K.."...?...o...6.....6.......6...r...6...>...!...>...6...>...Rich?...........PE..d......c.........." .........<......P.....................................................@.........................................p.......X...........x!...p...........*.......>...................................................... ............................text...(........................... ..`.rdata..............................@..@.data...8...........................@....pdata.......p......................@..@.rsrc...x!......."..................@..@.reloc...Q.......R..................@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StSdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3336216
Entropy (8bit):	6.441350645281096
Encrypted:	false
SSDEEP:	49152:k5tUW/bpXQg1iUY1reWeTYA9EDkTIvfXS8qNe97TFrRE75DFnQNAS:kme2/ZRFFEJM
MD5:	76355E8115666B67345435C7A39F61F2
SHA1:	321E110E144B7AEEE6965503A09EF27AE1FC891F
SHA-256:	4775A0F5EB9066DA4DDD8EF63C35D30E77ADDB0B7D709722B9FADE30D31DAF1C
SHA-512:	CBCCADC9162BEE48D599E85CD2ADD9D70BE6A4AEEC0EDBA940DD9CD0D400A1EB08FC01E7B9295E9A03D43F3CBCC38F24A3F4236C92036B040AA96A2452EBD89F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......c...'...'...'....2[.%...9._.#....2..#....M.%.....N.%.....H.!.....X.....'...+....2........_.......Q......I.&...9.O.&.....J.&...Rich'...........................PE..d...u.'c.........." ......!..........G!.......................................3.......3...@......................................... i-.....p.-.T.....1.D...../.......2..*...p3..E...$"...............................................".(............................text.....!.......!................. ..`.rdata...[...."..\....".............@..@.data....!...p-..<...^-.............@....pdata......../.....................@..@.rsrc...D.....1......r0.............@..@.reloc..Pd...p3..f...X2.............@..B................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StSess.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7092240
Entropy (8bit):	5.977142176247476
Encrypted:	false
SSDEEP:	49152:wK9i1SDDJlLFylPDbvXsQSFxkODI37WpqTXGZUWJkPuwAOHgftXAkeLAJIR7djXp:wsV48bst5gFXQLAAHkiWglga
MD5:	3788CF099E2B65810B7EC53430E59CB1
SHA1:	79A8A9F4E60E0AFB2C08FE7F7DAFC781762A6F8D
SHA-256:	E715AC15FD9EB9729F558418E41D82ED6EA0C309F7669ACFDC1A94AB399CE3AD
SHA-512:	4F2A108598A4392A13D3C9063A3019F0F9BD80DE54464D606F0E6B842B854AAF025817FD5F561363EBA4FA6355C57F15013C36FB31D22DE3A212FD7F872185A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H...........L......Z......Y......_.....q......q.......O.`....H..................F.?....X......]....Rich...................PE..d...aE5c..........".......A..p......w=........@..............................m.......m...@.................................................H._...... g.......c.......l..*....m.h}..p.A...............................................A..,...........................text.....A.......A................. ..`.rdata..8.....A.......A.............@..@.data....E...@`......&`.............@....pdata........c.......a.............@..@.rsrc........ g......le.............@..@.reloc........m......Jk.............@..B................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\StSvr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2034712
Entropy (8bit):	6.42432614740446
Encrypted:	false
SSDEEP:	49152:3OpRl2lfu2ubIuuuKtKrD6MPjX/jNS4c:73duusrFr/jN
MD5:	3A79D928348E36991FE1E9E89A797E25
SHA1:	44018020982345804E284B84B2B3F128FDB148FE
SHA-256:	F5F1554312CDC717E5E638458D4E0CC9B45C16ECB2B40F5F2BAE5BCD08288B88
SHA-512:	7D04ED61B633131790BA79A09D79F7D71570EABAF9430D3C26FE5DF5D7381236F3CBC8BCF9E019142846F6660B8D3B941D693DEEF2BA7B968B702B2D488990A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.N.:...:...:..+uc..:...B`..:...Bq..:...Bf..:.......:...:..e;...Bv.h;...B...:...Bg..:...ha..:...Bd..:..Rich.:..........................PE..d...N.'c.........." .................M.......................................`.......]....@.............................................J........................5.............8E......................................................@............................text............................... ..`.rdata.............................@..@.data...8........T..................@....pdata...5.......6...J..............@..@.rsrc...............................@..@.reloc...W.......X..................@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\TFFREGNT.SYS

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	211888
Entropy (8bit):	4.280846560531454
Encrypted:	false
SSDEEP:	3072:4+jcrSnu1GwN+CKr1ZSntm5lOjw2xyQNElr+A61yue:4+orSnjn3YU/5
MD5:	2F04888FC02BB091F73E4BD73F59D867
SHA1:	D130250F27D3C94D931EBBA098F2BA7BC675DEF2
SHA-256:	0FD6C35C03D5060E820275CB12B79A5565B2E51241C4C06180FC162AD4F76F6B
SHA-512:	E0C29EBA1A9F501D784107E1DB2A06F5907DE17E4346AFEF38672E94A17BAA5378B255B85C3EAEB2A63CB3DE83316541C23E5C4B750D527E786A61E5B2182467
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..W..W..W...T..W...V..W..V...W...S..W.z.S...W.z....W.z.U..W.Rich.W.................PE..d......b.........."......x...x.................@.............................@.......R....`.....................................................<.... ...................O...0..........8............................................................................text...pf.......h.................. ..h.rdata...............l..............@..H.data....P.......J...\|..............@....pdata..............................@..H.gfids..............................@..HINIT................................ ..b.rsrc........ ......................@..B.reloc.......0......................@..B................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\TNNetUtil.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1828368
Entropy (8bit):	6.404704447013732
Encrypted:	false
SSDEEP:	49152:ZkZBU7xHRShPdi0aF3PkCHPSEJhBrormt:ZUxIpPxhBtt
MD5:	9E9446AC1FC8A4E5831FEE643FB26AF3
SHA1:	DA5039F4B49515FDD79DD8B4C067FC0BAA2689FA
SHA-256:	048908489D43F4640DB1857799655C3692DF2661B0CCBED6E1BDB7288A94497A
SHA-512:	E0598923DD54EA2A24A1175FA6257460AEB00439C9E47BF525A8F98EB80666402427AC929540FCFD0D7646792BA2194003ACB953ED4007CCBA807799ABAB3877
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s................a......jr.....N]w......jt......jb.'....jh....................je......js......@u......jp.....Rich....................PE..d....N.b.........." ................d.....................................................@..........................................S..a...`,....... .......0...........*...0..(;...................................................................................text............................... ..`.rdata..qs.......t..................@..@.data...(....`...0...F..............@....pdata.......0.......v..............@..@.rsrc........ .......f..............@..@.reloc...J...0...L...p..............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\TSFltCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	207896
Entropy (8bit):	5.956963782260381
Encrypted:	false
SSDEEP:	6144:5rnJR6PnqR43LEq8GAXgnz9Sqtqwjqhj/6G8Qz9zmm8RpT4OlsW:5rnJR6PnqR43LEq8uL
MD5:	CF486F6361CCCC70B76334D5BC6747F7
SHA1:	8CEBB0DB202FA2156345882A50D5083025D924E8
SHA-256:	96F2A1793EC1E19D4470928E355E013FA61246C70553B4DB162DD00443DDE63C
SHA-512:	13BAC467951757DD7CE1DEAEC9FD5276E93D69199DAD3859857F33435AE757C9A68A1F1A1DA923D843F0D9630E55D6018DBBD3692E3E30307E86C957B08AE23C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.9.c.W.c.W.c.W.j..a.W.....a.W.j..a.W.j..h.W...,.h.W.c.V..W...9.`.W...:.g.W.j..v.W.j..b.W.}..b.W.j..b.W.Richc.W.........PE..d.....b.........." .........0...............................................p.......6....@.............................................d...d........P.......0..h........*...`..L.......................................................h............................text............................... ..`.rdata..D...........................@..@.data...............................@....pdata..h....0......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\TSFltDrv.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534488
Entropy (8bit):	5.8618115032821985
Encrypted:	false
SSDEEP:	6144:8LpLUdvdJX+pHrfZjjxShb7+JsNCSOmhtdO1nUNrfT9vEzmPDH:8FodloHrxZXGCS5h+VU19vkmPD
MD5:	9A9722F87DD767FF048A50BDEDB7865B
SHA1:	5174873F2C3B42D6EC373406213E859E87EA8617
SHA-256:	4EB6F7141941806843A9714B25B852C2AEA64ADECEFBE4FF703EBDA68EA070EE
SHA-512:	D73256E291B1251B881CD2DCFEB9D2A76BE46CAFD45FBBCCED26F62E4E584EF97B34813BA7002BAF20CE35F4D4020B1B484A8569F5E0084BF33B132A9878125F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`**.$KD.$KD.$KD.I.E.!KD.$KE..KD.I.B.%KD.I.G.-KD.I.A.-KD.I.@.9KD...@.gKD.....%KD...F.%KD.Rich$KD.........................PE..d......b.........."..........V....... .........@.............................`............`.................................................. ..<....@..`........2.......O...P..........8............................................... ............................text...1........................... ..h.rdata...Y.......Z..................@..H.data..............................@....pdata...2.......4...\|..............@..H.gfids..............................@..HINIT......... ...................... ..b.rsrc...`....@......................@..B.reloc.......P......................@..B........................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\UpEx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	757784
Entropy (8bit):	6.019433950422385
Encrypted:	false
SSDEEP:	12288:PSNg5GRag8QEswaSiLp0raJvrOkXfb/zMLUht1SiWOHnuUYeYJveyRxqn6goizzs:aNg5GRaSEs9rLp0raJvrOkXfb/zMLUh2
MD5:	0CBECE6026A196F8EEEA2C37D1A4BA0D
SHA1:	93876327C26DB8C766A5907E4AFA089BF003A6FA
SHA-256:	D2B994F9081CE57AFE43119FA334D10FC4BF820EF8CE2CADF242E6BFAE6B6588
SHA-512:	2643C466E216481D7800605D807E7290A54AA92152A15DF285E601E2B6513A2DA1463B299C2089B1CDBC72CC9492F9BA65750D188801C5F7E5D67A6EF35F5CAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a..8%..k%..k%..k,.Ck'..k..Fk ..k,.Ek'..k.7.k'..k.7Pk'..k.7.k6..k%..k...k,.Yk<..k,.Tk...k,.Sk0..k,.Bk$..k;.Dk$..k,.Ak$..kRich%..k........PE..d......c.........." .........p...............................................p......1e....@......................................... G.......(.......P..`........W...f...*...`.......................................................................................text...<........................... ..`.rdata...8.......:..................@..@.data........P.......0..............@....pdata...W.......X..................@..@.rsrc...`....P.......P..............@..@.reloc.......`.......Z..............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\V3Cert.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88408
Entropy (8bit):	6.434286569256578
Encrypted:	false
SSDEEP:	1536:1p8YUm3aOi/Lt3ypYxcA1abrhO4zGMqqU+2bbbAV2/S2LpjCbOlHlE47T4J:6m3aOIlTxj1abFVzGMqqDL2/9jAOlHlG
MD5:	931F74D43AE626D40FD045F1EBD7E6E3
SHA1:	79B23A795588DB0B72C22F97E5D09AFF2602404A
SHA-256:	51D45A416B396BA4691224E90B975ADA37665AF6A89E4CCAB97DB90E392E661C
SHA-512:	1A358ACAFC0FB71868F1E85DB5F15EA36218F18926B0B1ABCE89E4C5D6CD074C91D6886E6CAB8D9AAE77119172CC8E7AC0564D62EB62A6149E74DA1045F3612D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d...\..d....O..d..j+J..d....I..d...._..d....X..d.....d...d..Md....V..d....N..d...6H..d....M..d..Rich.d..................PE..d...Y.yb.........." .................\.......................................p...........@.................................................."..P....P.......@.......6..X#...`..X....................................................................................text...W........................... ..`.rdata..6o.......p..................@..@.data...`....0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......,..............@..@.reloc..2....`.......4..............@..B........................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\V3ElamCt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47640
Entropy (8bit):	6.102382900076391
Encrypted:	false
SSDEEP:	768:Q9/KjnoLT0NVtCK30V8vCipSCKL2yfpzDRzjOwCOlTjdyYitnkmeEdM5a:Q9CjoL8PCe0GvCC7q2QMwCOlTjdy7VRD
MD5:	83D667606D70516F3D8DDBD91C152D79
SHA1:	704BDEB20AB573BC7B975489FCB672CF97B53940
SHA-256:	F4CC64418BE0E6FFC80BA79FDD4580DCF7FC4E0E2FB4C435CF56740F5EB93F8F
SHA-512:	7003C7C5D4B4BC6B4A636ACE11A15C077BB7BF8B5C7F62C92CBD8B139AEB3967513A3F91AB0ADA63D9858D20E56BCE3DD89A89D1A1AB494F4B032CBFE6806FAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..x...+...+...+..&+...+..#+...+.. +...+8V5+...+8V.+...+...+N..+..6+...+..1+...+..'+...+..!+...+..$+...+Rich...+................PE..d......b.........." .....R...:.......Y.............................................................................................. ...d... ...d...............(........*......,....r...............................................p...............................text....P.......R.................. ..`.rdata...&...p...(...V..............@..@.data................~..............@....pdata..(...........................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1273088
Entropy (8bit):	7.970271479260553
Encrypted:	false
SSDEEP:	24576:wNGIXgjlFB/AhGDW3U1Nps9oYlK1znWBT4Lx2yyFlRInP72DB//:XpJf+r3ESoYOxM7RIj6h
MD5:	D580C855EE3489FA4A562756E9166B6A
SHA1:	5C4E1C7AC46769D082718A4323D2C275D10827D4
SHA-256:	8109445253EBEB5EAC2FA655FA49072B84DD32D38D1F6DB1958951C2F74D2E42
SHA-512:	2F238A7B9723724BF485D69B53C8EF3EC7A2CC5AAFBA39B1A78F4673F978F786105348303DB08114B59DEC8CE64EE3A22120386BC553CBB0E20C3A4CDACF0368
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................M............h......m.....Rich....................PE..L...9v.`.................d...,......(5............@.................................m.....@..........................................@..8............B...*...........................................................................................text....c.......d.................. ..`.rdata..8............h..............@..@.data...<...........................@....ndata...................................rsrc...8....@......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\V3Prtect.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	30704
Entropy (8bit):	7.994687726116243
Encrypted:	true
SSDEEP:	768:j8ln2GseEwWSsCJnvjjyn17sSt+vJKZY0Bl:YEGlwc7j65sSckzl
MD5:	2392F1EE01FDF107DF218799B881B7BB
SHA1:	F32466DC5920657DDD8957C1B67EA9F1C3C365FC
SHA-256:	21A2C611DEEA9BDDE659DB16CD9AC4492B9E994B1F5A66886EFFE953AED75A09
SHA-512:	9776C36AC288D532FE7A8FCB81A0E088FF2AEA3866A355A233611F4C87E26414A528904C76EF3C5B06323E88D77368771132A857009ABEA8216C5780395F6730
Malicious:	true
Preview:	...@....3..=6F:....bM .,....s..L..../kP...W"...!....gu.Zm=......M.r...;..80..QF;.YmM..uL.=TC.BLI.R.I..Z.;6..;.\.].\;.G...1..q.tl..N1.._2,.Y'......(.).......sG.C0..Y...O..x5&.5..D.........=t9...0..Q..v..H...B\|..B.Af.6.l......uj....\..I..B.3B3.?t.k....G.M...}..............bI...O.P7kor....F. ........!..`j.-{.. ....1V.....4..Rj..P#..X.#>:._.,.E-.N...x.j....-\|tDDR.EA.j,.+ru=..1ZR.2.3.Kt.{.!O.....M:..Ml'.]3...uTzh}.i....[..,u4.l.....{.R.%.]..H0!.Oz....'S.V. Rk.\0..!.H$..IY2^a._w...>a....,.....m\|.cDp....6'.o79B..HWR.%.^.wP..=.:......g.......WZ.L..7.K.l..Z.....A..K.?..qkw...A..2PF...G.D..;=koz...F.10U...KA$6-n1..%.....D...+..c......n..P.wU.f[]xo.\..%.b0@q.....F.[B.A=...S.,... .'..ke........Y0.o...^'H.he2&.)z'..Rvf.ph.D!..f...!>.....4....n..F..Y`.....>....%Pa6..^.PT......+#B.........". ..$.M.[..1"..H$......l.`.r..].}P..H..... :.RJ..C.n.tBJ...]C.{...K..+>I..Fz......Q\|6.3...c f...K`O.#n.M....ar.(w..WA5...v!+uI..54q.p.......yf..l.._....U......(.8..

C:\Program Files\AhnLab\Safe Transaction\WinFWMgr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54992
Entropy (8bit):	6.2151261400912885
Encrypted:	false
SSDEEP:	768:d9DpEJKW7TkYuVags9rZ3n9foQw2EOlOEDG2s1hykp23+zj:d1W7I3Vjs9rZ3n9foQjEOlOEbsXc0
MD5:	CE5126092A96047BEFB273A6FE44D4CB
SHA1:	40D11CAE0D69E2653998661BC2CD07E2BA7BCD1A
SHA-256:	050B372DBD24D250A08AAF0FDB04AE7CC8E2B04089A91F619CC48E698042E400
SHA-512:	9FC1BA5A2C322E27B608288FA33940E1C9D89C486E2926C7AA91862567DB0B7DC312F1195762A2584CABDFC35A5C775D1D75BDC9909702DAC06DD18E64EB01C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|...u.G.~.....B.}...u.A.~...u.W.u...u.P.x...[X..{...\|...N...u.^.~...u.F.}...b.@.}...u.E.}...Rich\|...........PE..d...>`9[.........." .....L...H............................................................@.....................................................d...............<........>......,....a...............................................`...............................text....J.......L.................. ..`.rdata..q3...`...4...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ahloha.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	645656
Entropy (8bit):	5.899960831822906
Encrypted:	false
SSDEEP:	12288:SOxxQ+dinSaJc4Hf8XBX+LdQM69V+Mzb6eb3kGE:SOxHdinSa64Hf8XBX+LdQM6vb6G3kd
MD5:	86C1BE5AF8801AAC17D9B566F5EF1B73
SHA1:	29BFADA2BE4337AA5DD9467EE7E75D78D52E1B47
SHA-256:	138E5FA33CBBA98E794F0378A01716BD744AE0976D33A878E756B3146CF1E87C
SHA-512:	75333ADC41DAA6899427D8348C7683F1321C60B10DA201001D65CFA0DDF3AE7DDD40ACE9D6D6EEB4E2239547716B009E5EFA5DE92BAD0B3949E8CD381D520F6C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x......................................................<m.........:...................................Rich....................PE..d......b.........." .....<...p.......................................................{....@.....................................................d...............lB.......*.......... U...............................................P...............................text...$;.......<.................. ..`.rdata......P.......@..............@..@.data...............................@....pdata..lB.......D...^..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ambassmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2725376
Entropy (8bit):	6.421867300252698
Encrypted:	false
SSDEEP:	49152:PTleOXbolSKB2ig9vU13nj24G29VNoUZTj+uFE:gsKesjtoUZf+uW
MD5:	21B9FF4DCC911D9805437616516277D5
SHA1:	D26E52AD1633E582E938003CB388BEA116482596
SHA-256:	71063323DC029834DC4495BC818940E3339E3D2E54601F3474A782DD21D7B088
SHA-512:	03C5E96A7A9337F43BC469607B5BB2DF0391A1EDEB4F705F0768A05F5D6EF028A59D4D0CF296ED4116D7D1F68009D65100B6053C7D56A2AE802086A7E22FB480
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.....d...d...d......d.....,.d.......d.......d.$Q....d...e..d.$Q....d.....3.d.......d.......d.......d.Rich..d.........PE..d......c.........." .....j...................................................@.....`[...@...........................................'.....L.&.......)......0(.D....l)..*....)..J......................................................8............................text....i.......j.................. ..`.rdata..9............n..............@..@.data...0.....'.......&.............@....pdata..D....0(......z'.............@..@.rsrc.........).......).............@..@.reloc...b....)..d....).............@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\aos.sld

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.186704345910024
Encrypted:	false
SSDEEP:	3:f0TWqlcr1+sAB6k:feWewABB
MD5:	7998105AC905A8BF889A97EE8939F574
SHA1:	975E410CE656F7E7B61BC5B71B65242DBDA1BF1B
SHA-256:	C2737649D652E9DB821F95F3B05B9089AA52D3D6DAF6A0A7CAF274E9A541F3EE
SHA-512:	BFCFD876FBB66997F8E3EC151C3B78276D79CECF1B169C9694ED6B2504C7A44A65D16209C740110867717FA004116A54E648B986708E8E75D982B7345FB497C2
Malicious:	false
Preview:	slpk a0.......M.....b!....9..K.....2z.%...s

C:\Program Files\AhnLab\Safe Transaction\aostrust.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74744
Entropy (8bit):	6.618122985098431
Encrypted:	false
SSDEEP:	1536:7UpUEXzDnqtBZBenA9qpYZUGcQ4IJ5KQXOla+cCN:7UVqtx9q6Ui4Q5xXOla+cCN
MD5:	DC68A111EA41BF5BA63E0F2427D89A31
SHA1:	E3B46146E5B1380C95A7AB74F6475669C9A486E2
SHA-256:	ECD20EE070FD8F0EC96033DD49A569BF8B50FC427B25D97CAF2E1D5634871FF7
SHA-512:	F0590903D418AC19813BF4EDF21A5E0CE672964A246354354646D73480173642B719F57C0085B6C329E157AAEA52573B58E9207096628FB5E8B48184D785D066
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.U...................R_H......hK......h]......hZ......hM.........&....hT......hL......BJ......hO.....Rich............PE..d.....H`.........." .........P...............................................0............@.........................................P...M.......d.......<.......\|........?... ..$.......................................................P............................text............................... ..`.rdata...1.......2..................@..@.data...`...........................@....pdata..\|...........................@..@.rsrc...<...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\arklicense.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	26046
Entropy (8bit):	5.152056526050458
Encrypted:	false
SSDEEP:	768:KL/5BD3UtnF/ijw3Xenxw2hTGMxQxUVZUh9BuzpDJFql/Mns:KL/LOFajwHsy2ZGMOoZUh9BQrS/Mns
MD5:	9AAC93C4D25C55BB259012F580C3233C
SHA1:	A2DF73985B1CCCEC3697859C07BA318BA7E67063
SHA-256:	5D2E8EFD104AD8D5FF24BE904C019226554D0D89677B388508FBE9D615814396
SHA-512:	17AAE966F69D4DC84FB452124DF47D0C9286AFA46A9FE850E135F3F2E5CBC755EC1628D8287BDDC47F9474FD1D62D77BA9717088F9AB345573160498186D7BD3
Malicious:	false
Preview:	..... Ark Library License...... Copyright(c) 2008-2020 Bandisoft.com.. All rights reserved except as specified below....================================================================================......* zlib : http://www.zlib.net/zlib_license.html.....Copyright (C) 1995-2010 Jean-loup Gailly and Mark Adler.....This software is provided 'as-is', without any express or implied...warranty. In no event will the authors be held liable for any damages...arising from the use of this software......Permission is granted to anyone to use this software for any purpose,...including commercial applications, and to alter it and redistribute it...freely, subject to the following restrictions:.....1. The origin of this software must not be misrepresented; you must not... claim that you wrote the original software. If you use this software... in a product, an acknowledgment in the pro

C:\Program Files\AhnLab\Safe Transaction\asc_main.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	129056
Entropy (8bit):	6.294528208901257
Encrypted:	false
SSDEEP:	1536:shUPJasOeUQhVFfuc+9e4/2pv/SXpedpVH8fBTwN2akiItSWp7M:seU1RYHSXpedp6faN2akptrpg
MD5:	5C77EF9D095A9C8D4DA5417E0DC82167
SHA1:	F1377158B7C8DD14E641095CC30DEFB21E238764
SHA-256:	2CB446E992CAE953CA963212C5B01E92EAD41FDF2FD1A330ADF6E519D5004C9C
SHA-512:	43FC97AA031FF61DBEB897654CB74271DB64C2EE1C4D0EB7068B2F644A853BC17021D4A9F62760CFE1E8E679B28BA959C9D9DD68DC7216433231260465F391C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........ZX...X...X.....[....Y..Z....Y.._...X........Y..i....Y..Y....Y..Y....Y..Y...RichX...........PE..d....m.b.........." ...............0........................................`.......................................................U......pM..P....@..P.... .......... ...P.......................................................................................text............................... ..`.rdata..he.......f..................@..@.data........p...Z...T..............@....pdata....... ......................@..@.rsrc...P....@......................@..@.reloc..4....P......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\asdf.sld

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.413977073182751
Encrypted:	false
SSDEEP:	3:f0eRtAFmkPcln:fVRtAxPU
MD5:	048F49C85CDF1AADDD35F5D917038A3E
SHA1:	4F58AD1471426ECDF29FED712E201699DCD11A97
SHA-256:	C06138DD09D44A59EFCC8C603310E7A26A0761E6FD5C5DEB1C52C06ECF0F402B
SHA-512:	72E6149CD929D2093594D9DEC8B5082450DDEE50A18EC1147B40AA4BE7F2C8E680E748DD612C20292E118531ED4EA74892DD616D4B1323B27D3F9FF64F567D0F
Malicious:	false
Preview:	slpk a0.{y.S...H.......V...wR...W!/r<`.?..#.

C:\Program Files\AhnLab\Safe Transaction\asdsr.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	107584
Entropy (8bit):	6.739043600231051
Encrypted:	false
SSDEEP:	3072:a9PUEmgBKkTF3LL8yegP3RTVIvZ92S5xyB8MdVbYPnkSanxOzhRsM:anUgP3RTVIvZ92S5xy4nhRsM
MD5:	C3880F488A1C3E4585276B3D988D3865
SHA1:	6BB44166001EF53D83601E63889C2978EC48CA47
SHA-256:	6F6AA9AAE8006DD2B9767E1AE311A171F5423EEDF7B6BA60B418532F7AD95E11
SHA-512:	E39B36D1B2448BA6777584F494369C11CE339F097B6D034D2E91315AF56C8A9F800ED04D439E756490D784D9D13F98DC6C8EF6A06797F4E7471669F0A44081B0
Malicious:	false
Preview:	.............................?8..................`WAW@DWV?8..................................b@[DSFW.`WU[]\.?8..................`WAW@DWV?8?8...y]@WS\.?8..Y]my`?8......?8........................?8.....................................................................?8..............................qv.......................................................................?8.............................................................................................?8..........................................................................?8..................................................................................?8.......................................................................................?8.......................................................................................?8..........................................................?8...................................................................

C:\Program Files\AhnLab\Safe Transaction\astxverify64.dac

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 4213 bytes, 1 file, at 0x44 +A "astxverify64.daf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	15045
Entropy (8bit):	7.309565959654631
Encrypted:	false
SSDEEP:	384:UPkrSAcYqMIIYitv7XtLPxh8E9VF0NyH2H:3rS2RYitD9LPxWExU
MD5:	64935C224CC67758C80928AAAAC94E91
SHA1:	EE3666791A85BE10AA97F76B7F7EA144C031FDF1
SHA-256:	A3A59E3D4704317DEA5FBF8EBCC4AC388D9D7A8BD6BCD771BEDD8EF0F7F4DFCA
SHA-512:	AEDB49E48548B1DE1205017C22C076A01A7FD19D584C624E3706EEB706DD833B5867938C36FDB1DFA97AB1FAD52DD8784D4DFB70D0EA89C1C969E7D3ADE50C2C
Malicious:	false
Preview:	MSCF....u.......D...........................u...P*..........e.................DU:. .astxverify64.daf.mj[~....[\]..aostrust.dll=1,ecd20ee070fd8f0ec96033dd49a569bf8b50fc427b25d97caf2e1d5634871ff7..HsbCtl.dll=1,6ac3304fc9c8a6f4fdd8f06c8d6b36564c7221720a42d5748d190400c8c71fe0..IAccessible2Proxy.dll=1,9d30971f21a14cf7ea0e04eb70fc1b08903038fefc275b74fcd55e39ec23f687..NzBrcom.dll=1,c0bc98f6bec4833980dfbd8d85192b9ad9af77dc6c80dfef52a58025de312543..NzPlugin.dll=1,7717124cb6f5d87e64e20f97510cb14cf2bec36f7d560c85852d2704fc502413..PdCfg.dll=1,894351da16b15ed251441a9c859afb812491ae1acd91a3f39829e52714a7fb23..powapi.dll=1,c7a74cedc9e04d79d2de68edbcad9a96726c375179dc24d9e1ac0307cfdcbb02..StCli.exe=1,0ca7bfb5022796346780f441ac7dbe7369477f3fd8bec75de19f5bba09328ada..StCtInst.dll=1,f581e4492f3c8369bfb4d10ad63bbd5a1a56d86b6eac84c27e760ec2a2b5c710..StCtl.dll=1,576756155aa576960f059e78b5ab7de05889fe5cfc9ddf9714fd75b4ecfb53eb..StSdk.dll=1,4775a0f5eb9066da4ddd8ef63c35d30e77addb0b7d709722b9fade30d31daf1c..StS

C:\Program Files\AhnLab\Safe Transaction\atstrust.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1518864
Entropy (8bit):	6.484462666823553
Encrypted:	false
SSDEEP:	24576:4eS1GGiFpq+eEd2bDB5DG27ZBe7ZADilFQt+fK7gIPW:4a9elDvqeZstADilAb7DPW
MD5:	BEE2E36D611CB14C30A5914DF8F7CF6D
SHA1:	BC9DCAD97C50490A99DCEA0FFE2FB02FED174C53
SHA-256:	1D75DB1AC46419A30ECE944F65295731119928F9DE1EA5A3C9D0858BEE750881
SHA-512:	DE8E0EE6D146277841B79A418977B37FFEBA1A6CA153BCDE2EAFD18772FD6C350490FBA4D9DCC8B93ACABE37ACBF761A0D81197C3706900127F0B6DEFAF7719F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.._$...$...$...-...&...-...&...-...&....i..-...$.......-.....-...%...:...%...-...%...Rich$...........................PE..d....3b.........." .........>...............................................p.......q..............................................0...i.......x............@..X............ ..\|8...................................................................................text...A........................... ..`.rdata..............................@..@.data...xN..........................@....pdata..X....@......................@..@.rsrc...............................@..@.reloc..8E... ...F..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\ckwcfg.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.820525555536394
Encrypted:	false
SSDEEP:	24:0XEqwr9nycfo9Y3dSudVjiYa7t8C86se6XZtCC:0XEqHcfWu3jiYap8Ose6XfCC
MD5:	37C266BCE4AC53259F6F41930E719DD3
SHA1:	6D6DE703F60BA09013A66254F4E9DEEFEDA74F26
SHA-256:	84362862A9E8E036D773D7F52EBF54E5E26B184A28AC2977A7B4A8FDA08FC14C
SHA-512:	F67A822C14C7163391837C2C23337348E274B5A97A667FECF10AE9FBBBFC7FC0D8F2F1A5CD60C6B64321B5BC7B9DD9D1D663B32212264924DB12C9E7C2FC52A0
Malicious:	false
Preview:	Ai..............Y.D}...0.].T\|{p..b;...L...0....&... l..s.._v.QH....=.A.C.........&..\|....9%t.y....6...E..A...cj..fNhI..eL.P..w8.P.T....6...-..C.-D..t...[..'!CS(....U..8T.!../.3...c..."C.X.........!....z..\|u..:F.[.I.0....6....2N....5.s....M..V.E.^`./:...........b,.9..a..N..H3.4d....\.S..vJ..b...e...u.A.dQ...".S.g..=EJ......E.h.... ....8...1.fh.N.4^.4.....Y'.".C_._~.>%j..+.......JP\....XS.._rF..."....G.z.....4..Y.K...].vCx.U1.Pi.s...v&P...7S!N...A..o...f..Z.j..+h3.5..(...O....g...!...ol.w...Y,L.<.9z.Rt.GIjn....... .[.e....:.b.,...G...w..RRi.\2b.+E..../..1.T.....-tA.~.......%........_.'..f6p=}O..!:.OrMC..d.P'.vO.a28hb>$.e....o8..'.U.[].gh..q/;GI.A.....f.5W..\|.-NnM......H.J.z.........-v..\|.)G.....^j.P0...qHP.j.fW...Y.b.RR ..n.A.iy..T...GD.O.g`'...&..]Va..$c.^.}.t..pk.~...f.....R.D..f......9.';.d0wql...g3....v.#.)tZ4q1....m...5<.Ip.]..?V..@.....B..Ck.m.h.xC.7&.1..._M?...4...C./...W.lE\|..z..pU.[..<'rK...?.x.Zkf..'J...!.R/.....

C:\Program Files\AhnLab\Safe Transaction\drvinfo_astx.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Generic INItialization configuration [CKW]
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.001936411243482
Encrypted:	false
SSDEEP:	3:GB4ov3BRiowov2TmRwxvMSommNmSHTAlchCSGean:GHpR/duTmMkSomSlHTAKg
MD5:	2812C59D2913861499B7A5F298E1A8B0
SHA1:	A1B50D96372D7691F19BDBF9B5CFC5F1FEA00FBD
SHA-256:	8DAE59F22A89D386BAAB97BDD2F09CC3AC7086CB8E9A4F5FB00BD52F2BDC0447
SHA-512:	BF75333C5386E71AC3DD8C3AAF7B407499DCB5BF4CF8878C686CD76F3C465B309927F459E688FCF789B5BDA68B9F1D99270C9ABAF3A516C92494F5C8D374372D
Malicious:	false
Preview:	[Build]..BuildNumber = 10.3.0.30..State = 4..Version = 10.3.0.4....[CKW]..Commit = 97b84bfc351e4f02c009c428e7d3f082673b956d....

C:\Program Files\AhnLab\Safe Transaction\libacm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	211672
Entropy (8bit):	6.58144395919684
Encrypted:	false
SSDEEP:	6144:nKUI34zbdLXDus20QCGW9vFmDkVOP31Nrrr/5C42+2bfP/PGe8:1Uyd7ysmq+fr/h
MD5:	E79439AAD3716F569CE9030F73C59BDF
SHA1:	E6C414636AD1979CA5E94BB1691C7B9854285BF6
SHA-256:	20CC81891C94F827AB3845F2C9FC6083FFD53B587DFAFF425CC16379C3DAF2A6
SHA-512:	E751FFE4686B91ED5FEC446A3D740FD989D0271DE123EBB2927DC779CD8FD978FB5C7F5445088856A907817AA372FBBA3FFC56465DAEC0A04BDA9AEFB47253CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b............{U.....{S.....{E.....{B.................{O.....{T.....QR.....{W....Rich...........PE..d...z..\.........." .....p..........ty.......................................@............@.....................................................x.... ..L...............P>...0...... ................................................................................text...Ao.......p.................. ..`.rdata...Q.......R...t..............@..@.data...X...........................@....pdata..............................@..@.rsrc...L.... ......................@..@.reloc..$....0......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\license.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74417
Entropy (8bit):	4.988394074560754
Encrypted:	false
SSDEEP:	1536:lt4j5XX2cCmTOKyjTKV3OFYwT3JkMOFYwT3JAPWH99LZSZKizbZQzSju8i2H5IMV:H4j52eTOpjW3OnJ1OnJAs99tSZNztQz+
MD5:	D35CB60B236526758A014ADB783F93C6
SHA1:	28C94004CA7C5E26BA41BF3F1DC8DED5B7782121
SHA-256:	EEBDE7732A2DD1C4CC6402AC289718F12CE6BB2FD6F879F7604239D373BE2343
SHA-512:	6771E99EF52FF346BEF792609E47A846D32C7D1A8572424D244E042F6ABE2B8071E3A08DF2EB68B8F0418DC42694D3C793CF36108D09A673E67335A1EA90CB6C
Malicious:	false
Preview:	AhnLab Open Source Software Notice....Product Name : AhnLab Safe Transaction....Those products identified by the Product Type and Model Range above from AhnLab, Inc. ("AhnLab") contain the open..source software detailed below. Please refer to the indicated open source licenses (as are included following this notice) for..the terms and conditions of their use...The source code for the above may be obtained free of charge from AhnLab at http://opensource.ahnlab.com. AhnLab will also provide..open source code to you on CD-ROM for a charge covering the cost of performing such distribution (such as the cost of..media, shipping, and handling) upon email request to opensource@ahnlab.com...Please be informed that AhnLab products may contain open source software listed in the tables below.......AhnLab OpenSource Site : https://opensource.ahnlab.com..-----------------------------------------------------------------------------------------------------------------------------------....jsrsasign 7.

C:\Program Files\AhnLab\Safe Transaction\medcore.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3104080
Entropy (8bit):	5.673789288047187
Encrypted:	false
SSDEEP:	49152:nQXJus5VaIhvTN2tlQ/uwYaRQBsyHlFXWGNEwixZh8zfPXa:euaVaIhvTN2tva
MD5:	C365BAED8F41D9538627DC419F393E21
SHA1:	BA5343EF851047F184D02039D413D4AA4AA24EEE
SHA-256:	BA3099CE2A2429AEF245F743B3CC6FEA853F8C554F5A8F3A1E4DD63A6E46A719
SHA-512:	30DA0FD3E424193477FCA4AF1DBF4A99840660A5E2A1F30782B6B38E399845F879440A5D12AE1BDEF708A78FE61E038254A70116E4A913AD0EC024CE9C0A8B1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........KB..,..,..,.t_R..,..Q..,..W..,..-.+,..A.x,..B..,..V..,..P..,..T..,.Rich.*,.........................PE..d.....qb.........." .....2...........9........................................0.....D./..............................................B!.......!.T.......h.....-......:/.P#....0.h....\...............................................P..0............................text....0.......2.................. ..`.rdata..f....P.......6..............@..@.data...@q...P!..\...,!.............@....pdata........-.......,.............@..@.detourc."...`..."....-.............@..@.detourd.............0-.............@....rsrc...h............2-.............@..@.reloc...%....0..&..../.............@..B........................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medcored.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1113992
Entropy (8bit):	5.6353653873374245
Encrypted:	false
SSDEEP:	12288:F585sWni+esP7Wk5h1L5Mm9sDDXRID/GbnWTZOBrZX//9JD0FG6WTymh1:F586WnidsaCjLqKsZnWMfnrD0FXWOmh1
MD5:	E8BF43B8F034DF1BCF95068235181999
SHA1:	F30DCCE3E226554E0BD416EED73729032B65B73D
SHA-256:	2167ED8DF99D35C5C37C69D4E5988C87A5BF9D389F5B9445E653D10119C5E1E7
SHA-512:	71A5BED347B5D63FD5849769B0E28BF40027F7BB3AB41282B24E651720E7A7FC0DBD126CAA2F3A21943993F2607B7FE774D2633909DC92D9BCEBEB8CA227F606
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.j.,.j.,.j.Z/..!.j..t.-.j..t../.j.,.k...j..t..).j..t..(.j..t..".j..t..<.j..t..-.j..t..-.j.Rich,.j.................PE..d.....qb..........".........................................................................................................................d...<................6.......K...........$............................................... ...............................text............................... ..h.rdata...)... ...*..................@..H.data...h:...P...(...4..............@....pdata...6.......8...\..............@..HINIT....j........................... ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medext.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1320272
Entropy (8bit):	5.730601534772912
Encrypted:	false
SSDEEP:	12288:iXKzauLzhoGFTR4Lo/B9NbakB6nEdarwqv/c5PcOeyqsamdmbfk56Sq:P3LCGFeo/B9NbRS6ard/YcOeyRPdciq
MD5:	63497A48DFCBFBF7A9CE2C71E3B5287B
SHA1:	F2E21ADE738BFEA85DC1B10A61BE40E7FE508D5D
SHA-256:	F6A3A1CD632F59CC8B64A1A2B6A299A6DA3CD3DFA4170FDA8B8C938B6175FC1F
SHA-512:	1F343D1CFBAD090BC0617710ADB0BC11F9230C4A73F4F1807051F65C3BAAA0D2870EE806C432C6213895A7F5F2A1A6474C88EC0B2E9A63E4BAB8046DF05CF4CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2..2..2...G..2.....2..2..w2.....2.....2.....2.....2.....2.....2..Rich.2..................PE..d.....qb.........." .....f...........o.......................................`......d4......................................................<...x....0..........\|.......P#...@..........................................................H............................text....e.......f.................. ..`.rdata..oI.......J...j..............@..@.data...............................@....pdata..\|............`..............@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	916872
Entropy (8bit):	5.330590123069806
Encrypted:	false
SSDEEP:	12288:wWjs0lKZEnw2dGcxMKJbvYrCCw+1KAAJCvY9mJOPTeKGaXFit:9sBZcweGaMKxYNw+oFcOPTeKGiAt
MD5:	D298834CFA3C3578C199D0CB70078578
SHA1:	D40339B5C5D15A4149267291C8F8F47869E1E566
SHA-256:	67005AFF4AF890CB1DD57111BCF49D101A5F5337A6A45D7FF2845E7F1AC565B2
SHA-512:	CC4266993E490B0DC6CB4A6F84AEA4CE8D4282A551B21230131F0E68E32D9BEBAB53CA58738DC200F250997DCD76A3BBD11DB3BB6BBF77338C2BB174386124BE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: C:\Program Files\AhnLab\Safe Transaction\medvpdrv.sys, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:.V:.V:.VLq.V0.V.,V;.V..V9.V:.V..V..V?.V..V>.V..V5.V..V~.V..V;.V..V;.VRich:.V........................PE..d.....qb..........".........................................................................................................................d...<............P..8C.......K......0...P...................................................H............................text...8........................... ..h.rdata..............................@..H.data....<.......@..................@....pdata..8C...P...D...6..............@..HINIT....p............z.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medvphkd.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30088
Entropy (8bit):	6.6610493106344535
Encrypted:	false
SSDEEP:	384:XsxgFdjvyZZOie/k6h3KaJpQtR9zus2+UUnZsHLO8d6GsJck4i/8E9VF9Q1:XkgFdjvyZZOieb3K6QP9zueE3kreEk
MD5:	753DDB93CB353C4B667C44260F80C89E
SHA1:	D4B24F485777307FDDF0DA4248021C83027154A0
SHA-256:	3BEF5A6479FAF5A8DDEE51F1ADD028FC4650BBA9B26288FE49B4448444D8EF97
SHA-512:	91A671AD9C2AD3F3B9BBA5C6903CF1D8F04AFBA66BD3A8C651BE01FCBF49E3948D0D808EC0AD07386FF62CAA9F8E0AF1E12E85F367F38C0338A04A1B6B405AEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..4...4...4...4...4......4......4......4..m;...4......4..Rich.4..................PE..d...3.qb.........."..........$.......P..............................................L......................................................lP..(....`.......@..........K...p....... ............................................... ...............................text............................... ..h.rdata..\.... ......................@..H.data........0......................@....pdata.......@....... ..............@..HINIT.........P.......".............. ....rsrc........`.......$..............@..B.reloc..V....p.......(..............@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medvphku.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1681744
Entropy (8bit):	6.82846077353633
Encrypted:	false
SSDEEP:	24576:AX6gIs3/IevRBQa8p3oWxUp1kPaHeGeizSs93j1esf1uJFR4Xy+N3amR2ADmZ+4G:be7CZpxM1saHeiz9sJT4TKmRD
MD5:	AEDFAF7F50EA15EEAE8ECDB1EAAD922B
SHA1:	74B8263BD10BBF2DDE3335DEC4D5319056B6B849
SHA-256:	1E13664B5B43298F8045C19E350CA34F8653BCA08A87202EBEFAE18F670B7686
SHA-512:	095F13F5EBF18B642062C8B4930DFFA1198803A89359B32529209047DE1DC90CD969E713B853C6C25BCFF9535A6D927F696EB5F0EEBA16C7167548978BEEFCF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u..u..u.9....u...t..u..Z...u..t.!.u..Z...u..Z...u..Z....u..Z...u..Z...u..Z...u.Rich..u.................PE..d...A.qb.........." ................@>.......................................@......................................................P6..A...t#.......0..........D(......P#..............................................................x............................text............................... ..`.rdata...F.......H..................@..@.data...@....@......................@....pdata...'...@...(..................@..@.detourc."...p..."..................@..@.detourd............................@....UPX0....V.......X..................`..h.reloc...............n..............@..@.rsrc........0......................@..@................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\medvphkuw6.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1038672
Entropy (8bit):	6.916221327981851
Encrypted:	false
SSDEEP:	24576:Nh/J9GdXHSQzdMitDhQzTvqyT3PAJZqZ9fnNgHB4s745:f83SUMchQfyM3eaRNCBs5
MD5:	B51CA53F18CAF267A6913A7377A64F14
SHA1:	9FC53AE7E0FA52A035AF5AC0D12B26CFF08EACBF
SHA-256:	1A4DE61B015AEBBD7BE9E96D0E47A83DAD2296FB19991D9B0F433A7B7166AA07
SHA-512:	4A2FE610AFC7A9BBF48698DE1DDC720A26D5998F4EA298B6A0F64D864818E6E10CC5DCC696689098F86A922BC61BABED9523F887CBF13A56D88C349D32C89D65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............rvZ.rvZ.rvZ.nzZ.rvZGnxZ.rvZS,w[.rvZ.}+Z.rvZ.rwZorvZ.T}Z.rvZ.T\|Z.rvZ.tpZ.rvZ;RrZ.rvZRich.rvZ........................PE..L.....qb...........!...............#;.......................................P...................................... ...A...p........@..................P#.......4...................................................................................text............................... ..`.rdata..a#.......$..................@..@.data...........p..................@....detourc...........................@....detourd.............<..............@....UPX0....:.......<...>..............`..`.reloc...4.......6...z..............@..@.rsrc........@......................@..@........................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\mfc90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5102400
Entropy (8bit):	6.535339741970271
Encrypted:	false
SSDEEP:	98304:RyPTkdgKaQ0cAneLY6ODI0CTwpFLOAkGkzdnEVEFoKGj:8PTkpaQ9A6OFLOyEFoKGj
MD5:	E9017D8024BD96E95791DB3957C4230A
SHA1:	BEDE8B3D956308D29BFF23D252451D14D37942F2
SHA-256:	ACAC07A57604EF73B013F127CA39876B4F33027102819214389F9B2652E0BD9D
SHA-512:	CF99D660B619AE037C952E1F574B8D38F031E70E56046863689510F183687F48C36D2DAEBBB31B25ECE4FC7D99DC3A1A32C1973F793EC4915C9D10701353ABFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..........q......q.............~.....................q.......................I........................Rich...........................PE..d....gYJ.........." .....Z)...$.....\|.&........x..............................N.....w`N...@...........................................7.'...`q7.......<. l....9.......M.@.....M..F....)..............................................p).X...pK7......................text....X)......Z)................. ..`.rdata.......p)......^).............@..@.data...(@....8......h8.............@....pdata........9.......9.............@..@.rsrc... l....<..n....;.............@..@.reloc...u....M..v...NL.............@..B........................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	853312
Entropy (8bit):	6.345193364377354
Encrypted:	false
SSDEEP:	24576:ag5ni6keQ77yaNSroZMESNwDEKZm+hWodEEF8Z:asn39W0
MD5:	DFEF29DD8EB0542C31469DE7C5886053
SHA1:	41326EDC6B6DA6DF2184292D19E94D7978F8629F
SHA-256:	7EE97643CFEDA8A79B7CAFA5EF3A010B2F85EF868356D30D7EE09AF8E85FF38A
SHA-512:	6A714CE91DE7FCB063610908B68FF4FE6781219DB2BB1EA3E370FBF52CFF4639CFDA845BAE57A8DB0750E6027CFB591F943F4793C0430E6EFFC221EAA077B0B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..c+{.0+{.0+{.0...0){.0".~0({.0+{.0.{.0.4{0{.0".x0{.0".i0.{.0".n0.{.0"..0{.0".y0{.0".\|0*{.0Rich+{.0................PE..d...CNYJ.........." .....N...................Rx.............................0.......T....@..........................................C.......6..<................q......@.... .......f...............................................`..@............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data...P9...P...&...B..............@....pdata...q.......r...h..............@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	624448
Entropy (8bit):	6.583477769791977
Encrypted:	false
SSDEEP:	12288:BIyThtSXwAnAJGaAx8eCte8P8qhzNZppK5E2WeAI99aWmqy7QMz:BIyThEXfn+G9zCtb0mpc5E2WeAI9mqyf
MD5:	E4C2344E31D3C577FB2723C961069858
SHA1:	572F0281081BBB7A87E491D32B4A29E2447CD75E
SHA-256:	4546EB9106E86E471CAF0870ACDD4D1FE34C2AD293F596FD55B82215B922AE14
SHA-512:	7F35D0F0BF6DCFB44A1CD7E07F95536010690722FD28D587450F158F87BE0913F210B06EFCEB87D63BDAF4DAD4ECC09A4CF7397F64C5284A36579A133CFD5BA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................'..........r....B.-....T......E.n....S......U......P.....Rich............PE..d...=NYJ.........." .....p...&.......&........bx.....................................\|....@..........................................q..Cx..._..(............`...D...p..@............................................................... ............................text....n.......p.................. ..`.rdata..Si.......j...t..............@..@.data....d.......<..................@....pdata...D...`...F..................@..@.rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\mupdate2.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.56995557944874
Encrypted:	false
SSDEEP:	12:accOzWKm5cFon2GpQtR5k/x1YmgQ+ptNtLxQMudq:ZWd5cunhatg7YI0tHl4dq
MD5:	3065EC9B71C89C655CAFFB88B3EA143D
SHA1:	F3071EFE6D53644EE63C06AC22B2A91F5DF16E19
SHA-256:	246F61291D7666022A029CE5BD1C328B0C20BCC3C1F2E56E432BC8737C7EDE53
SHA-512:	5BB616EDF28675CED6FD40E671DC2D5F12118FF215BE27F1F838DFCBAE165BDA319F963932CBBCEB6233BCE88FDBF9DD55BBF9172F138CC5EE628179E6BD0126
Malicious:	false
Preview:	.%~^.c#w{.=.-.v..2......8....._x.....z."\K.1/o....%...P6.....D./.`.K.@..^Cv...8F.K.......y.....e.{.a...!........u...,._\.H.$.L...(..d..A..7j..2...#.tb..{.h...-.A.9%....~.g..h..f.H.F...XN.:Y.8c.9..yZ.....c..1.P.[PC.]...)..2..T.'....\|.....G.....X...e'.s-?@.2_......T.....(OC.WS.;.....-....7..{EIN...>t.'W........~W..G...~.\|1......i...b..2..Y....k.w..8..n..I..A..58.w...s.=.Y.c...Qf....O......8.dM.E.....&A#.6.k...Y\|.Ao.5F...O...D...q.....

C:\Program Files\AhnLab\Safe Transaction\powapi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158744
Entropy (8bit):	6.251439316264388
Encrypted:	false
SSDEEP:	3072:Obzd9NfQRQKZd634mGOfMqqDL2/z0Ay0rP/OlehgN42tV0Ml:md9kdNVqqDL6nOlehgN5Dp
MD5:	631BB12D4CEA2E01D072452E6BA69A26
SHA1:	7B03C8428D4CCAA902B1A0EE231E942874BC79B9
SHA-256:	C7A74CEDC9E04D79D2DE68EDBCAD9A96726C375179DC24D9E1AC0307CFDCBB02
SHA-512:	1900A618E89720A411CE13440557D5184CD68DC00E4EA8032088FD848522B6DABE184225CE99776DB07749AEA061A1C4CB4CB173FA54705100957945824FD032
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Io.(.y.(.y.(.y..zy.(.yMg.y.(.y.P.y.(.y.P.y.(.y.P.y.(.y.P.y.(.y.(.y.).y.P.y.(.y.P.y.(.y.z.y.(.y.P.y.(.yRich.(.y................PE..d...w..c.........." .....<...........%...............................................L....@..........................................!..J............p.......P..h....B..............X...............................................P...............................text....:.......<.................. ..`.rdata..J....P.......@..............@..@.data........0......................@....pdata..h....P......................@..@.rsrc........p.......2..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\trueeyesu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1255168
Entropy (8bit):	7.031795624450013
Encrypted:	false
SSDEEP:	24576:CQiGWaZW6nCdcKjKuy3xe3jrmsiCEGsHy6Jf4938gDW9X0:CEWaNCdcK2u6kPmcPRR1ZDZ
MD5:	B21244B6FFD05B4402AF7560F6305A04
SHA1:	1A5110F3FBE2F4D10A2681ADD544243A6138F5A3
SHA-256:	0D216D7B2666962A1D0897E61924D802F05864C40050B026F2A07B15549DC351
SHA-512:	8AA1B053DD92A0B0CD5E7A6A343675B38ABC5F4BAAE3E62D87C3F66B78CC2547FCC969405BEB0590A83AEB09390486E9054975EB8EFE24794B0F1234D183182B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>..r`...>...V..>.......>...>...>.......>.......>.......>..Rich.>..................PE..d...*a.b.........." .....^...B.......,.......................................p...............................................................w..<....`.......=..<............P.......q...............................................p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data...T............n..............@....pdata..p............p..............@..@.detourc.!......."...v..............@..@.detourd............................@....UPX0....c.......d..................`..h.reloc.......P......................@..@.rsrc........`......................@..@........................................................................................................................................................

C:\Program Files\AhnLab\Safe Transaction\tsmime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93264
Entropy (8bit):	6.542990111685332
Encrypted:	false
SSDEEP:	1536:hIPVhmws1JhKB7slvjhdv7hc4Esas6WE+UqKq66rMCYgHbIKc30l/0A:aGQKv7qU6WE0Kq66gC9HbIx30l/0A
MD5:	A917BBF825CA674F036EB74A8BF7A3E4
SHA1:	73FA7B54EC4B039878F4746DDD911D473ACE82A8
SHA-256:	4B03CFBDC356F7EFBDE3EC9C638772330D46832B749DB31794BB5FA4F1A3416F
SHA-512:	DA4200203D56D9E9A2BD2EA0BB467732CE09FAAD4C20012F36144BEB0E710C60C74AD2099121B650E00E1137E145787D1B1C4B4D56BD585229EE5F873ED86906
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....r.H.r.H.r.H...H.r.H...H.r.H...H.r.H...H.r.H8..H.r.H.r.HZr.H...H.r.H...H.r.H. .H.r.H...H.r.HRich.r.H................PE..d...JL]\.........." .........R......d........................................p......<.....@.........................................."..m.......<....P.......@..........P>...`.......................................................................................text...Q........................... ..`.rdata...3.......4..................@..@.data...P....0......................@....pdata.......@......................@..@.rsrc........P.......&..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\AhnI2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	172640
Entropy (8bit):	6.286560856048801
Encrypted:	false
SSDEEP:	3072:cS4Izi2X42powDxQ4BV3iGoe+xCUau3C1pH8yRWOlGfWnPxwv/40dp:YIzi2I2poCLu3CqOlGfWPxuVX
MD5:	33DA77B3C14C52303EF2B53BAD36011E
SHA1:	370DE630780DF5F5AB23377D94D58344CB5C8B02
SHA-256:	FA920768F1A23405636D9F6165E6592C9B3A55E27C5B19F27FA80A564A6C15A3
SHA-512:	FFEE1466A1E23F0FAB7FB886BDC065F28E108A4AF2B8A5F2541917F2C13372D678491FD1AC79A65A89EAA2D6C8A6645216FDD82FB933108E5849F458592A6087
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5\..[...[...[.......[.......[.3.....[.......[..J ...[...Z.8.[.......[.......[.......[.......[.......[.Rich..[.................PE..d......[.........." ................p[.............................................../....@........................................../.......................p.......d..`>..............................................................8............................text............................... ..`.rdata...h.......j..................@..@.data...x#...@......................@....pdata.......p.......H..............@..@.rsrc................Z..............@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\BldInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.959459707035537
Encrypted:	false
SSDEEP:	3:GB4ov3BRPNVLNxsusUmdOrMdZJBROdwIfFLsXLQsyxNVFy:GHpRFBNKfB/ROdwIfALQBJFy
MD5:	6E09B169BB08A70212D98F986F9FF33D
SHA1:	67CB1E75D9899919F0E0212726B8063F775799AB
SHA-256:	AB52A3BE3659C59E4DF91A0933EAD0F0ACBB740A089AA2B881126CF70767BED2
SHA-512:	EE99857655DABB27986428CEEBEECBC77054592D8BDEBBB3F10787BDB58100BF37D91DE0D5E7DC756566C4C5E84940CD1133EEEC0785E5534DD2B713B109D0A9
Malicious:	false
Preview:	[Build]..BuildNumber=1.7.0.1630..State=4..Version=1.7.0.4..[ASDFBuild] ..BuildNumber=2.5.81.1435 ..State=6 ..Version=2.5.81.6 ..UpdateVersion=0 ..

C:\ProgramData\AhnLab\AIS\SafeTransaction\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	5.38478122745935
Encrypted:	false
SSDEEP:	48:3SlK+vU6gaAg09kkKb+Ezo09kkK/zzbK5C09kkKsrzY:Clt8UAgXk8+E8Xkaz/MCXkJ8
MD5:	A806C2A878EBCAA97F095E204AD23527
SHA1:	83EB34D7CED2B9DC71DBB849AA21EA78EC45A78C
SHA-256:	6B737568E1A12AB56EA091427B691B0FB5391997EBBDC4353C4ABDD2786E110B
SHA-512:	52149492ED4FF37115CB8D16203BE2419B692074824EDE86647CBC1B9CAA46D23E04C9C9D8979E512EE09933D46F69B7B384678E05B74ABEDB81BB9AB6917263
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="1b065fdf0cb8516b0553128eae4af39c5f8eeb46"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Vy8CgQgbu3qH5JHTK0op4kR8114=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="45d3027d87eade77317e92994790598c755b3920"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

C:\ProgramData\AhnLab\AIS\SafeTransaction\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	5.368010340567118
Encrypted:	false
SSDEEP:	48:3SlK++U6gdeB09kkKLzs09kkKDIzZOs09kkKJnzE09kkKK3MgzY:CltFD6Xk24XkBUsXkEnwXkpMg8
MD5:	EF0ED5B8F33C0B526101778EB14651F4
SHA1:	59FC443FE4A93669ACE0F59FA7986BC9A04A400A
SHA-256:	0E840B3AEA14A2DD7F84E0E6A923ED4B40EB139BECC2941C2D67A395DA26879C
SHA-512:	C0AEB711A3DC8C074577EB64433545A05DFD7BAB1259AECDD10FE2DC54BFC45463CE62D70C21302F3F136FF10E4FF48DDEE4F51CF018CD162D7FBC3834802BB4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="7a86bbafeb8fab5ec5e6b34f226cde1ce9a1ae9b"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>jknaTCuYm0hCeoiYG7L8EtQPel4=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="1817389f2b3d7b9fe5c4468c6592c536a5c2b842"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

C:\ProgramData\AhnLab\AIS\SafeTransaction\NzInst.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	950296
Entropy (8bit):	6.715241814776746
Encrypted:	false
SSDEEP:	24576:+HEScP9+67jL5XqjowYEF0ybLdJIQYJQo:zEEjL5ajPFfGQYJv
MD5:	F380128EFE73C2896CC50ABC0BEB5FDE
SHA1:	FFF334A03B7D3B67F4C8C9BFF31C2DE1626FBC80
SHA-256:	5AF161C4FB7C3522FAB909AD03A05456C05DFD968A328CF317B3FADD3EB9C933
SHA-512:	A4438839C43FE61F86D843746C4B3B02AC52E20DF6175EEFCDBC8B3714816EA672B3E69B94CB5D0133AC1BF817D6B5AA671D43FAABA1FC3A47BC62B9DA4C9D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........r.I..}I..}I..}W.}L..}nxq}J..}nx.}J..}..}O..}@.}K..}@.}F..}@.}O..}?#r}H..}?#q}M..}nxg}T..}I..}X..}@.}{..}@.}...}@.}H..}W.}H..}@.}H..}RichI..}................PE..d......c.........." .........:............................................... ......4L....@..........................................G......(#....... ...........6...V...*......@....<...............................................0..h............................text...~........................... ..`.rdata.......0......................@..@.data...H....P.......8..............@....pdata...6.......8..."..............@..@.rsrc........ .......Z..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\mfc90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5102400
Entropy (8bit):	6.535339741970271
Encrypted:	false
SSDEEP:	98304:RyPTkdgKaQ0cAneLY6ODI0CTwpFLOAkGkzdnEVEFoKGj:8PTkpaQ9A6OFLOyEFoKGj
MD5:	E9017D8024BD96E95791DB3957C4230A
SHA1:	BEDE8B3D956308D29BFF23D252451D14D37942F2
SHA-256:	ACAC07A57604EF73B013F127CA39876B4F33027102819214389F9B2652E0BD9D
SHA-512:	CF99D660B619AE037C952E1F574B8D38F031E70E56046863689510F183687F48C36D2DAEBBB31B25ECE4FC7D99DC3A1A32C1973F793EC4915C9D10701353ABFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..........q......q.............~.....................q.......................I........................Rich...........................PE..d....gYJ.........." .....Z)...$.....\|.&........x..............................N.....w`N...@...........................................7.'...`q7.......<. l....9.......M.@.....M..F....)..............................................p).X...pK7......................text....X)......Z)................. ..`.rdata.......p)......^).............@..@.data...(@....8......h8.............@....pdata........9.......9.............@..@.rsrc... l....<..n....;.............@..@.reloc...u....M..v...NL.............@..B........................................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcm90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.009895182248049
Encrypted:	false
SSDEEP:	3072:IiN/Dv33XymC2FL/uqll+m2a1tQ2VQOkd61IvwSRm3+rYOpcWRq:IOD3xLca1t7VQPd61ORmOrYOp7
MD5:	E6E1B7ADEED68FC899703F79EF980401
SHA1:	D6BBAA17BFCBFA6D6DAA7255B1C68EB4D44D1C81
SHA-256:	C18ADC99C097230222063AA264D69841183B949EBA5CD51C73B73D4011EB61D3
SHA-512:	2DD151CFD8174250FE0217EB4E22914AFD14EA9A9FF35F4424D230191917066C79CCB8057D24C476E8722A3EB119CEA4F6D40C4494CE15206327BC156588305D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S.n.S.n.S.n.Z...P.n....R.n.Z...R.n.7...Q.n.t<..W.n.S.o...n.Z..._.n.Z...6.n.Z...R.n.Z...R.n.Z...R.n.RichS.n.........................PE..d...MNYJ.........." ..........................Hx..........................................@.........................................`.......\...d...............D....................0............................................... ..@............0..H............text............................... ..`.nep................................ ..`.rdata....... ......................@..@.data...8...........................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	853312
Entropy (8bit):	6.345193364377354
Encrypted:	false
SSDEEP:	24576:ag5ni6keQ77yaNSroZMESNwDEKZm+hWodEEF8Z:asn39W0
MD5:	DFEF29DD8EB0542C31469DE7C5886053
SHA1:	41326EDC6B6DA6DF2184292D19E94D7978F8629F
SHA-256:	7EE97643CFEDA8A79B7CAFA5EF3A010B2F85EF868356D30D7EE09AF8E85FF38A
SHA-512:	6A714CE91DE7FCB063610908B68FF4FE6781219DB2BB1EA3E370FBF52CFF4639CFDA845BAE57A8DB0750E6027CFB591F943F4793C0430E6EFFC221EAA077B0B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..c+{.0+{.0+{.0...0){.0".~0({.0+{.0.{.0.4{0{.0".x0{.0".i0.{.0".n0.{.0"..0{.0".y0{.0".\|0*{.0Rich+{.0................PE..d...CNYJ.........." .....N...................Rx.............................0.......T....@..........................................C.......6..<................q......@.... .......f...............................................`..@............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data...P9...P...&...B..............@....pdata...q.......r...h..............@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\AhnLab\AIS\SafeTransaction\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	624448
Entropy (8bit):	6.583477769791977
Encrypted:	false
SSDEEP:	12288:BIyThtSXwAnAJGaAx8eCte8P8qhzNZppK5E2WeAI99aWmqy7QMz:BIyThEXfn+G9zCtb0mpc5E2WeAI9mqyf
MD5:	E4C2344E31D3C577FB2723C961069858
SHA1:	572F0281081BBB7A87E491D32B4A29E2447CD75E
SHA-256:	4546EB9106E86E471CAF0870ACDD4D1FE34C2AD293F596FD55B82215B922AE14
SHA-512:	7F35D0F0BF6DCFB44A1CD7E07F95536010690722FD28D587450F158F87BE0913F210B06EFCEB87D63BDAF4DAD4ECC09A4CF7397F64C5284A36579A133CFD5BA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................'..........r....B.-....T......E.n....S......U......P.....Rich............PE..d...=NYJ.........." .....p...&.......&........bx.....................................\|....@..........................................q..Cx..._..(............`...D...p..@............................................................... ............................text....n.......p.................. ..`.rdata..Si.......j...t..............@..@.data....d.......<..................@....pdata...D...`...F..................@..@.rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\AhnSec.dat

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	7.866283166661573
Encrypted:	false
SSDEEP:	24:q3WsMtiVIruaYU2N2MegPAWhq2E0wquykxWikkS2wcJkMeuwe5VkJeK:qKsVmuaYU2NJeg4z2pwlykxBkkS+J3gd
MD5:	3582778BF80A1D0A963BEDDEF30A7E8B
SHA1:	F023052D0DB347DB482D5086EFABCD93AA7281CB
SHA-256:	D1BDE04010021E505376642A86807B1E4C55D3664D9229ABB63C1CF73D1BADA6
SHA-512:	E36A85DADFD9AA5DA13AFADFD88E5C25F3890158D69316170ACDD31126CD5B4F1C0326C73242EE2B9A068392F06BAC29699CA28EFCAB7EBC702199849F87B130
Malicious:	false
Preview:	..'....s.H..J..q...AD....M..5a.......v.H1L.<@.w....T......Hl\.M...T..A.DJ....B.,._9...[.M...O.Od..8..A...>>.w..o..A...Y...Kp...9..L.n.......#.N6.}....._6;.....BS....}KZ...<...[..}.8c!.t....Y..m..p.".;4@i&..^.5x..O.J.'..AvsXY~[.j........%.u..#....W..E{r.B..o..6..^.0<\.....F.p.. .#I....#...@.j....[I..xkD...^4~.^..{$aX....^R...........0..6N........L.r..SIa+.Q.JH.[.n.....x.#i...7.R..m.....f.'..ly.P.)u..T?%....T_.....d...>...r/N..J.b.:N...J'.V.g......K.......y..d.X.=Y..%....}.<.&).P.c.K.._.7.+..s.:.9{.[..(al&?].cw......I...6....f..}C..!.cf........f.q.Z&.A.....5>.5/Ed..3...b.&.Sue.o...%m....-f_.J....C.Qjy ............=O...S.DQ......g.m..eBS..Z..85....Q.'.!.?L................\|..$L .k...J.U..D..8.#.c.0;.gb. ....,D.*.)f.t..IF4SJ..;....B%p.q.oe..Q.p.p.h...J...H!u.t..3.Pk..JP...[...C.)0U.k..\|,L.].....a...N\....;.......&{yB.Z.cs..e..`....!.B^.r.G'-q.w"..Q..>.....:.8.......8.....f.{T...?b..tB...<).(.GZ..c.9.7....k>..;.5.%..zq'....T..r.a.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\BldInfo.ini

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.959459707035537
Encrypted:	false
SSDEEP:	3:GB4ov3BRPNVLNxsusUmdOrMdZJBROdwIfFLsXLQsyxNVFy:GHpRFBNKfB/ROdwIfALQBJFy
MD5:	6E09B169BB08A70212D98F986F9FF33D
SHA1:	67CB1E75D9899919F0E0212726B8063F775799AB
SHA-256:	AB52A3BE3659C59E4DF91A0933EAD0F0ACBB740A089AA2B881126CF70767BED2
SHA-512:	EE99857655DABB27986428CEEBEECBC77054592D8BDEBBB3F10787BDB58100BF37D91DE0D5E7DC756566C4C5E84940CD1133EEEC0785E5534DD2B713B109D0A9
Malicious:	false
Preview:	[Build]..BuildNumber=1.7.0.1630..State=4..Version=1.7.0.4..[ASDFBuild] ..BuildNumber=2.5.81.1435 ..State=6 ..Version=2.5.81.6 ..UpdateVersion=0 ..

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_arm64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	1850137
Entropy (8bit):	7.999873896919295
Encrypted:	true
SSDEEP:	49152:tvzXSKdVHrlygSOKCY/Xe/DJuIJUZgu47OC:lD3HrlvcCaauIJUZ8/
MD5:	CF6C8DCCFCB3C5C551F2FCFCA550CB11
SHA1:	A27AFFF3F8B2DA95E9E0186E08044D0D1D5796DC
SHA-256:	4AC997209D57B8E624B157485210E796FDC952E26E10D0A8FEE45CBDF584E419
SHA-512:	47CA20D17A87B353621DFA5670F044A3929282DDF982909BEECEB91B05BC67247E4D887E91BABF6299B86D522B4C58D928D0AB5A361CA7D1E09680248F4D37F7
Malicious:	true
Preview:	7z..'......9.:......$.......f....&..p.........../D.\|...!.6.uc..L..BW..............~..4.+mW....#.{...u..Z.t.'.r....}E.....D.....h..HO...x..S..../C...O.3.........<.<..{&...&...PLn.....\.>B<H,aS...R#..-_.......e.;...x.A..c_k.R.PG.Xl.F..L2xC..^.1Ns.q.E.{.."@&...C....$WwH..\b....[...l.............&)'M........9..lW...p..A.....^..YM}.Z..L....d.8.aV..N.2rbx..XN[...G..%X..c.z..qy..s.)t;r..E.......i\.t...a.W.2B..jI.R[....h....K...t...NyH....f.W..x3.i.3..~...q.].@,...!3..F.k.:b.....jl..q...]..8.(.)..C?.u.:..p...;.-..I.R.....F.L...w].#.....$.+..o..S.\|....N?/..u......R....)...xV~.o.w.<J...P6j.#p..q..%g5..Vg./~.Gt....&\|rh&..P..PgY.$"daf.q..m..$..o....w.......J..GG~vk.........B.#...'.......j.W!(.....V.x/....R...%..q.f.y..P.d.....E..Y..RO.)....<~X`C......YIEh...k.c7.X}./.L.".u...1mi}..(&..$`..@G.......1....:E....).5.4..b`...J...;...qS.\|7.3.t.;..-...}..vW...^...-..tr....d...7......w......\|...%....}.6..e.7.....H..$..&.$..^....3./~.v..C..D..+.Ha.r~NX.,`})......`.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_com.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	2469224
Entropy (8bit):	7.9999242500677985
Encrypted:	true
SSDEEP:	49152:XKxYprJxIIGGFqrFPXPaUSsdOfWl5yH03gUqtyra:XOYpVxIqUr8U8WLEU2yra
MD5:	02B0F04989022D749D42CD7DBF28FB4D
SHA1:	85F53A67F85CC441A4CE2C80AE1C82F8BE293498
SHA-256:	F2A3856AB7DD96B3C3DB462FBB88359318B4011BC427F1DFE5472C9FFCD7290F
SHA-512:	DBA1D0C73EEDEC8C4D029B6B65AC49C962946EE18CA4AA6FF4CC723EFD020482FDCC23062B11D795D9347A6F50A662399FC45FDD902A45C82E2673AFAEA4EC0C
Malicious:	true
Preview:	7z..'...6A..#.%.....%.......M..5.I...Qi..n....5.,..}..\....R=........2...Y..\|.U.Di.+....<..@s..p0....pG.. ..oeZJ..1.7.H....7...aK+.(...S..z".J..E...r..E6K..QX.XpO.Q.8.. ...>.r.b........\=..a.a.7....q.d..M..5...R{..t.I....~...`O1....TF3.oF.`#..vq.d...K.7.8.f...1...J..d..s.....?.>.......t.....G...9..}D....J.$...g......1K...ACf...8..h..{B.PlW..c...MI(.J.. ....".ir.(..i..BR...?.O....U.'..f.....P..t%..O._..#..$v.j..dV.GV.t7D..?.b.a.%?.%V$.....zW.e.j.!....Y..j......".2*.-.3.{!...F......(zQH.d.......un_M.W.rn_............'....pE....`.D...c..}.s...Q4....o;7.}.!K..r3d...+......;"....7 ..[.A...)...d.J&u.....x{....5Z..7....>U..b...G.....3?4{.;v..LO2.!sS.l...C..\41.....p.b}<.H......./V10.~..$......}.s..I-...J.7uS.....5s...4a...r..c.o..V.w~..%T!....k.._......1.&.t.5.}..y.(....s..$...)...``...`.....M.XK...T.R4.wK.?..~.{...2..].u".ng..../.X....B.X..Z.5n..e.;.....(......,^e&9....<..N.d.>M...6..l4...Z).T........c...g..".pv..\|...s/.....9.....A.F% =<....j..wD.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_nt32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3685778
Entropy (8bit):	7.999945810274197
Encrypted:	true
SSDEEP:	98304:lnq4/0R+q3wVve3bJekjAmNZvsq21g3V5vp:lnqERE3lekTN5Rz5vp
MD5:	ECDA8C1792A62CCDBACAF0912BC11377
SHA1:	4B8297BEE3AB1B8B12D2CEBCBAD22A917E27178F
SHA-256:	4AB3349A6DF5C2526BAF512AD1B2D0F7EE0EE52C8CD0D67974AFFFDBCD70EE34
SHA-512:	CEAD45830450E86D8E4C45E52A22B064B89257F922479F11224AD6300D73A53F0806C70616FC4FCAC83C215BEFD642BED27CB4469A0D32706EA9B75379B0EE2E
Malicious:	true
Preview:	7z..'.....<.M=8.....%........q!..&..p.........../D.\|...).1...../Aq..k..Lx#..t.8..Kp...s.._.gr=N.`9....?.O.gp.0.7..y^..1.C H.2..E.}.i\.....o.n.......G..;qf..#.../....xE......S..6%....".C..R,.;..f.V.....Y.q"<umi..4......k.....p...7.:}..M.1.Jq...A.k5s.L..[.fH6WA&...D.{-W8RF.B....l.lV.....-...%.QI..$M...)j...?..?].........V.F.kT..3.......I....;...\....;.2.O...R.i.5Iu.l.d.....f...>.#....F.j.(.N.'4.....>.U...>.....A....'.....?...n....Z./.p.....5....3z.#53Ww.\|+.#. ..`0....2...}...me..(u../....Q(..9A.....J...p5.D.....a..L(..!`.==.:+....i..BLW}.Bu...s.......r.e.Shv..G._1\Q._...>.Jh...I0.O.p.oI...#...._..D...%..9.\..w...;#.!\|....@..C..z..b..\4oPg...f..}../.j(.....>..c,...4..R."...4..?Es..r..x....#x...\Q.A.6.t.RC.Y.^.....D..X.......S...3..s..g-.8K1d.........`n..O.D.U....,.....+.].......,+.......+.!.. .\=.}'..i.`.L.....C[.;.o."..>........G.6....\..........t..z....k:.A.9.......H..0yf.c......d>...M..\JY.GV..F...E.P...P..B.-..[.BY..4.AY.o.>H@.q$.$.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\Engine\med_x64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	5131724
Entropy (8bit):	7.999963679776346
Encrypted:	true
SSDEEP:	98304:77XdjOF3NuLMF55DgmsKlJnEuM3pOIjZbWBMYQma8dvBDH/7:VmuLMF52Vc8dNCMQdHD
MD5:	343991C3DE2D4E5C35B72413D68B09FD
SHA1:	2D8F5C85DA7742B1E7F45E9F78FCB4EB6B1B69EE
SHA-256:	E06D472B9D5198A6E059E111E7896FBCBDEEA3538274C42B790486201F84B2BC
SHA-512:	9D64EB78751FC3DC0B79173DE7973CBF0937A9CC2614C81795DD4A2442141F9A35264EE3EFD02845FD587953408F5A5AB8BC0501902EF86E49FC2350CA7EDF1B
Malicious:	true
Preview:	7z..'........MN.....%........5X..&..p.........../D.\|...).1...../Aq..k..Lx#..t.8..Kp...s.._.gr=N.`9....?.O.gp.0.7..yb,HF..w.#.......g..w.V.1...z.T.].fM.n.A.j.V?.m.x...C.T...#...~q.!.....~.....F.........y3z.uZ..K......F...#<I.<.....Y.......&..G.....>......<.r..pB.NrV\|0..0.......2..^.......\|7..'..NM.=).i...ghN.oO.B!!b......B...k.?...0wMA. J...S....[k..2.v.!1..kN1.Iu...:...I-S..`.@.s...F.T:.ex.........3...;.....q.....?qr.....J.Jxc.o.."O...:..G....4.N..uA.$.K.P}.+mgq.s.....F.B..%`.\...xf....N.....S.mW..V.C.V!.Fs...g.^w..1}$.P...w...<....'cF...W.......UzI.\|.......k..7S...c...(Tgm..;....:........A.A...l...g@.o........k...2...C..L.G.....C..`.j.....nC.....:.8>..........A..a...L.;^......w`..W.5..........rU.3..:..E....~.=.....m[..5?.....I.ig`..!...T@.d.B..i.....be.$....b~<.x.}gkR...Y..y..u.5......O..V..&.....S0..N........M.E.x...#.....H\|.k.......y..o...I..>~...C.cEX#?C.9.M./`...`@.....ix4)..5Z.k.=.v...*.M.i`.......f..r..c...J..a.....+.<.f.......

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1294968
Entropy (8bit):	7.969045132579768
Encrypted:	false
SSDEEP:	24576:PeOzoeasDe0sCdUCex1/OyMAA/2D11ESYP/a+lVq7/yZFBPK5yyux9R:PeOTasLECmW5AAOp1EtP/aCQ7yyyyuxv
MD5:	F4116873D9C057697783C2C128708617
SHA1:	F4513F6A935DDF21D94EC0344ADAFC43D7AF7841
SHA-256:	A491630672EC90D5912DC01F9B053DA27A412494B65F9F0D4B66C0B75F61A5F0
SHA-512:	25202658FD845F794ADCA82760961AB43EAA876361665015AD3FB9874950E3466CBFD23C44FD6FF55C07FB5795E25FD4E070F27B9812B3B55570F99DBED73061
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................M............h......m.....Rich....................PE..L...9v.`.................d...,......(5............@..................................w....@..........................................P..8...........h....*...........................................................................................text....c.......d.................. ..`.rdata..8............h..............@..@.data...<...........................@....ndata...................................rsrc...8....P......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	8998288
Entropy (8bit):	7.999979672359702
Encrypted:	true
SSDEEP:	196608:Rmbqeac/Z9uRULQeSMZkNl3ykhj/0pSeEsvObIN6:QOc/ZcRU8TMSNxleGIM
MD5:	ECDB8BD50D26BA374F4617A17B1821CB
SHA1:	86958FA1654CFAEC90983B43C19B4C94202C4958
SHA-256:	DDDCF50F2C12DA25728D9E3A81EF407B995CC6D3BB80CB6F878F8B7F4C9E7594
SHA-512:	94873146637147FD2AF06150538D5FF2542188A5D6EAF780601136B80C324965F5D3A620E2611B60163AC41AD46D62A3BCBF09A96E08AA49EC6662132FF7D56F
Malicious:	true
Preview:	7z..'....9..KM......%............&..p.........../D.N....LE .f...E..g]].. ..j5}.5...lX..^.c>1".B...;..8...............9b.......zke....1H.3...a)...:...~u]MLW..80.yz.S,z.B_.A....j+.e.gQ.....O..W....Z....@...k.&H..b.p.,Z..nD....d..4.[.\|..M..p:,.=...\|2...$?.w7..^?.c.......'..Q...................;"(.p....f^:.mW....J6..Z0.5.$..=.6s.1^.S..ci.......^..b.gf..q.G...#6?.>......}........ $..J.I.<.f.l..A..;..;?.Q.QE....i](C-...g.i.....7.UO^&0....-.....h.:.v...3..6.c...=.~Y+....R.......c...1...C..D.i...S.R.X.}...+..w.[.\|'.-..FzH8....e.V.a..23..x.D..$.............i..#..0..7V....29...l6d..2...Q.&.4*n}.b.j..5M...Q.U..}...J4.H....=7....1.ON..lQ_._.:.l....U.1.[...O......Tb.o.....'9<.:....%"..T...r......\|.q\W.R........Z.(.2?\|...h.s....a..!K!.....+.Z......n1.....\|n..re.V.\.LTs..EVT....D.e.."......"..f.r.n%/.....!].5..E$.H......Js...'J..).3.DY.+C>..GQ....mo...1B..ra~....4.....7....C.-A.m8}..1...x..X..>...\.6...t.ei.....,N.l.(4...;./.^..`....^...\....Q..%b.:$..l

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Common.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	4435395
Entropy (8bit):	7.999959728368326
Encrypted:	true
SSDEEP:	98304:ov/H/CYwJKRrgzCC5hEJJJIK52llm645DA4XCQOjaPZiky:ov/f/wJooCC5hEJb35Clm645DA4ydj+a
MD5:	79CA811C82F5430B66BDFC40848E8076
SHA1:	5CC6A6AE302984ADB4867E5CB66B756ED611391C
SHA-256:	9980CF81B927BBB2B4DA2194EC3C84FE82A75F734F94D72CBEEF7464FD98A228
SHA-512:	B904AB5A1E29E1CE385E1D89E09E4FF488921D6A2AAEC18EC9BC0D617FFC570BEF41ABE0149372E9FE3F476AE92C745D55174ED53CC1D550B842EF7D81445CA3
Malicious:	true
Preview:	7z..'.....HT~.C.....%........Qn.w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o....bA>....Qc]i..u.=KZ.P.H..[..#..3..R.h.a...>...sa\|["...889\..kZ.s.v\|.........u...w.\^..#."-.0.m{..@d2v{.....Ny.a. .......K.Hf.VI(.L.9.D....P..2......s).!....S<...Yv...~.KL...TYhzb..R.[u..2.l.f.Y....k..X...\|....sG..r......... /.D....M.9...:.g.....@W.2.O.i..6.6..r..w%.=r.]j]...Z...Yw....?. .`6.......\%.]...r.....]&Q...^a. .?Y..z.}..h...p..c....h.o..^..o.E+oF..^.Sn.e..........8`...]P.......6.V..z%...c.4J?....K.E..dz._..uX.oDuM...'.......~.U..5...S..1..0..o...H..UY.Ie&.^.N...D..c..l.#F...f...1O..Iv.#.3..J.x.5.#..[..^.N.\.i`L.,.;....~..F.;.jn...;,......'/.q..2H=....q....8....D.m.....g...s..Y.+..]:...^.p. W8.....^7N....~Y)l0.....^..!.2..\.P.^tP..$;J..A.Rc..u..)...M.-..r.} ..q...*...,(...Zw......=....F/.........`Fy.-7....

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	2454899
Entropy (8bit):	7.999923308350734
Encrypted:	true
SSDEEP:	49152:aiFijvg6dU+ahXLMvwu7hqdR7mTOBz+glYArmzcLbt4xAOkXVGN6VMxOTqWRE6D8:aiwE6dDaVLywu9qW4z+glYAaIfmWtGNX
MD5:	17A3A1C9FC61A00A854190003A230837
SHA1:	BEB56663B03DE7E1E1C53C1640EEBA4CB842C2D2
SHA-256:	6DAEE6411355FE6048DB24F2658B3CA4541644A706441B86A036502A9A3054D3
SHA-512:	28B8EC3F94CE196D110AB3268A644C88A688BC5D214DE5EE8874B0CCA746B969E86090B9C9E197CE3904604196A8F54636236259EADF91DBA0F598777CA0AC79
Malicious:	true
Preview:	7z..'.....&..u%.....%............&..p.........../D.N..XOg..si.pp.1s.%..1...}.P`..M..6..M.K8agO..p.'.T(...f.eXR<.q..........4wl..iDR.w..+0.....J^w>aiCG\|..r..b.......C#@.\|...r.................._eGNn..!.+..J_...Nu.X!...~s...rZ......]~s/p.J~;...... .nx.....V.....g.+..#J.Y8......."\|N..#...NP....#.\.!.>.C9....\|.:..SqYR..........h[..j...K...^.ae-7.h4.q..../5.5.T........d....Z...........D{.j.....l.K....7.....(.\|..`.D...S.~K...e.)......oAxd.~!Tj...\|D.'.y..E.4....k.....HV.zvE......X...U...]....r,Q....8..X.....Y....h8.......JI........l.AL.1....&)IL\F..\.V....... ...-..(..Ckj0..;.`.........R...%>...N..l..2...n.'.M.../.1.].}....I.l.8........K6...\|V}.j....\|.s.....;j....&..&....Z..}.,...6...k\...r..~.3.....NW.....c.~.!^.S.<Ol._)U..b..g.....2.f.......(...........Oq...z..qo..i.c.....2?(.#.g{.....>S...K....C.....pB...\|.,.@a..]2..o...."..S............\.......b..7...^...?5"$.`.A.^RyGSX.Y...4.M@{..U...]240`.K....e?"5.It.".."..V,+$.T...v.....

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	2253673
Entropy (8bit):	7.999917986738463
Encrypted:	true
SSDEEP:	49152:FpxKwbI34+2jse+3OXLOnR7NwJAeQtrcAWsqu1/JT9aAE5HcVJUFb:3zbvDAe+3OXSnRJwErEgxwtcV6Fb
MD5:	233BF0F6755E26157EBE659CDEFC05A5
SHA1:	D3F753A68EAA2EDC37E57C40FF94917D9188E1B9
SHA-256:	300BFAC09897841C769C616B82245718F4B57792A960F0490EC67C19FAF46C6B
SHA-512:	AE392B820EB5465552DC186E3EBAA6AFE42C7025DAE3596A8A418DC3F0A4D17E378DACD404016CA9A8EE481307576736D287CD49F5609AF83DFDF4FA2112443A
Malicious:	true
Preview:	7z..'......$c".....%.......+._h.w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o....bA>....Qc]i..u.=KZ.P.H..[..#..3..R.h.a...>...sa\|["...889\..kZ.s.v\|.........u...w.\^..#."-.0.m{..@d2v{.....Ny.a. .......K.Hf.VI(.L.9.D....P..2......s).!....S<...Yv...~.KL...TYhzb..R.[u..2.l.f.Y....k..X...\|....sG..r......... /.D....M.9...:.g.....@W.2.O.i..6.6..r..w%.=r.]j]...Z...Yw....?. .`6.......\%.]...r.....]&Q...^a. .?Y..z.}..h...p..c....h.o..^..o.E+oF..^.Sn.e..........8`.K.XH.\V[.x.H.a.\|......O64.l.X{.....~..*.(.....8..P....:...5.)...%t..T.....=....4.....-.t@.F9Y.Tuq..v.....1o.&.K4....+q.T....8V..c...zJt.C.4V..I....c.P.<...2.b.z..}...W.C...A...U..ZQMM..Z..--.2.j.L[...=......UY...P.....-.T. .K...q.@.b.h$.....&..p.........../D.N....LE .f...E..g]].. ..j5}.5...lX..^.c>1".B...;..8...........wg3......b.{.:i..V..J..\.K8

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Install_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	2575399
Entropy (8bit):	7.999939000214655
Encrypted:	true
SSDEEP:	49152:PR0K99gFkCeUuRsskd2gTaC9t3YEA31cC6xR9m3JfW2B2FuI9lmDx5MIf7NyFPQu:eK99gXeUYsswPTaC9trOhZrBHDTMIpyf
MD5:	7D9E881946D0F59CEE2BC319485D8692
SHA1:	318F41400F9D151016A3D9A7CD4802E2B18AB9A2
SHA-256:	9CF45644593D50A21D84C0AA238F5775382669AF9A587D670F61FAC7A27F96F9
SHA-512:	18D545851EC63513BB5D5F5C62A499B8E14F87BED847BDBCB4951F04DAA3B69D6B611CCC61493A0A728C9700800D559773DCB7887FB3B3D069DEA157EA40A5BE
Malicious:	true
Preview:	7z..'........K'.....%........D...w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o......'i....D.{..e..W..S.'..4..5.......aT..7.h.\5...oiJ_..L.....(5...........:...,..R{......+HfX..g..X_S#....'.8.@..~v.......d=-K.n.7.B.v4 .5o.h..9....c.z.[WW.........u9.pj...m....e&.gj#`.brrl...5hA..x.l...mzB#`C.X..:..'V..PlW.._.\<;..7....D(.Z6.[.....XD83.E........3~.Vgm.J....ex..E.....L.KT.l....O..g.}...t...i.......A....._....a()q.K...]..P...M.I..$.H.1b...bS....1..`...4wD.....g...(.m.<K2...y.E......a.i....t.K.Q}t.qu...>..b&....KnKp.!O$1...S.fJ.{ze..........s..=..j...5xvRKNv.~.h...e%V&A....4.\|x.'....D.`G%wQ..:..R.K...Yd...<....,..?.I...\.8>..m.n....#_.ZI.P`_g....%Z..^....jS..~qE.i..c.o.@N....i..-:.y.......&..p.........../D.N....LE .f...E..g]].. ..j5}.5...lX..^.c>1".B...;..8..............U4>(.9q3...{.....{

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	4198312
Entropy (8bit):	7.99995451457425
Encrypted:	true
SSDEEP:	98304:IcrlUl74JYzlTXAAEsOh5w1diz4fcrIHyk95ii0qBv90rNB3yXd:I6lUZUY15pONz4fcrIHykLSCF0JwXd
MD5:	6049149E5B706BC0C778B0188FAE0A2B
SHA1:	34BFC380A01759D36DCF03AF5EF51A0044D03E40
SHA-256:	26C297FE9FE15DF7D08E26D65C47D58C10DFBB6A4506D39E9A93007E7CB6A97E
SHA-512:	F77ABED713D27F8C1412223277C831DD17D60F2C9A81EADCBE085C9367633811D25EC3AECD961FBE2B69C20264E77A0FE260818798658464BD84FDAA636554CB
Malicious:	true
Preview:	7z..'.....ncc.@.....%........6...%..?SP.Rc..B..!.BV..-.Y.?.i...M.fTV.......d........,.J..o..>...)M..Qv......Zo.hjdF..b...w.=>:.x}B...4.3...l....b..9I0A..E..s..4{!:..dby...}.w..vh.-..&..p.........../D.N..tF..s....}.....<...........:.>..#s..\.b..bi..@.^..gw`.e....3i...$.{.;...W.y.....wR8(.v^.# ...ap$w!...5.74M.q.)G.NK..X/..<.k;..\.d.."...r.7b.".......tH...~.z/.Dmk.X.]D._../.OEI.bP"...,wS.E...OgQ.\|u;N....v%...?..]u.(.<.;..(..?.j.:fFD.na...R....7U.x....I.g..R......<g.w~Y.fh..l......O..}.%........q..aZ")...Y...;....R..[`....i......T.n.e.Ry$r..x.:..Rx..z2..7.N..%..S.7.............w.?.:...^vR.......F\...B.\|.n.\...;.....P.TL...i..xd...Z:7J.b...Y..N.<.o...M.n.8C...+0$.....]+V...4..R....u.9.<...G.-...P...H....s.6..a ..sy..fF. .+/0....V...U3.c....\|.>U..p.....8.....s6C..d/`....\|......FI..q..[b0YC85.<..7@.....v..e.:y.....9....@.v..'F?.2.J.9.i..!p..8...Q.....6.i.,...`..d.T....'t.....(#....kd...@...<...n....<.R.&..&..P..N.x.../o.A...V}sA\|.+...:./..~K...{5

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_Res.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	88565
Entropy (8bit):	7.99808528553976
Encrypted:	true
SSDEEP:	1536:q3VeIEXpAbFMWwsjkXgac0K3qFo8o9X1ICBXFdcBWTxI+3:q3t6WQlcfR792KVuBWNh
MD5:	F4712F7BA5D7E12582E940580CBF4145
SHA1:	06E3F6FADDEA1BE3CA59B48FEE2FA4264231E8B2
SHA-256:	CBBB97D1ECB3819D2E8D72DB5A9CE8594B5973EF40E6C02D44ADFBE2ACB49AB3
SHA-512:	F63E333BFD792D9FDE573CE1AF699A02B26F69F384B1008945F87E7BBE8E38347E8A0F0E8C32D3A4988DDCEAA6ACE6E56A13DD8404107B24679D4577638B62B5
Malicious:	true
Preview:	7z..'.......Y......$............!.Mx....6.!...N.G8dR.._..5.V..PSG.my....ie.~..../t....!..-.q..G....In....O..9....A.....0..3.<t...t<...."..O..iH....o.>...-..Q4....y...eG~p.h..y...H.w.W..}....uS()..Gx.3.....eHO...E.w.....7..(p..!.w.f.Vym\|G[...S..h...^...A..$7..7..>.:D.N.C8.vdt.6.&...S..........C}x8L.t.f..k..O............6.w..[..#.{y........R.=....~.nk../N......4....1..`.0."h....4,0...9V.g..4.....@....!Q..n.U....`.s....qI.b.....t.d-`..D.`.O..ju..O..[i....+C.f..6L......%.G....ZS.96.\|t.F..kM....d<}<e..S.0C.6......r...(..o.Q}.:....#(3!8.;A.IM.<rr`\.H..6@...z..6.....T...M..sG.4.B..w..1._DN.J.e*.d.[c..2..\.zJ$CQ'...y...s...Qi.........3...........y\.E1.ky.XJ.9....b....cC..H(......Y..Dz..@G...?.c.......<y...z-..h.5[L9..!...Z..s...5.?..\.4....q...#)F..0Fh\L6i.Ul:i.. J6a0.!....o...{.....0.A..Z."&SX.V?.f....R.."..7..\|O.H.5..Q..d...z....^E.....xV.O.u..........#.KM..J,E;k9..-...g.d....#.....NZ.._c..c.$.n.e3Uu..>X.....A.N..0.N.x.-n.....6.Vq.{ g..8...//..

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\ASTX_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	6863284
Entropy (8bit):	7.99996849744424
Encrypted:	true
SSDEEP:	98304:aYgqeOyfWAoAUVii3im+k3M0lB87IvmyF6xTcxK57/vo7ZpEATanXphW5yRJAvWn:MqekAoXp+kc0g7cmcA5TRATiyyRJSrh2
MD5:	396F808D1DCBE59BB100B15E1F8B9D75
SHA1:	2180479DD2A0B74D3D17DD63E5B5B2BCA3B30135
SHA-256:	4FA1DF2B47283595D1AA0A244756BEF2627DA8F9146A2BD3492988FBC2D9E35F
SHA-512:	34037FFFB1CB3C701CD47AA67741E062A68304BA720EA53D4D7BD4F0FF874C31BAC686C7CE24AEAFD744360CE533C1931FA2434E4F223135DE545983CAF72CF9
Malicious:	true
Preview:	7z..'...lj.6o.h.....%.......m.r..w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o......'i....D.{..e..W..S.'..4..5.......aT..7.h.\5...oiJ_..L.....(5...........:...,..R{......+HfX..g..X_S#....'.8.@..~v.......d=-K.n.7.B.v4 .5o.h..9....c.z.[WW.........u9.pj...m....e&.gj#`.brrl...5hA..x.l...mzB#`C.X..:..'V..PlW.._.\<;..7....D(.Z6.[.....XD83.E........3~.Vgm.J....ex..E.....L.KT.l....O..g.}...t...i.......A....._....a()q.K...]..P...M.I..$.H.1b...bS....1..`...4w?...W...........L......._..#..1..D.Td}.u=..?x.......&.o...,Y..Q.....u.....ec.U..\|.ezf.D...]=!.=.(^#.4pJ..q...H.lZa.[.>......c.n.f..'I.%..&..p.........../D.N..tF..s....}.....<...........:.>..#s..\.b..bi..@.^..gw`.e....p.h..Pp..Tr.....q=.yw.g.F.z./.D.^Z..Qb$w.hM....E}..m....md..._......._....A...I.2Yc.{=.I......~..9t......dCwa.."X.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	599950
Entropy (8bit):	7.99962010978993
Encrypted:	true
SSDEEP:	12288:Tcpfev27ya/slIuDIpco12OM3PdQjE6fynngBDC/bo5MM:IpW277/qDDI72OA36fyngsML
MD5:	1561A656EE04B92E4828A1772D3F1002
SHA1:	70AF5C8301619BBFD42A8AB3E0850B58F1A8F09F
SHA-256:	5E0D482D391387CE031C0160748F5960551C07670DD61B0B41ABA2B37465C6B9
SHA-512:	2AD8414C63BE63D53D130423C8549AA41807EDC13F84B00E559C80B3E39946C07F4046ABDD0B66BAFBD4C781D1470D0514FD01A5C773068708AC48CC799BF86F
Malicious:	true
Preview:	7z..'...g..rJ'......$............. .b........x.tP@.......;V=J...S..g.w?.[./.I..$.,....0f.WLpJ....Q.'.k2j.1Ma...wyz.[^.....~..no..\.....C..z..............r.lV2W......8....N.......9g.Y......f...i...-..."X.{.$.......Km...<.K..H...Njh.W.f.".qI...3.....80...a5.\.O4.......O...[;....m..Jc...P..<.h.{=\|'..\|..9.DE$>....i^.Y....-....&#...'...z....,.C+....Xc=.....2.'...._UB...jB...+.....TZx...r+...'o.[..B3//7..D..t3.\`.Z....r..r.e~}..5.....Z.Y. .#I.. 2...h.NA...e.0...=x&vRV..F.@......x.[.X...G...Fd........N}...q.........P........Q.-..V.,q...../.m...V...\.f.I.)..5.l".F..~....o..oy..__)..?;..^.....+.I.A..IN.y..@{..3M9..<......x...Zk.C.?..sZ.T...8.a..]..3t....s.tK1......W.$>.......a.S....B.D.\.E.g..Xb...:);...^gBe.ur...y..N.3..O.+)......~X.g....{t&.;.V..fm....B..lD.......).J;......\..'s.v&.(h....T.O..S..#cl....w.T...at.#..)Y$..$.b..].I.@(:..E.X...6.N.$...s.....<.&..'.:).j.,.7.$.,.=..*.^4.b.pkg...k..r.l.Ge...$..'..zf6....\.3q...\$j....(.iP..IT....X.H..

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	584447
Entropy (8bit):	7.999688406583714
Encrypted:	true
SSDEEP:	12288:lzTx+//FFKTONasBV8M4a2uPY1IlwTHlB7tuMBp1DiXx:lzOFoTOALDa2uPY1Dhj8
MD5:	E9B375C2DD90851F327A410399B39A46
SHA1:	428B01F0D14E228C1F9F554194456FA7C10A3C75
SHA-256:	A2AD8527BEF7FAC9D10A7994CF5C1ADF064EB938A13404B465D126C7A3DB8565
SHA-512:	13F7C6CFCFE6538C579D182F6874AFD1222765C6E8070138A00D1D26F795184E82D795AD351B75654ACF64268C35188E6E1823F526298562062FD9F898D5C22D
Malicious:	true
Preview:	7z..'.....w.........$.......Pt.... ........h..U.....IL.......}.,{.NI.)....c.......o...vt...y..c..]..0p.'c.Mc..7.`Muj>.l0...y..`.V.......s.N..4./a"T.h...:.....r..92:..&'U.....k..2.jio.!W..{.f...\|7.WphK.Q6..b..jT3.2...gI...J9..3N....z......3bA}....x.@(T...bH..-.o.\J2..W(..'.H.X.....cYQo0.0.!.+N....7n..D)..... ......!iJ.0.....=..@d.h..W..o.bY.H.....@....!...{...-O._.....e.0?P.i...L..W...4e.y.5.Q..I.......G.nd.6.\`{....t.j~.2.}o..Z..F.....'...V....{0e....7iID..H..q......&....<......c1..@.w[.....4.Zm*8..WvZ].......KT........,......z......z.?.1....+........-....a..t.F....f.......>.W.....v.?.......I..>.%B..o0...51....... R.....3.KL....\P..:.....j.Vd...U..w-.u...7..)Ie..<.-.........D..p.U$R.E...h..k.s.rO@.....X=..)...S..5..d.......g....m[k4.0..@......0iSY.J..B.M.8...`.A...-...h....>.sc3..x..\|.....f)g+....U...'.R-.``....n`>.@...Z.a.FUw.. '.k...RHn...j.n(..Pqz._..\|.b.z..2az.3..3".....nc..WZ.9;J..A..,t. .mN>.....X.....'..V..l....0..AX.z..Y...F.Bs0..

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Av_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	600234
Entropy (8bit):	7.99967095350073
Encrypted:	true
SSDEEP:	12288:U3GVgDFjRUU+29tjEn8loMDKYypewi30OyhBRNCofIEFo2Ivogc1:UWViCU+29BEn8p0peZ0OcBqo1S2Idw
MD5:	98589A2D090A698810FD231F7B82BA43
SHA1:	251D3649F6FD20EB3D6C0EC4D4BCDDE60DF79E0F
SHA-256:	08903337A7784FF405CF799B87F33CA8979E03828351FB249D599214CA686E0E
SHA-512:	234CB8B8FDB169A3AE534165DF0970C358403607A3C803F5480A945F004A7E4956C3DE39248DC21EE7A97E4F50740F1DE970B033571B667C2271ABCB3E545E8A
Malicious:	true
Preview:	7z..'....4..f(......$............ .b.0......x.tP@......wCV=J...S..g.w?.[./.I....,*....0f.V.J>....p..G.h..&b.~p....Jq. ?....{...G..wp4.X..(H0.\|V.c..V..0)a.z/U.cw.....k\..S..9%c.i.k};..9...j.3...Bh..>...:.4m..H..1D...^^.../@..D..)]\....p^..e.u....x....r..`....Wo..~.......P#9...f#-.3(.#3..}.Y.,n........GK.>..b.h(i@%..\|,...^.g.,.G...o..:8E."....Op.HD.4...>.##...Mg..v........H...G..-.!.2.u./.......i) ..^..g.?...;..Dn....4=z..}..Q...E.....AB.../.5Pane.f.._.F~5c`..?.j.........=.$..O...AS_..y... .Wb.F0....../..X..Z....qE.R%.T^6U.{...V...{}......qB.l.:Q-....b6...S....$...;.No...-..p.%.......r..D.....d%(...UP..\...lgAB6Q.P.nW..1H.".F<(....^.[$Ra`...`q...DEy.XK....'Hq.%.9/.tc...r7.b.....,....-...$C.......Io.Roq.$.9.:.7s.4o.."q..~Q.W...b.7S.V.?[.......9Z(..(s....k 5.c..j.'...d^.M..0./'K.g.<.D.......>..u.\=..=..;3?H;..).{1.0.N..}..W.\|J.#..\.,....B...y>.\.....I.q3$....H:.._z..=I..-....:V9B..!.e..A9G..=.2.#U..$c..X@.].<.zZ.7#Fl.m^\|!..r...k..sE.,5

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	6613685
Entropy (8bit):	7.999972249142294
Encrypted:	true
SSDEEP:	98304:pME7VzaViO+9TbAIlBRpphTu+F85JG47Uy/u1fT6e1OVJlsnnGdZaycpbTuLPb7a:pJVzaABASxakc53u0e1OVcnWBT2
MD5:	4678ECA9FD40E5CE9A058B85829CEA82
SHA1:	34411B9C9626CF218E336A2ECD42BE7C88E54359
SHA-256:	6D3464BF6B58519E6C5956D7603E2D1378E8D0992F32F260883BE084D0C1C13F
SHA-512:	7B1391A9662C0220948CE9F313BCD5C0C2CF866C5D4B56E7A510378023442B9158E496A35421ABAC51EFB3C607F06F37845C87635B51D471839F235356A965BB
Malicious:	true
Preview:	7z..'.....".p.d.....%........$...w.....jw.\N...... ...}.@..lt..\.<.c.{Sz.Y.0(@N.....y......Y?..l.O.q.N.bl. 5.....Q..X..%...W...k...dw._...d....v.IE..A..8K..D...~xMI.......E..+.V...v..&9.Q\|N,n.1...`R...=..b,......X........%C.....n.n}1.5..cX.9u{>..F.m}.W....;%..f..G....f@'o.......&..T..q#!.Z.K'r..9.b.2.....kr"....R.#.1y..r..~..`...fyD6......./..I.[.......mVNW..Y.f0A.H.rP..k.v.;..[...FM.I"...0$.}...i.$....#.@...0.S..J.y@?.[u!..{....#F<Kl.j2Qh71W...@b3...=#...pM...z.\|.lV.?.....='.)m.u..........:6n.nUD....-f.Ez........-....-...0.T.k..,....O..EY_.2.'..;..iRp."........,.R;.C..F._P..j...Cc.....S....M..C".A.r......+J...............s.hk..s............%.... ......aZ.2...3.F...8.Gw..qT..j..b..2!....P........6q.z...!..]Dy..*;.B...g...eU..7t..o..eU.Y<....?......{?I.....aj.....Z......T..XY/....q..y......s0.h......C..7.r.Y.a.=.)./%.M.NIW..,.ELb>...eSHGT...LJ.a.wp..J..4.$.\.S...#....er~...RA..t.S...,...<A^1.P...^...2..F.H..{0.,ic^.\b.D".;.@y..D........

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	6756998
Entropy (8bit):	7.999972832061905
Encrypted:	true
SSDEEP:	196608:lmpNblLyz9kbyEuDbkTTlh6wAo27UPzzS2sX3Il:0pNbleqyEGkpgw6UPzmDIl
MD5:	AC0153A721678E241583A76917692301
SHA1:	70D45F6420B7B7D20FE0A43DD252F96A1F4E2356
SHA-256:	425F06C1D58DE0F9CC9A0D59F45B3EDE6D6CAF5EEE5E41C25CFCEFD13BEF1D09
SHA-512:	7F9531B94E3855796EB4142312FF172A8EDC49713AD4A086583EB0131404481D72CE583A1DD6F2AAE869F0233317007232073305F08FBB6FB73A4BB4F23F2898
Malicious:	true
Preview:	7z..'.......A.g.....%............w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o....bA>....Qc]i..u.=KZ.P.H..[..#..3..R.h.a...>...sa\|["...889\..kZ.s.v\|.........u...w.\^..#."-.0.m{..@d2v{.....Ny.a. .......K.Hf.VI(.L.9.D....P..2......s).!....S<...Yv...~.KL...TYhzb..R.[u..2.l.f.Y....k..X...\|....sG..r......... /.D....M.9...:.g.....@W.2.O.i..6.6..r..w%.=r.]j]...Z...Yw....?. .`6.......\%.]...r.....]&Q...^a. .?Y..z.}..h...p..c....h.o..^..o.E+oF..^.Sn.e..........8`.K.XH.\V[.x.H.a.\|......O64.l.X{.....~..*.(.....8..P....:...5.)...%t..T.....=....4.....-.t@.F9Y.Tuq..v.....1o.&.K4....+q.T....8V..c...zJt.C.4V..I....c.P.<...2.b.z..}...W.C...A...U..ZQMM..Z..--.2.j.L[...=......UY...P.....-.T. .K...q.@.b.k....nU .'..5a....T. 0.....}.88...i...e.......S.....s0....&.d.Ed^I...u....D....5Ce@.:.....[c...:Z...#Q.D....<...

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Core_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	7841722
Entropy (8bit):	7.999977065809501
Encrypted:	true
SSDEEP:	196608:8d+IZSqI/caPW/IANp9LRyYKiB2LZBwE/WOTGOfjsK:u+1nE3AO3LRRiLZBwE/BpsK
MD5:	1D970BF733EF4C93B351384D2B34405D
SHA1:	D7FC32C354BEB6084E186485474459A746C1A566
SHA-256:	369FB27B23F548E4B901D2EEF553802F6CFA60E55BBDD89E2B5DD402C434E191
SHA-512:	A0578DE50EFD39A890F47A75B70709395DA47F74A105075BB4C15E820DDB2773C4D2D206761812E6D471D8E58BB6287EF74ACE28ED9F10BD94CF3569F8E72BCF
Malicious:	true
Preview:	7z..'.....9.u.w.....%.........._.w......3.a`.....f...'D.$.."8..S...5..\.z.......K._..2.....?}...$...:...Y......P.;3.J.x..3....i.F./.}.R.....'.v.l..a.%..>.-.2c2...x.g.c_x..a...-...{.)/..2K...H.........0...g....Y_.@..k8.]9......X..o......'i....D.{..e..W..S.'..4..5.......aT..7.h.\5...oiJ_..L.....(5...........:...,..R{......+HfX..g..X_S#....'.8.@..~v.......d=-K.n.7.B.v4 .5o.h..9....c.z.[WW.........u9.pj...m....e&.gj#`.brrl...5hA..x.l...mzB#`C.X..:..'V..PlW.._.\<;..7....D(.Z6.[.....XD83.E........3~.Vgm.J....ex..E.....L.KT.l....O..g.}...t...i.......A....._....a()q.K...]..P...M.I..$.H.1b...bS....1..`...4wD.....g...(.m.<K2...y.E......a.i....t.K.Q}t.qu...>..b&....KnKp.!O$1...S.fJ.{ze..........s..=..j...5xvRKNv.~.h...e%V&A....4.\|x.'....D.`G%wQ..:..R.K...Yd...<....,..?.I...\.8>..m.n....#_.ZI.P`_g....%Z..^....jS..~qE.i..c.o.@N....i..-:.y...........P.~...qu.j.....Wl.V..........JY.4J.....?..."....DT=....+Ju.......p>..GQ.s....jl.o..{#.N.....B.i

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3354288
Entropy (8bit):	7.999936452677557
Encrypted:	true
SSDEEP:	98304:u0XFZtIOB1ycBXJXXjbkafl5xe3qdUlFqAuXQ:uuzIeycTTD7E3AUlFqAuXQ
MD5:	90195F62B6C0B6C3255B6DE1C0BAB17F
SHA1:	83F0DF5FCC422A68940E3EE916F2F47016322E06
SHA-256:	9C4289A59E271038D86157FDF83B0B965481C07747D777E2D327D1D923CF070D
SHA-512:	B8079DF3ACABF8DAE2B3A942CF1ED47F39070FB8AC70681B5B4CECD2251E5599066F239113D5DD19F21E9BB9472662C1B2E5F0C72554DB59D96F5291FA8D2567
Malicious:	true
Preview:	7z..'...;...k.3.....%........<(...,B.....R".M..eb[..'...W...b.].w8J.+..?..}...C4e..B..q.....T......[..c..X...j....U..pB...B.N.......l.n.X...n...hw.fH..F.1.`Ji..PF[.p...G..;.J..}..BM...%.)a}.%.J.Q.:.@2...-.!....t7.?...#....g..u..p.3t..../).....B[u(....j2h..[.. .+P....M7..=.v.....en.t..&f.$w`Gi.ZBgyb......'..g..4.4.up.S.....M.J..z...=.wGy...j.....@.5.u./b..JX.....$.9.$n...6.D.\ v.......f.e..KX..b.+Z.k.TT...,..C5..\|.....).....m.......L..O2........U.".'.2.U...t.;1.^.Qk...m.J.H. .H....p.V.$&e(~.wc.i..{......z\|7...&..H...{X ../F%.u..y._Gn_-v..&.)....-...}.Ti+>.v................d....J...........$@.d4.K..^.$...9o..../N.A?.h.V.Q...AL....UR.\.C...P..M.... .......A.1.....U.........e......&.yrW.$e.]q3..r.e........$i.;.....>...s9.d.......4.X.....-WI.u.V.X...=Wi.(.h....s.i^ME.L^..K.....l...q.9U.nq.5%>.b..U.....y......`.*..1..t,...J.._.m=.Qu.9.S...C.g....IYQAn......D..6.(. oW..Y.-...'..~.!.Gg..T.B.I.d.@.i..>...".0.(.l!...#\.<....)....!o...a.gf.z.....F

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3330012
Entropy (8bit):	7.999935971509493
Encrypted:	true
SSDEEP:	98304:H0XFZtIOB1ycBXJXXjbkafl5FrNFKxVEqYn0lbfG:HuzIeycTTD7FXcVJJVu
MD5:	5E6A2F8228DD7C9070F90D0B13813A10
SHA1:	E62DB52ED15C6A50C5694249D6C964F6FA436A07
SHA-256:	3FF811E114DBF7BBA276FA584605D900A949114AC04387BD2E77E2738D270C20
SHA-512:	158D0A254ED0CBA630F05D8CC7AF40258F0798FD4AF7700E3887DFD085E15BC946D9B9C6A41794BAE8975D6619DC548B3947AA1505DD1FF11156FFAB9F0B62CB
Malicious:	true
Preview:	7z..'...A.....2.....%........x....,B.....R".M..eb[..'...W...b.].w8J.+..?..}...C4e..B..q.....T......[..c..X...j....U..pB...B.N.......l.n.X...n...hw.fH..F.1.`Ji..PF[.p...G..;.J..}..BM...%.)a}.%.J.Q.:.@2...-.!....t7.?...#....g..u..p.3t..../).....B[u(....j2h..[.. .+P....M7..=.v.....en.t..&f.$w`Gi.ZBgyb......'..g..4.4.up.S.....M.J..z...=.wGy...j.....@.5.u./b..JX.....$.9.$n...6.D.\ v.......f.e..KX..b.+Z.k.TT...,..C5..\|.....).....m.......L..O2........U.".'.2.U...t.;1.^.Qk...m.J.H. .H....p.V.$&e(~.wc.i..{......z\|7...&..H...{X ../F%.u..y._Gn_-v..&.)....-...}.Ti+>.v................d....J...........$@.d4.K..^.$...9o..../N.A?.h.V.Q...AL....UR.\.C...P..M.... .......A.1.....U.........e......&.yrW.$e.]q3..r.e........$i.;.....>...s9.d.......4.X.....-WI.u.V.X...=Wi.(.h....s.i^ME.L^..K.....l...q.9U.nq.5%>.b..U.....y......`.*..1..t,...J.._.m=.Qu.9.S...C.g....IYQAn......D..6.(. oW..Y.-...'..~.!.Gg..T.B.I.d.@.i..>...".0.(.l!...#\.<....)....!o...a.gf.z.....F

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Fw_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3414275
Entropy (8bit):	7.9999371689728065
Encrypted:	true
SSDEEP:	98304:40XFZtIOB1ycBXJXXjbkafl5/NzWIUxQFoCu:4uzIeycTTD7/NzWJOox
MD5:	B78EC12E56D20CE4DA68479C6F5C0163
SHA1:	4FBCBC2345F64CCBAEB2E86C6F6D8C1AD96D9704
SHA-256:	9C9B043C0154F3D1CAB8766E098F06976213AA3EFF47914390CFAE1C62D94AB5
SHA-512:	01356BA25C348250195D9C9FFEA94D4C0EABF9D256900E3E2DBEA3E4E9C74187148538A91F8E47550EE5226DEAE186957C02344116E2B7AD4895A85FD53FC7EA
Malicious:	true
Preview:	7z..'....!...4.....%.......ew....,B.....R".M..eb[..'...W...b.].w8J.+..?..}...C4e..B..q.....T......[..c..X...j....U..pB...B.N.......l.n.X...n...hw.fH..F.1.`Ji..PF[.p...G..;.J..}..BM...%.)a}.%.J.Q.:.@2...-.!....t7.?...#....g..u..p.3t..../).....B[u(....j2h..[.. .+P....M7..=.v.....en.t..&f.$w`Gi.ZBgyb......'..g..4.4.up.S.....M.J..z...=.wGy...j.....@.5.u./b..JX.....$.9.$n...6.D.\ v.......f.e..KX..b.+Z.k.TT...,..C5..\|.....).....m.......L..O2........U.".'.2.U...t.;1.^.Qk...m.J.H. .H....p.V.$&e(~.wc.i..{......z\|7...&..H...{X ../F%.u..y._Gn_-v..&.)....-...}.Ti+>.v................d....J...........$@.d4.K..^.$...9o..../N.A?.h.V.Q...AL....UR.\.C...P..M.... .......A.1.....U.........e......&.yrW.$e.]q3..r.e........$i.;.....>...s9.d.......4.X.....-WI.u.V.X...=Wi.(.h....s.i^ME.L^..K.....l...q.9U.nq.5%>.b..U.....y......`.*..1..t,...J.._.m=.Qu.9.S...C.g....IYQAn......D..6.(. oW..Y.-...'..~.!.Gg..T.B.I.d.@.i..>...".0.(.l!...#\.<....)....!o...a.gf.z.....F

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	738728
Entropy (8bit):	7.999745012548899
Encrypted:	true
SSDEEP:	12288:NzuCIeJbKwHQ5NaU3u7rBTOodf5rbrrUus/6Gk3gkfh4gUg90mwm:NzuCIoQGU30FfjG2Ei
MD5:	354E592EE08ACC2FDF3F36056627D980
SHA1:	2DBAB12D6D7F74A0473112A14DF729BEABA7D397
SHA-256:	CAC43A952E9BBFD141D04AFED2605CDE6C2DC2B6203BB775B69023C0BBC226D4
SHA-512:	248470FCFDFF97661E3B7EBE08BB55038610BE241434CF3861AF7110069A82D023FED6EA2CBD4187A9F22263E21EE3B85F7245351874BD9E2B2AB5A3CDB9DEAA
Malicious:	true
Preview:	7z..'...\p-.dE......$........Q......X....#<O9.-H.c...4.Q..X.4.....R>n^...X.m@CR.E.....A. Y...8;.'....D.6U..b.o...EJ....Z8..k...W_..WJS.:.2.Cm...&...=.....r.p..'...mD....X..C.s....[;..b..."...I\>.F...V.A..R{.$..;s^x..~,..2.`...........q.._T~.....g^..B...._..e...:.IJ97`.i.n/...k.".4...eR...%d.Vo......P.H;....,..b..U..'.m.Sr..Ur..X.\.3Wi.5.}..}n.3.ri..B.._"2....2...u"s.8..t.6...\|....D..E..m\|8.l.f....6HT....(.?Xp.B.U..ZO.K.......9..t......5..C..CU.....(7.YUol..@..A.%....X.Q....F.{0. ....?4C.Mm.<.PS.....4vc.y.....>?....a..o.O.l..VC...L..<N..Gj.....~.....t6z..........1No....su......I..9V ..E..U.bW.R...).r..W.af..;..0.uZ.m,m.l.^....b...".c.m....z..b].N.IF.....5.{....:_...N.L.^..jA.....3...tG.K.....l..z.6..R.A....../....K.G.x.&.).&..^...P.g+u..1`...T...==.Q;.J.......P........:..h\|<A4f.J..2-K.c>.{...~...o.V.`}...[..=.".sh.3.n.r.~...+...9]....h".".O.%..Q.cU.e.lvq......(..LF.L..2~0..)5..n..r .y$.N...J..-..L.A...q...t....jB.{iB.o[....Qb....\y

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	703790
Entropy (8bit):	7.999715207371694
Encrypted:	true
SSDEEP:	12288:4zuCv/+QGHh3r3aWppwRSRP2DFb5jIFRoLENXNIrVTnoWRVG+eKQl7zy5gc:4zuCvHGHhzaapwct2h5jIFR7NIrZf1XB
MD5:	0E2918C6CB33D736FC0DBD0DC7961AD9
SHA1:	4C61D50D5372AF54DDDF724093A3CCA04247AC82
SHA-256:	F1512F3397EFC6339E2DDAC4109E878A78501246CECA446EC346A1CB524C22BD
SHA-512:	A9B93F96BBAF22F9FB07E3C7AAD50A63B1DBC36FC7ACE5778007943481CB1BA176D6C547C492064F26178638FC4E3B09784EE84800E10725EFAD100D857377CD
Malicious:	true
Preview:	7z..'..............$................X....#<O9.-H.c...4.Q..X.4.....R>n^...X.m@CR.E.....A. Y...8;.'....D.6U..b.o...EJ....Z8..k...W_..WJS.:.2.Cm...&...=.....r.p..'...mD....X..C.s....[;..b..."...I\>.F...V.A..R{.$..;s^x..~,..2.`...........q.._T~.....g^..B...._..e...:.IJ97`.i.n/...k.".4...eR...%d.Vo......P.H;....,..b..U..'.m.Sr..Ur..X.\.3Wi.5.}..}n.3.ri..B.._"2....2...u"s.8..t.6...\|....D..E..m\|8.l.f....6HT....(.?Xp.B.U..ZO.K.......9..t......5..C..CU.....(7.YUol..@..A.%....X.Q....F.{0. ....?4C.Mm.<.PS.....4vc.y.....>?....a..o.O.l..VC...L..<N..Gj.....~.....t6z..........1No....su......I..9V ..E..U.bW.R...).r..W.af..;..0.uZ.m,m.l.^....b...".c.m....z..b].N.IF.....5.{....:_...N.L.^..jA.....3...tG.K.....l..z.6..R.A....../....K.G.x.&.).&..^...P.g+u..1`...T...==.Q;.J.......P........:..h\|<A4f.J..2-K.c>.{...~...o.V.`}...[..=.".sh.3.n.r.~...+...9]....h".".O.%..Q.cU.e.lvq......(..LF.L..2~0..)5..n..r .y$.N...J..-..L.A...q...t....jB.{iB.o[....Qb....\y

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Ips_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	770457
Entropy (8bit):	7.999751699266126
Encrypted:	true
SSDEEP:	12288:+zuC8T2qMihVGMHnbVp5z9gUZ/uHZV65uZWET5A2eRxfJACzSLKqb1kcohDh0B7v:+zuCCxMyXnbVp5w5Ue5AvxxJS2qbSn6
MD5:	A671708937935A258362467D107CC1D5
SHA1:	1BB90DA754DE337D63272F8C6234F444702E6AF7
SHA-256:	5B12B53C5AF7CA003B615CE9429E36717AADD7A30F47BBA41FD6053C2031D8AC
SHA-512:	78280E58610864F00602777A33E6B473191AFE6304B36F52F2DEA7E43E5334ECCD2ADB02ECC0E85F0DBEE0908C5DA990F4F255D3514CCB497240B1232438A7B0
Malicious:	true
Preview:	7z..'.....O.U.......$.......x........X....#<O9.-H.c...4.Q..X.4.....R>n^...X.m@CR.E.....A. Y...8;.'....D.6U..b.o...EJ....Z8..k...W_..WJS.:.2.Cm...&...=.....r.p..'...mD....X..C.s....[;..b..."...I\>.F...V.A..R{.$..;s^x..~,..2.`...........q.._T~.....g^..B...._..e...:.IJ97`.i.n/...k.".4...eR...%d.Vo......P.H;....,..b..U..'.m.Sr..Ur..X.\.3Wi.5.}..}n.3.ri..B.._"2....2...u"s.8..t.6...\|....D..E..m\|8.l.f....6HT....(.?Xp.B.U..ZO.K.......9..t......5..C..CU.....(7.YUol..@..A.%....X.Q....F.{0. ....?4C.Mm.<.PS.....4vc.y.....>?....a..o.O.l..VC...L..<N..Gj.....~.....t6z..........1No....su......I..9V ..E..U.bW.R...).r..W.af..;..0.uZ.m,m.l.^....b...".c.m....z..b].N.IF.....5.{....:_...N.L.^..jA.....3...tG.K.....l..z.6..R.A....../....K.G.x.&.).&..^...P.g+u..1`...T...==.Q;.J.......P........:..h\|<A4f.J..2-K.c>.{...~...o.V.`}...[..=.".sh.3.n.r.~...+...9]....h".".O.%..Q.cU.e.lvq......(..LF.L..2~0..)5..n..r .y$.N...J..-..L.A...q...t....jB.{iB.o[....Qb....\y

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_en_US.txt

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1245), with CRLF line terminators
Category:	dropped
Size (bytes):	36868
Entropy (8bit):	3.2762575086868377
Encrypted:	false
SSDEEP:	384:8FWtLRz4WEJvM7/PXAa+SQVfsL7ijmHxcz2+XInMV3fRhR/RmnLXbunNK+B06Cv3:O0pZCAd+3S75oXInmxROLXbunUhB
MD5:	DF2C0A8B0D1C6A0A407988A23A3D5D5A
SHA1:	4E6D365AB51A8BA9C45BBED58B01CEC47510EB41
SHA-256:	CEB0CEF2E9E67AC1EB3282CF92FBFAE6FD5B56F052CB301870DF6E1ACB98B7AA
SHA-512:	56E9B63EADC9EFD5530002A74A921EA7753E4AAB15922EC0FFF733A27269A5340A04A6925B686DF20EC428F0430599AE5F2444217BA4DD84825D850174911E1E
Malicious:	false
Preview:	..A.h.n.L.a.b. .S.o.f.t.w.a.r.e. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........I.M.P.O.R.T.A.N.T. .-. .R.E.A.D. .C.A.R.E.F.U.L.L.Y. .B.E.F.O.R.E. .U.S.I.N.G. .A.H.N.L.A.B. .S.O.F.T.W.A.R.E.......T.h.i.s. .S.o.f.t.w.a.r.e. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .(.t.h.i.s. .. A.g.r.e.e.m.e.n.t.. ). .i.s. .a. .l.e.g.a.l. .a.g.r.e.e.m.e.n.t. .b.y. .a.n.d. .b.e.t.w.e.e.n. .y.o.u. .a.n.d. .A.h.n.L.a.b.,. .I.n.c... .(.. A.h.n.L.a.b.. ). .w.i.t.h. .r.e.g.a.r.d. .t.o. .t.h.e. .u.s.e. .o.f. .t.h.e. .s.o.f.t.w.a.r.e. .a.s. .d.e.f.i.n.e.d. .b.e.l.o.w. .(.. A.h.n.L.a.b. .S.o.f.t.w.a.r.e.. )... .....I.f. .y.o.u. .d.o. .n.o.t. .a.g.r.e.e. .t.o. .b.e. .b.o.u.n.d. .b.y. .t.h.i.s. .A.g.r.e.e.m.e.n.t.,. .y.o.u. .s.h.a.l.l. .n.o.t. .i.n.s.t.a.l.l.,. .c.o.p.y. .o.r. .u.s.e. .A.h.n.L.a.b. .S.o.f.t.w.a.r.e... .........1... .D.e.f.i.n.i.t.i.o.n.s. .....1...1. .. A.h.n.L.a.b. .S.o.f.t.w.a.r.e.. .m.e.a.n.s. .t.h.e. .s.o.f.t.w.a.r.e. .t.h.a.t. .A.h.n.L.a.b. .d.e.v.e.l.o.p.s. .o.r. .p.r.o.d.u.c.e.s. .a.n.d. .h.o.l.d.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\License_ko_kr.txt

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (653), with CRLF line terminators
Category:	dropped
Size (bytes):	17686
Entropy (8bit):	5.602875902592905
Encrypted:	false
SSDEEP:	384:IniKZ7swwVpNm8B2ornXey2mzNPctblShpuQv1uB8V5dj525hSBHGqx90:c/swipNmStrnOy2mzNPctbshpuQZ/dYP
MD5:	D89D667081591B016A463FD35AEF97A4
SHA1:	3D1CA7CB3DC09E0B6ED7EE208E890220DF61F2C3
SHA-256:	77F5E342D1B7E3BFDC361FA7D4B8FBB418F4AC5800728033EE1A5E06A832E7DC
SHA-512:	13BD9119891B01B382C8E5507FC2595449F3C06C5359150367D2E848166426A813A0C4D9A2BE43EDC02AF1D4FDE2F8AA4D9C77E74E156BA6A6E76AF8311E522F
Malicious:	false
Preview:	...2H.. ......... ...... ..}..............\. .....t...\. ...8... .}.. .....X...0. ......... ....... ......... ...... ..}.(.t.X. ."... ..}.".).@. ..2H..X. ......... ....(.t.X. .. A.h.n.L.a.b. .......... ).X. ..... ...(.X... ...X.@. ..2H.. ..... ........ ..}............X... ... ..}... ..X.X... .J.. ..... .A.h.n.L.a.b. .........\|. .$.X.,. .....X.p... .....X... ......$... .........1... ...X. .....1...1. ... ..}..... .. A.h.n.L.a.b. .......... .. ..2H..t. ..... ..... .....X... .....,. ... .. ..X. .....\|. ... .\. .........\|. ..i..... .A.h.n.L.a.b. .......... .....0. .........,. .0.]...,. .x...<. ... .(.\|.x. .8..... .... .8...\|. .D.o.X... .t... ......... .... ......\|.,. ..... .0...,. .....$.....,. ..... ...\|.,. .0... ..x. ...\|. ..D. ...h.`. ... ............1...2. ... ..}..... .".....0."... ..... .....0.,. .t.\|.t... .....0. .. ........ ........ .....\|. ....... .`. ... .... ..........X.\|. ..i.........1...3. ... ..}..... .

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_ARM64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	153760
Entropy (8bit):	7.998519956590656
Encrypted:	true
SSDEEP:	3072:13VR3UKV9VF5z3qEgKwGmrK7+2Um+uV3KVTOnxEQOGl2u4rDW7RVLJwU:Zv35V9VF5zXgNThuZpvUrwRV6U
MD5:	59A2D05EBEDE5C30A7896D31003363E7
SHA1:	8267A8FCB611A18099047BF7EDC3EDB3EAF2FE6C
SHA-256:	3CDAC6B2FD90217DA1060143FBD69D6BC725C13A26499AE528620F2F3932FD2C
SHA-512:	3AA4F90EA122B0FA41CA265AB232762E63A36D9A26DCDB9761B592E341E9EC549BDF7F23AD0F854B951D80CE4F4347DE5663B81416561A0492584D7469AA30C5
Malicious:	true
Preview:	7z..'.......$X......\........V;$.&..p.........../D.N..B...T.?{.P\<.A.').LH/U..c=.7fC.....Q....n..j)..0.v F..i=a.a.....z.V...~..hI.c...L.B..........i....+...u{.. ..{...2d..apK....$...M.(2..ds.Qg.T.".q...M.-bR..Y.%.miz..._..Q..{....m..R...GYQ.HH?...F...y[.1...F.&...!..L..%9...R.K.=..s..w.v.\|...i..%.}..X....h.tMVgv.8y.>..R$W.j.X.......4PK&..^+.....(b....[u.@..l[~.....Y..Gv......86Z#~....BB...RPF.Jd..LB.)...b.....%wB.B.K.bdp.R..?..=M....E(..\|./.p:Ye'.....M.s.:........hE,4...ctU...G./....)Q\....z...!W..e$...^`.rGN...Z#n/L..s..\|.Cb.......;..5.........;:.-...l.?.6..f.z...!.HK..'=..2..?...C..u{.p..b...y.,.1.;4...I.(......Z........]..E.....f...p..<.......:...M/..k..xO..".g.~...t.3L....[.`^U....;.....&..L......L..+.......H.{`...DF"...^.m.Q.......4...9.q.l.Y._....l..OI!0.>...Z....{.G.\|...H[.kd~U.............H......a..]r4.W.fh....G...7..&"X...}..ad8\|....5<:.V}..../...].>..a/....j.g....7.~-.1..(.UXK....Y.xb\|C.....9..hu..p.+YIk..P..{.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_NT32.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	190474
Entropy (8bit):	7.9988408146501
Encrypted:	true
SSDEEP:	3072:8sUCZVFKBg4zP+QTw0OsYjFl0VxC5hpmUU63zGxcZTvznuUgoIQYhF510daG3enP:jrEHrA7BGGfmU/aCnlgR17SdnuLj
MD5:	B3143D50A14BABBC53962F7249BA39F4
SHA1:	56A8D31995EACA817DBFC4767ACC5B167DD115CE
SHA-256:	667C1A6CF4A14556105D20B936091D159B33419DB18C571404C7F0A19840869C
SHA-512:	78C64A9DC22372A8E449E53FE7488218938084A064DE272B97E605786975DEBE939EBDD577597752BB1D8061F120E1972FCC6F05817FF926C13B0F8FFAFD71A5
Malicious:	true
Preview:	7z..'...R8O.........\.......@:/>.&..p.........../D.N..7A...ZK...@.....T......YU....H...M..7..g@.]...9.I..)=0.\.;...O...v.lw..ts}.?i.~....\....e.(>......rR...\^....E.FR.EB.$.~.+..U`...`..........l...._]..0.7.>Db.\^g...~.A..h.e..8.<E...D...sc....p.K.a`.K..-H....H..M.D#"..?AEVD[.J...R..6...2.._.....T.oQ>...N......>8.....3O./.~../....GO'>..0..<..}^....I.J....p.+.sF..Sa.u..B.~&L...0.......-..-:...=....f.....;p..]>....f>....?.....:u.1[.N.%P.<..%..+I/>...cA.2...A..#.O.Ft.`../.J$!k.oM...Z.6..L.....0..5.u....S..r..Z..~..yv...=..ln.......,`....t..k'e.Z..sH..E...OT..]..,.G....'..z..>.%.....;/....1-.)].....!(.^M1.5.7`....u....C.W.B...@ac....A.O.U...\.=r.;..Dl.^......duw...s..3i..j..q.....Y..Y.'.bw..x..:q.....w.......Wt..6....x..[P..EUG/.y.'e.....B.9s ?g~0I.._4 u45.JG..bq...p......@u..4...U)"..r5..mn..=..".V`.....:.....'M<....Y...c..s../.L..C...D._=y.....;X.\|"..Ig.#.W.D.Z.c.@7..*w..2..$..l....n.u......i.........z."#`[8.?`D..R....2=+....Z

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Mdp_X64.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	214069
Entropy (8bit):	7.99914416454149
Encrypted:	true
SSDEEP:	6144:34DDBFWPebanYCF4WEkGOgxt4+pmS4F2BiNNmspOA:WW/tatI+T4FWiNj/
MD5:	5A1C5E53F7A25409A519658FB3BCB620
SHA1:	9F3E322769AC53607D30DB7246D17CC3BF2B3917
SHA-256:	5993E99D4BE5024A42F7B84106DFB602F1A2AB5F2CAA5D7462239BAE83810805
SHA-512:	12DD4DEC837645CA7CDFD76AD8C02E2BFCFE0024FB4C6428ABA517746564959BB755129B7B050A36C9FB33591E80346964A185D2F89AC4987FC115EC7D93DC2F
Malicious:	true
Preview:	7z..'.....G..C......\........`.q.&..p.........../D.N..MhC.T.....n.......L.V187y.].'.U.G6P`}6._..f..;..<.....G./..8t..lf..0-..l.E..\|R.>oi.....2x1.w.XVF...MVY..\.F.._v.E7?1..v&..N).....}..f&....t.0..6..Wv..&MRv...?.e.-4`L:.{p....D....D. ...&'.F[R0..&.....w!......6.i...~..;....w..k.D.<......S..V.....FdI.jv....;.c..N`a....SO...........X.{...:....G...p.'-..P~..$b..A..{....Y.7.<k..o.;Sn.....\.....I..f..+&.J.r....y~\|.<...X.....2.h..9Br...+..a..\.&....._E...].N..b...yHjLC.{.......5.....).=..!.:.`..a{..+~U..]c@{..H.9./w:..".V-..kG.....R.T.....\|...\.N.F.~.,._.$X/..........wO......h..k5.Z.t+...y--U.........zt..s....9@...T.....1.y].VO...6........:.~g.{(..0........s.8.D"F.om..c`..j......&.w......GV...w.iaB.M.;5x.e5Y8.)....u.]O...y.=(.~d.......:^H.......BS...........3....T{[j...m..>..y...L../.6>!.!H&./.Z._@........l.qH._..n.....;f.F.T...#]...r.N..+\|7....2?...@.x.Y.{..H.-..)nUi..M...\|..G....6.179...Q.k."..I.....F....n.......FF..vu......e....&......>..%}F.

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\Update.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	2080368
Entropy (8bit):	7.999919546086242
Encrypted:	true
SSDEEP:	49152:60DB6LlrpGX+An8+mmAyoIsTCDPSUTd8ufBdYx6dHx9Wlavo1:6MglrpoRn83LODPSUx8ufEMd24vo1
MD5:	A3ECC684FA4206DC731D95B2A8B3116A
SHA1:	848487E820CD3602F502EE60F6F02BDD35F82C0E
SHA-256:	6017362C19BD19B5674ECBD08BC10A30F31B718F130353214768F58CF7522148
SHA-512:	B690A42943199D4B160BD276A4E0CE3BE72AA284440325CE018E5DA54AB5DE6659CB9D74F3A5C00145D961BCD77AA003E7796C2F978011DD406B6DA8890F1960
Malicious:	true
Preview:	7z..'......k,.......$..........-........f.Q=8.D.,.fL>$..y..w.z...FL.w.g..{t..l....#K.&Q..F.1.b.N..~... J...._,...1.8.(E`..B...\[L..../....Ba...0!...#M.L..{@...E...jr5F...+..V.jo..B.q.A..L.;.r..2.?V^..\...l.~p...H..xP.0.e.s......W.I.8.....]\|..%4~...}u>x!.......C.......:...C...4.I......>...h..V8$8w..&....c..}].. ..8.Es<..5%. #.w.B_<^u..p...+E.....^.'...Xm...T..g......b...:...u..w3.6..WC).3.r......7.._.......b...).7('4.^....5.t.:9W.>.@...,h."....... .u.Xd.%._).....}B.j.~..3.....u..P0..a..^...}E..h..x.oT............~4H...b`+...8.8e..HI.f...p...w7.j.n.....&.?~.+jm."..J.6#.}....n...0mw.\|O...,z.....Tf............@..F..^>1-#.kDL...%/x.Y...'.NSYr...r.>S.....)........p....4.=.6}....;....zq...8..^B3.L..u..O.5(.dD.D..X....\.xJ.........?T( ....>..f.%....L.=..V....t.nk.0z>.+...%...R...C.....Q..=.*...bEb#.'N....v.L.g<]..M'..e..8.?....kl.2rv..2G.../..4".Z_...N..>..z.n....:_:. ....E......O..W.#Ac.....=.<.......G....._.7.0......X........p.c..~Q..e$..i.l...7o

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\asdahc.nz

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	31717
Entropy (8bit):	7.99403404133069
Encrypted:	true
SSDEEP:	768:RTJZGkhc01BTRaR2Z86KdpZKD84DBNvGrM:RHRTJZ86kaBN0M
MD5:	6359B76DC845C26AF4CAE31320A0BF56
SHA1:	B5BCA8D4C431F9E840637416AE936382F3FB2EF0
SHA-256:	4EB74FAFCD85A21C3969AA7B3BEED9C74FAA80613337C98284076F7450310BE3
SHA-512:	6E5EDE7D50D6CDC556C0F895456C10EE1DF5A8CC72904593734BE7B7B091D0D232F87CA8F2E783D31ECE806D662334671EC80DC18F70CC86A2C22CFE2FCB441C
Malicious:	true
Preview:	7z..'....Vx..{......$.......e.:N.&..h..,.c.p.q...r.C3..xBP...4a.+.Kwl...#I...vF...f....1.(.u.............+........4...0..Z......`.#.!...1Y7..r...Mb.B......a...;. `L.g.m"...2.Z.\.b../..:..w....T..D."....]....t...........lNO.$.{i>..k0i..\G...h.....B.f.....r..N.m(C\....v...5eG..w...K..........[[U#....v!....5u..-..%..S..`.z~..d.v.,......L..3.......5.y8..<...Qt....\......B#.U.JL9.....-..6..fH...}..g...MP.? p,..?uq....y..O}..3...t......tg...p.^.f....L....2....V......-.w.pH..Wr.&,tt .pq.g..9..U.......1AC...&4@..6...Y..i.R^RV.j@.:..&..}.E>i.E.....V...Lfc<W{,C#(.#E..d%..dX`:...x..0m&...Fz.?...O...f.&?-....e...AH... .NXW...($..h..q..#Ubp.U..l0X_.......Pu.Fx.W....20.L.4.;.Y.g..k...T......~...+....&R(.e.O.........r.2.".(.w$....Ir....Q..p......M.....6.@m...2B9...c#0.....;..$...Kk#....pu....F.BTo..,...lF.f.....C...\|T.;K.(d.,..8.Y.D.....e.....'...=M**..6$:.)...zc...6\..EF.....y.8...c&x...6.6........3.W-.Z..T..yC.+>W..>`........H<...S..;X]...^(...i..

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\astxverify32.dac

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	Microsoft Cabinet archive data, single, 3382 bytes, 1 file, at 0x44 +A "astxverify32.daf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	14214
Entropy (8bit):	7.378812425706248
Encrypted:	false
SSDEEP:	192:MNH37HdCDXkPTHLVIYiYF82M34qFIIaih+noPOJB3hy2sE9jBF0NyKplAt:MRgGVIYitv14Pxh8E9VF0NyKPAt
MD5:	08CB57B4ECA5FDBB246C60C7C6172780
SHA1:	3F12C8FDB6CE49AC25E94C8DB8F4B267BE156723
SHA-256:	FA91CAA1CF4AB52DC3806FF6BF07E10B1B43EBFEB212D0766C729B8640962BED
SHA-512:	0B52C132917B69FF8D4026662D94E6D6A751239DEF1CFD98F6F7637B72CE244C290C3470C393D84049D0FCE8E3AC8FB4F6ADDD77738C09B3C7205080C073BDB5
Malicious:	false
Preview:	MSCF....6.......D...........................6...P*..........e.................DU9. .astxverify32.daf....h....[\]..aostrust.dll=1,906b599aadf4fd3c5368f639796802c2a7bb15457be8ba2a6a0b596a13703176..HsbCtl.dll=1,edd16144c76a9748ef37cb918b2df13f8ff8a2154a0c52fb02585c7c961c858a..IAccessible2Proxy.dll=1,b458f2301a7adc407e30431b683e31df428aba5bf60f5dbb3fc998da7fefde93..NzBrcom.dll=1,0fc64dffa95fddad32ed0b6aa8ac11ce7ae6286fb7616739a8674c2278fad50c..NzPlugin.dll=1,718bcae9185ca2fabe18a296fe8740c788b53b663c0c41155d1965a69a917cda..PdCfg.dll=1,dbdbc3c7500c3b618adb37b84d224bae3914c753e6b69e5d0784ec74d8f6bf37..powapi.dll=1,54bb997fc1da865ea298177e45724bef2f6384ca0a163c21cf7f0cee9429c737..StCli.exe=1,b0636deb5df92ee937cd941f2671518b0d39bb8dccb99735333dfb28fb869ecc..StCtInst.dll=1,55e2b12375d7aa89dd98d037b7b16cfb91e60ca0f193f850248a61efc9114e89..StCtl.dll=1,0771a2787efaa0b0acc438b44f68b93613c701d9a5143db2fb6a2cb5ea089bd6..StSdk.dll=1,3699b9257e05453557aa39ab2f8dc37b0ab6808fac40be16deabd612dcceb4db..StS

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\astxverify64.dac

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	Microsoft Cabinet archive data, single, 4213 bytes, 1 file, at 0x44 +A "astxverify64.daf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	15045
Entropy (8bit):	7.309565959654631
Encrypted:	false
SSDEEP:	384:UPkrSAcYqMIIYitv7XtLPxh8E9VF0NyH2H:3rS2RYitD9LPxWExU
MD5:	64935C224CC67758C80928AAAAC94E91
SHA1:	EE3666791A85BE10AA97F76B7F7EA144C031FDF1
SHA-256:	A3A59E3D4704317DEA5FBF8EBCC4AC388D9D7A8BD6BCD771BEDD8EF0F7F4DFCA
SHA-512:	AEDB49E48548B1DE1205017C22C076A01A7FD19D584C624E3706EEB706DD833B5867938C36FDB1DFA97AB1FAD52DD8784D4DFB70D0EA89C1C969E7D3ADE50C2C
Malicious:	false
Preview:	MSCF....u.......D...........................u...P*..........e.................DU:. .astxverify64.daf.mj[~....[\]..aostrust.dll=1,ecd20ee070fd8f0ec96033dd49a569bf8b50fc427b25d97caf2e1d5634871ff7..HsbCtl.dll=1,6ac3304fc9c8a6f4fdd8f06c8d6b36564c7221720a42d5748d190400c8c71fe0..IAccessible2Proxy.dll=1,9d30971f21a14cf7ea0e04eb70fc1b08903038fefc275b74fcd55e39ec23f687..NzBrcom.dll=1,c0bc98f6bec4833980dfbd8d85192b9ad9af77dc6c80dfef52a58025de312543..NzPlugin.dll=1,7717124cb6f5d87e64e20f97510cb14cf2bec36f7d560c85852d2704fc502413..PdCfg.dll=1,894351da16b15ed251441a9c859afb812491ae1acd91a3f39829e52714a7fb23..powapi.dll=1,c7a74cedc9e04d79d2de68edbcad9a96726c375179dc24d9e1ac0307cfdcbb02..StCli.exe=1,0ca7bfb5022796346780f441ac7dbe7369477f3fd8bec75de19f5bba09328ada..StCtInst.dll=1,f581e4492f3c8369bfb4d10ad63bbd5a1a56d86b6eac84c27e760ec2a2b5c710..StCtl.dll=1,576756155aa576960f059e78b5ab7de05889fe5cfc9ddf9714fd75b4ecfb53eb..StSdk.dll=1,4775a0f5eb9066da4ddd8ef63c35d30e77addb0b7d709722b9fade30d31daf1c..StS

C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\_Setup\astxverifyarm64.dac

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	Microsoft Cabinet archive data, single, 354 bytes, 1 file, at 0x44 +A "astxverifyarm64.daf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	modified
Size (bytes):	11186
Entropy (8bit):	7.620599932493779
Encrypted:	false
SSDEEP:	192:gIYiYF82M34qFIIpo2gl+noPOJB3hy2sE9jBF0Ny7Ll4lw:gIYitvJo9sPxh8E9VF0Ny7B8w
MD5:	AB7D099779E05C6A903121B4C82CCD50
SHA1:	7D3C60C011D491D22F38BAA3F691737E8C131A35
SHA-256:	C0ED9B0A0E05FB97C04F24F775BDCA3460C4BC0F3B66972EA0876912387AAE42
SHA-512:	3AC02A02D53993AA35F1A286C823BE4E3DE48F7B3D34A2058AEAAF6D47DA3397B27516EE3133DCD29357432C772F114DBB35A158D0FBDF20A0AEF86C767E4A03
Malicious:	false
Preview:	MSCF....b.......D...........................b...P..........h.................DU:. .astxverifyarm64.daf..]......[\Cert]..certutil_.exe=1,75ddab1826f220eb36a9eea9cf8533c94c19bac89d961380f3a418f6eedb2b4e..ca.der=1,fe46fd605fb59b26e2f8535d352f7c93f0e25431f5cd21231cb66f00ddd1ee9f..ca2.der=1,8a81891c6200605f963355a7d7b379221d4a14f2bc55c969353c04214a7c5685..0.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". {.I.H..<u.u....(v.ZfM.T...%.D]010...`.H.e....... ...+`..6Q....5.8o.a.0.!.{[..u.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AI7z20.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436856
Entropy (8bit):	6.390985511562089
Encrypted:	false
SSDEEP:	12288:yVOq++EqGck6Sx5YE+8nKN5wskrcrEv8kB8qCwotk:yVOOKvJ+8nKN5wskoEvCtk
MD5:	3A88ED9BE67C12569C6E7D5177FB97ED
SHA1:	D8E6BAFC094337AA311E58D2224C85974FD2D92F
SHA-256:	5C0AF86FD84878766D0E5CA746703AF514CAEB58B511EB183EC6D67BD3968005
SHA-512:	1E3D4C71C17EB462C24AD1E7A1B3B318507C46073BC11750F3B7327DB3BDF8A54920EE5B87318550AEC1DDDFEC3F6447EC7F7167181EB792FD6E166BAE496BE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h...N..N..N...N..N...N..Ns..N..N..N...Ns.[N...N..N}..N..N...N7..N..N...N..NRich..N........PE..L...!+.c...........!....................................................................................................c.......P....@...................)...P...@..@...................................................@............................text............................... ..`.rdata..s...........................@..@.data....}.......`..................@....rsrc........@....... ..............@..@.reloc..$E...P...P...0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AIS_PageProgramMaintenance.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	3.54394752836035
Encrypted:	false
SSDEEP:	24:QTzyegmh3QevC68mVU839pgveDmsC6wwz6BiCHC6gRCQuwK6B0CC1C6gw4oC3:kWEhfvumHjRDm8wbf6BuwHe6nd
MD5:	9EBE1DD2F5ED0B41A91CB483A6BDC988
SHA1:	FEFF72B8AC62BC03B294B695B0A713915C9DFE6A
SHA-256:	8E5CCABF15A84C4CCC407C482B378FC0B9CA5C8AF946540C392000AE0D2307CA
SHA-512:	15A952FBD06F4799A6A76C22B4DCAE7AC3722CA9E4FA9920C84625DADCF80C87BBD577E302CD3EDFF6818FA25255EA20AD84C513F551CE7D4C849EF472C148B6
Malicious:	false
Preview:	..;. .I.n.i. .f.i.l.e. .g.e.n.e.r.a.t.e.d. .b.y. .t.h.e. .H.M. .N.I.S. .E.d.i.t. .I.O. .d.e.s.i.g.n.e.r.......[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.1.....C.a.n.c.e.l.E.n.a.b.l.e.d.=.1.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....T.e.x.t.=.B.e.f.o.r.e. .p.r.o.c.e.e.d.i.n.g.,. .w.e. .r.e.c.o.m.m.e.n.d. .t.h.a.t. .y.o.u. .c.l.o.s.e. .a.n.y. .p.r.o.g.r.a.m.s. .y.o.u. .m.a.y. .b.e. .r.u.n.n.i.n.g... .\.r.\.n.\.r.\.n.C.l.i.c.k. .N.e.x.t. .t.o. .b.e.g.i.n. .i.n.s.t.a.l.l.i.n.g.......L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.0.....B.o.t.t.o.m.=.3.3.........[.F.i.e.l.d. .2.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....S.t.a.t.e.=.1.....T.e.x.t.=.....L.e.f.t.=.1.0.....R.i.g.h.t.=.-.1.....T.o.p.=.3.5.....B.o.t.t.o.m.=.4.4.........[.F.i.e.l.d. .3.].....T.y.p.e.=.L.a.b.e.l.....T.e.x.t.=.....L.e.f.t.=.2.0.....R.i.g.h.t.=.-.1.....T.o.p.=.5.0.....B.o.t.t.o.m.=.7.0.........[.F.i.e.l.d. .4.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....T.e.x.t.=.....L.e.f.t.=.1.0.....R.i.g.h.t.=.-.1.....T.o.p.=.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AIS_PageUnConfirm.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1278
Entropy (8bit):	3.597604350569883
Encrypted:	false
SSDEEP:	24:QTzyegmh3Sev5sC368lOLz6UeLogtUAK6dvy1CdCA6Tc8eJ8ToUoaCfo:kWEh1v5UzMogTKt1Cuc8s0oPo
MD5:	87F0EC57DE8EDF5DCCAB1FE1CF999CB2
SHA1:	0BD69F1CE3DAD5BA4D1CCFF887F1D9A1FBDDA005
SHA-256:	81DFCB505BCCAF66221C3604CCA286910A88539F6D8C8C103131357FE1160C25
SHA-512:	036762D3EBEEFA6B95182D989C0FA03009B82FD45700CD8FC23FA8E8C10FE3EED0392B122DE1D5ABBC295BA454CCFB7548426241AEEFC3659CF4B60AF46D353B
Malicious:	false
Preview:	..;. .I.n.i. .f.i.l.e. .g.e.n.e.r.a.t.e.d. .b.y. .t.h.e. .H.M. .N.I.S. .E.d.i.t. .I.O. .d.e.s.i.g.n.e.r.......[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.3.....C.a.n.c.e.l.E.n.a.b.l.e.d.=.1.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.0.....B.o.t.t.o.m.=.3.5.....T.e.x.t.=.T.h.e. .p.r.e.v.i.o.u.s. .v.e.r.s.i.o.n. .o.f. .A.h.n.L.a.b. .S.a.f.e. .T.r.a.n.s.a.c.t.i.o.n. .w.i.l.l. .b.e. .r.e.m.o.v.e.d. .d.u.r.i.n.g. .i.n.s.t.a.l.l.a.t.i.o.n. .o.f. .t.h.i.s. .v.e.r.s.i.o.n...\.r.\.n.B.e.f.o.r.e. .y.o.u. .c.o.n.t.i.n.u.e.,. .c.l.o.s.e. .a.n.y. .o.t.h.e.r. .p.r.o.g.r.a.m.s. .t.h.a.t. .a.r.e. .c.u.r.r.e.n.t.l.y. .r.u.n.n.i.n.g. .o.n. .y.o.u.r. .c.o.m.p.u.t.e.r...\.r.\.n.C.l.i.c.k. .N.e.x.t. .t.o. .c.o.n.t.i.n.u.e...........[.F.i.e.l.d. .2.].....T.y.p.e.=.C.h.e.c.k.b.o.x.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.8.9.....B.o.t.t.o.m.=.1.0.0.....T.e.x.t.=.D.e.l.e.t.e. .d.a.t.a. .t.h.a.t. .c.a.n. .b.e. .r.e.u.s.e.d. .a.f.t.e.r. .t.h.e. .r.e.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AhnI2t.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1459456
Entropy (8bit):	6.770690128600417
Encrypted:	false
SSDEEP:	24576:445SsevKQLVXYLazmrRo4NayLrRNjpfd4P/xlI5udREtVcOzMJWxer3PC:J5TOWrC0XQk4RG/0Wxer3PC
MD5:	D58AA52AE4F49DF7ECB594B2328A7A36
SHA1:	939A34535F1133D4904E05AA1D518580E70DA55B
SHA-256:	555DEE4D6B444253DF3D9F99A565A0623FE0301686142D79654865D648203188
SHA-512:	EDC908746102A7195340FFE44F2EBFCB3839E44E37D32CA979D6A5BF21C1B46AF39B614D047478B7FAC3D6F01C5D417723776013BEB4AB0B13ADC0AB6C7F6898
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................e.................t.....s.....b....d....a....Rich....................PE..L....e9b...........!.....Z...................p......................................w&....@.........................P,..........d....................&...............r..................................@............p..`............................text....Y.......Z.................. ..`.rdata..e....p.......^..............@..@.data........@...2...(..............@....rsrc................Z..............@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\AhnIEx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1601008
Entropy (8bit):	6.749281650919733
Encrypted:	false
SSDEEP:	24576:vedIJcNVXu2hBHfU+eraM8kOJAoy2eXWDhhOfrRP8HE+2EJfE9iQsnL44Euxo2Uv:qJHflhrGqkAJfEHKLZEux3Uv
MD5:	A349F78CBC6A07BDF100FFC6ADED53A5
SHA1:	CE33518766DAF017E8F06168217FA35E5FD35F4D
SHA-256:	80A61411DFE7A4F97B0FA2E5D5FE1138A1D60451EE27C37A7D3B2039A3D4DC83
SHA-512:	70F56E5EE2747151F3744D91E825ACB18896FC3E9E566531383C00D0288794D77BB6AF61ADF8C1E200B3081E4432D380E25E5399E00AE4C66E21D68CBE14189A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!m.uO>.uO>.uO>...>.uO>..">.uO>...>.wO>..4>.uO>.uN>.tO>...>.uO>...>.uO>.'.>.uO>...>.uO>Rich.uO>................PE..L....+.c...........!.....R...................p......................................xH...................................%..,............_...........D...)...0......`t..................................@............p...............................text...NP.......R.................. ..`.rdata.......p.......V..............@..@.data............$..................@....rsrc...._.......`..................@..@.reloc.......0.......d..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.530178179336849
Encrypted:	false
SSDEEP:	384:0Onio7tgOO2GaW2zcjpAT5t6CdAtBZaL3:Lio7iO0izKwLX
MD5:	180E0A28B7296E818C3135BE5D8D7B60
SHA1:	4F8B369F18AADEAB0C1598EECCF4546BA19E2EAC
SHA-256:	E5E1DAE700AACB3FED1AC4725B6AC546B5AEB10A34B57D33767C50B8D117D98E
SHA-512:	EF6B5E6A2329D47DF2C5E510F183371D97106EE9521C4ABAF5632C0DE6F9422EFE27B5AE3FBDBB6F5B9EBCC77CDF10C9308DD7CC828CB0B2C41D4AEB18FFDCC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T.h...h...h......h...h...h.......h.......h.......h...:...h.......h..Rich.h..................PE..L....v.`.........."!.........^...............0............................................@.........................0?.......7..................................p....................................................0..X............................text............................... ..`.rdata.......0......."..............@..@.data....E...@.......2..............@....rsrc................6..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\NSIS.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	17031
Entropy (8bit):	7.429641447353002
Encrypted:	false
SSDEEP:	384:EUdO7g3lNIYitvz+asm4i/8E9VFL2UtVV:EUdHEYitqazeEdj
MD5:	4FA154851FA10EA7EF62D063FCD0FD6E
SHA1:	51D4ADFC6C533DBC2D0C6B0CF972A49CF7575E21
SHA-256:	902B98ACBE2CCF435233FA1ED00F623A714FDF107851975494832B1D730A897E
SHA-512:	D373D0052DD8F2B705857ADD0B3A7EFB8C476C0C3BE2ACD11974F617F8F697D28A2AA012AF3E47D73A31304FB54F3BB62CB76A9E63D27949B90794C8DAF2AAB7
Malicious:	false
Preview:	0.B....H........Bt0.Bp...1.0...`.H.e......0.....+.....7......0...0...+.....7......"L..+.N..fc.v....220627014823Z0...+.....7.....0...0...87.#.(s..4.\F.q...1.0...+.....7...1...0... ..$.6Ro.-??+.d.1.w..`..#..C..61q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..$.6Ro.-??+.d.1.w..`..#..C..60....i.$..4..W......B<1.0...+.....7...1...0... ...k....3..B_.Gwn....$N..I....1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...k....3..B_.Gwn....$N..I....0... .;..Re...5...9..D......FZ ...KiE1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .;..Re...5...9..D......FZ ...KiE0... .X.p.u.J....].=...\|Y...n...x..1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .X.p.u.J....].=...\|Y...n...x..0..........i..2{W....(1.0...+.....7...1...0....u..npk+.<.<"...v.1.0...+.....7...1...0....n....A..i......u{b1.0...+.....7...1...0... ....P.7..;R.\....R4_....y...H.1q

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysARM64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	153072
Entropy (8bit):	6.2301561470407965
Encrypted:	false
SSDEEP:	3072:Kbc36cHuoZpNTPMgwJSGv4YI99dHE92CJAnz7:f6cOo9QgCiL9wUUG
MD5:	187F718574449F0721E558D3D89783A2
SHA1:	D37763D70BE02460BBE4CD6B295604B39C69E783
SHA-256:	E82C7B82CF04419A843FF01F888675313E1CA8538E4EA99F05BCBB0573596D73
SHA-512:	DAA08632C767D75636251A70F635C70477250E2F5509482BE7CBA29B64544E1A297743507DA1E7D2D560BF3104593C7A612D96A07547B8C9725B6797EA4A3ED5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8a?.\|.Q.\|.Q.\|.Q..dT...Q..dU.v.Q..hR.u.Q..hT.[.Q..hU.m.Q..dP.y.Q.\|.P.$.Q..hX.y.Q..h..}.Q.\|...}.Q..hS.}.Q.Rich\|.Q.........PE..d...U+.c.........."......p...........>.........@.............................p......R.....`.................................................l...<....P.......@..@....,...)...`..(... ...T...............................................h............................text....n.......p.................. ..`.rdata..f............t..............@..@.data...`%..........................@....pdata..@....@......................@..@.rsrc........P......................@..@.reloc..(....`.......$..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95728
Entropy (8bit):	6.247442837433356
Encrypted:	false
SSDEEP:	1536:BTf2PX4eca4nIT/0qA8WMpefrbMd+oQXjzGvO7L8TJuJMQJL+54ba0y7uON:Jf2v4VITcq4NfXMdxQXGO7IP2L2D0y60
MD5:	9005E21833E657558F139A3D3945C97D
SHA1:	1490E4F3F34896D326D3369EEB6AC5A3C7C83C75
SHA-256:	1AC25B1DEDF7DE0D7B126B15BD455384B3CB6D6A321AAB306649F363E52213F1
SHA-512:	124DC648894C39A8410654FE5EBFF0594CC57192F6BC3FDE67198B26A529A9347BBD2B95ECF47DC26C695D60EB9002AA5BE3F97A0B80EAADD0C66B8B9A992B3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}..p...p...p..T....p..T....p..T....p...q...p..T....p..T....p..T....p.Rich..p.........................PE..d...'+.c..........#.................`L........@.....................................:.......................................................<(..<...............H....L...)..............................................................p............................text............................... ..`.rdata..^@.......B..................@..@.data...D5...@......."..............@....pdata..H............4..............@..@.rsrc................D..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.8749018746022035
Encrypted:	false
SSDEEP:	192:aS8LqFZBOtRG/+VE6HwIobhj+PJu97wI88QF+wnazLL:/ZQtsh6HQdj4OnauzLL
MD5:	1C6C387F9A72F7CC591B0C296EE8C58B
SHA1:	D167CDFC4F8D0265299AF33DEC4EE5E3B84FBE41
SHA-256:	18C7E74A71E88CCF61795DCD4E8DFF42318CF1CBB3C1777F312DD7B45ACB4BE3
SHA-512:	5950456B4032736AA0DBB0C9C273C25F394696134C1EDF4D98346D9AC3A1158B10B83FADC85A976219730BBCB4F8A618DE237C96CA094E5F766FC2F963D9DB1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~_...1...1...1..M....1...J...1...0...1..g....1..g....1..g....1..g....1.Rich..1.................PE..L....v.`.........."!..... ..........]&.......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata.......0.......$..............@..@.data...D....@.......(..............@....reloc..~....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKE.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110904
Entropy (8bit):	5.727949815668744
Encrypted:	false
SSDEEP:	3072:h9eJxJSRE87TODAFI7c2Hnye0JoWV/cw/L:brRE87K0F4jYoWpx
MD5:	ED19F652BB5A53BA04EFEDD277808D44
SHA1:	27C2C3F47048557E8241B86F9A41FF87CA496BB1
SHA-256:	03E94DBCC74E14927EB77361C98513464CD36797E2C99A47EAD5ACD2F270697C
SHA-512:	BC2902186FB7F6AE4225FADF8DE4EF170C5078CE77AF701080752A52B07E68926AFABA68B7145B3063D0AAF5320953E8782B8BC19C3668B5A8EA34C2DB51F730
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4..4..4..BL.3..BL.6..BL.?..4..O..BL.'..BL..5..BL.5..BL..5..Rich4..................PE..d.....Mb.........." .....2...........=..............................................]4......................................................X...x....p.......`..........8#......l....T...............................................P...............................text...^0.......2.................. ..`.rdata...@...P...B...6..............@..@.data...0............x..............@....pdata.......`.......z..............@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AHAWKENT.SYS

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76744
Entropy (8bit):	6.278803320665906
Encrypted:	false
SSDEEP:	1536:z/AIFd4bP9qNlbMLoGGRnNFzp47dal4MW:z/9d4L9Q2LoGWbiIaz
MD5:	6DAEEDE536374A5A1106D140EB39E36B
SHA1:	00CD82052C3FFE6E8CC59488FDFA34FA21B65334
SHA-256:	E51FC1DC8FEEBF82F2A197E88001787986239A29B984A24BF9B7C74C8C2D7248
SHA-512:	AF74D2FBA0E2657DED5873F5EF9FC2384ED98774530F7478848076AD902ABFC66C151A402A9D263FD8B8B1CE22EA70439E7B0E54750BD5F57DE2FB6FF19D6F64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."<..f]..f]..f]..f]..;]......e]......d]......c]......h]....d.g]......g]..Richf]..........PE..d......b.........."..........&.................@.............................0....../.....`.....................................................(........................O... ..8.......8............................................................................text.............................. ..h.rdata..T...........................@..H.data...p...........................@....pdata..............................@..H.gfids..............................@..HINIT....\|........................... ..b.rsrc...............................@..B.reloc..8.... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AKDVE.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	174104
Entropy (8bit):	6.091677837548821
Encrypted:	false
SSDEEP:	3072:LQt0KzIz50IQkKPB+Pyz3L2YJ7Ssamp+7QF6zxNRx5ejJJVEN2L1FA4:LcRLLiU2YJWsf8bejJwG
MD5:	31C67060D0B9AAE5C7DFF17EE79996E4
SHA1:	133DEF015F0E64EFC31C55B3CF36FD2404911937
SHA-256:	F7A7059CC4485067B6517DCBAA4239DEC8294017E50791966E06EAF5F90CE5D6
SHA-512:	72C0EB5C9D87593E32FE34934E138D1152CEFD335D4AE9883F04A4CF88EF864F6303B62CEB9BA976B88C6F97B75B36AFAD4FB0EB0C8E671039B0576DC11E12D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........yL..."..."...".~m\...".O..".Y..."...#..".L..."._...".^...".Z...".Rich..".........................PE..d......b..........#...........................@......................................R.......................................................R..(...............\....~...*..............................................................(............................text...>........................... ..`.rdata..............................@..@.data....h...`.......D..............@....pdata..\............`..............@..@.rsrc................z..............@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ALWFCtrl.Dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28416
Entropy (8bit):	5.965375645303923
Encrypted:	false
SSDEEP:	384:c3nkC0P0sL1O0znXoClBwPYNkmLDEMjFrg6hhZsHLAbhrc:AULw0kPwNhEM1gECqhg
MD5:	7CDBC107A646C1B9852C7B5730BF87C0
SHA1:	F8ACFB2CC9EA88521A6630C3286B16CB527EDB8D
SHA-256:	77CDB6B95CC6D1F4A83E306A6EE0A5BDF907D27435F96AC43D181E522DB968BC
SHA-512:	BA9574454335447635C3E0D9CAC1983A7DCA697FCE58A0A81F33B713FE5B8ED592C9D969606BEB24E2057D47479837F52EE7E020EFD9FA1C78DB30102A5666FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1`2.P.a.P.a.P.a.sa.P.a.P.a.P.a.ua.P.a.ca.P.a.ta.P.a.\|a.P.a.ra.P.a.va.P.aRich.P.a........................PE..d....w.`.........." .....B..........,E........@..........................................@..........................................P.......K..d............p..d....R..................................................................h............................text....A.......B.................. ..`.data........`.......F..............@....pdata..d....p.......H..............@..@.rsrc................L..............@..@.reloc..$............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW7.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	203320
Entropy (8bit):	6.081440173056831
Encrypted:	false
SSDEEP:	3072:NSqaFZPabZ5eABbf0hs0LHOBcYL0i5DnZhn3Ttj//M6sawe9j:N/ew550hs0LHOBcYL0iBnDBA6l
MD5:	02E548E0641ACC66791036004D3098F8
SHA1:	A118739E2A62EDBA5241DE550BFC57C784F62409
SHA-256:	BFB270C00D7DBEAEAD95DBE9630EA37F4307A01E5D10324EF87E3DA6D075622F
SHA-512:	822597FCC34E0F0E1FB8957DE8CF2CD30271156550A7E10611236A2336B68B1D9576F1EB25D65320EEB3CA02E3DC84AAC5345067A6C17DAFD24A44E10BEDC544
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........l...l...l...2...l...1...l...l..#l...1...l...1...l...1...l...2...l...2...l...2...l...2...l..Rich.l..................PE..d...@..c.........." .....l...X...............................................@......# ....`.............................................8.......P.... .. .......t.......8R...0..(.......8........................... ................p...............................text...OV.......X.................. ..h.rdata...3...p...4...\..............@..H.data...............................@....pdata..t...........................@..H.gfids..............................@..H.edata..8...........................@..@INIT................................ ..b.rsrc... .... ......................@..B.reloc..(....0......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonCDW8.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	217024
Entropy (8bit):	6.073394498066033
Encrypted:	false
SSDEEP:	3072:Sjht+WSzFSBPYgMshsIMIwkFbMpEjaGceGh7hSKOVDthtDZop/U7q:Sl1SmQgtMIwkFbMpEjaGczhEfVDPtDAT
MD5:	3F24CAD3EEBA3C4E598BDED50814C3C2
SHA1:	7D148267FF92168E5735AE0EDE068BD598AF2219
SHA-256:	401206A4B7445D9B01742EFD1C73B20EC3B550166D5A38BF2FEB039996E3BD08
SHA-512:	A6955C9A7CF89C2438F1020F13D732284056E38332C953EFDAAFB6A852CF4E225ECE235BC2AC017369CCD730A10593AB73A79785359CA3FF73986EE5F6A6A25C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z+...J...J...J..s....J.......J..s....J...J...J..s....J..s....J..s....J.......J.......J....u..J.......J..Rich.J..........................PE..d...@..c.........." .........`.......0.......................................p............`.......................................... ..Y...\0..P....P.. .......(........O...`..(...0...8...........................p................................................text.............................. ..h.rdata...8.......:..................@..H.data...............................@....pdata..(...........................@..H.gfids..............................@..H.edata..Y.... ......................@..@INIT.........0...................... ..b.rsrc... ....P......................@..B.reloc..(....`......................@..B................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonHKnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89160
Entropy (8bit):	6.1361091588452785
Encrypted:	false
SSDEEP:	1536:Erdv8izdNIsQ0WkcRBjH7unccGxNzuw67eQ:ErZZvIOefoccG/v6aQ
MD5:	03186C8DF0EDB6AAC7AF1682BAB6CF2B
SHA1:	7810E6D751DEF6CAD76AFD3B3A0AC6C5E433417D
SHA-256:	C847C2D3AC4DB2AB38A966CD8BCC82C504F8B60183E8E8973E062A1F1F47F06C
SHA-512:	1FEF416C4C976B465F0CDD62A514E0D96016A56FE57D5287AD7B23854D014B6C7D52D5F63B55FD766EA9DE0A16E97CE3E019F2A6104D9EC2227764E13A25B15A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..}..}..}..}......&..x...&..\|..Z}..~..Z}..\|...&..z..Z}..\|..Z}..r..Z}..\|..Z}..\|..Rich}..........PE..d...'&.b.........."..........$.......0.......................................`......?................................................ ..3...d0..<....@..........D.......HR...P..........................................................x............................text...y........................... ..h.rdata..L...........................@..H.data...............................@....pdata..D...........................@..H.edata..3.... ......................@..@INIT....^....0...................... ....rsrc........@......................@..B.reloc..0....P......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	8421
Entropy (8bit):	7.22148801908308
Encrypted:	false
SSDEEP:	192:nX6H320oECl6EBmMBWJdZ2Mf5rfoEXpBjSou:nq7m8SmJdZ2OfXXpBjhu
MD5:	E9BDC36F448FCC137B9B18A37E8BF9B5
SHA1:	86E81D59DED13EE3532438DBF2903053B0550C43
SHA-256:	E6960D20598A27B8154B75AB9BE5DD8186E5D38CCD720ABD48CCB1A76334C20B
SHA-512:	8CB667AB6AB32AADF6DA68A87CC2B9A9D6205E25EDD7D6274BF7E17100E2A7E031ED9676B89619CB9192F5AB9E2F4D8E2CD97933DD73591A1D40E4D9077A0F3A
Malicious:	false
Preview:	0. ...*.H........ .0. ....1.0...+......0.....+.....7......0...0...+.....7..........jK....M.....190704061909Z0...+.....7.....0...0....R0.D.8.A.7.B.E.C.5.F.A.B.C.9.2.B.C.6.5.A.6.6.6.D.E.E.C.7.C.0.7.3.0.C.9.8.A.D.9.F...1..)0<..+.....7...1.0,...F.i.l.e........a.m.o.n.l.w.l.h...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........{._..+.Zfm...s....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R6.9.F.C.F.5.3.9.C.2.B.5.C.E.2.5.F.8.6.9.4.E.D.3.A.1.E.B.2.6.9.9.B.E.D.C.7.B.5.2...1..10<..+.....7...1.0,...F.i.l.e........a.m.o.n.l.w.l.h...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+........i..9..%.iN..&...{R0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......}0..y0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2979
Entropy (8bit):	5.1590609752075585
Encrypted:	false
SSDEEP:	48:/ZHNMJmrGhDugBq0FIlDV1qXmHhV3tFiRFZeDRHgDW1dDoFAqQvo2nxsp5+y+anD:hHNMMGJuf0FY2pGXfZv++yB3uHpS
MD5:	E22703E733A5569D0D199462EA8F6D69
SHA1:	0D8A7BEC5FABC92BC65A666DEEC7C0730C98AD9F
SHA-256:	0DEA44212B3DA0228E9D33CEC47CBF531D2A94B4A5B1BD5B7366A69FC0299B23
SHA-512:	20C9BAD169AC28A6FC1C2A2688F9AF270F6E5BC11CBE8EBA2233D1BE0112FA0A647F34921840AA16DE3601AC28178212ED73ABCA950731C39C2B73DD80A9C1A6
Malicious:	false
Preview:	;-------------------------------------------------------------------------..; AMonlwlh.INF -- NDIS Usermode I/O Driver..;..; Copyright (c) AhnLab.Inc All rights reserved...;-------------------------------------------------------------------------..[version]..Signature .= "$Windows NT$"..Class .= NetService..ClassGUID .= {4D36E974-E325-11CE-BFC1-08002BE10318}..Provider .= %AhnLab%..CatalogFile.= amonlwlh.cat..DriverVer.= 08/25/2014,4.0.0.20....[Manufacturer]..%AhnLab%=AHNLAB,NTx86,NTia64,NTamd64....[AHNLAB.NTx86]..%ALWF_Desc%=Install, AHNLAB_LWF....[AHNLAB.NTia64]..%ALWF_Desc%=Install, AHNLAB_LWF....[AHNLAB.NTamd64]..%ALWF_Desc%=Install, AHNLAB_LWF....;-------------------------------------------------------------------------..; Installation Section..;-------------------------------------------------------------------------..[Install]..AddReg=Inst_Ndi..Characteristics=0x40000..NetCfgInstanceId="{4F9A48F2-91CE-46e7-98CB-582B8EC4A3A3}"..Copyfiles = Alwf.copyfiles.sys....[SourceD

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonLWLH.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71320
Entropy (8bit):	6.508611684996172
Encrypted:	false
SSDEEP:	768:x6itx1u/C97GTjkRHS4/X9HwjQzLBPrEb7+KvFg911tC8pU/Aa+3p23+zjx:faaQ/kRy4FHTI+8FCtC8iYI0x
MD5:	431E04EBDF9BF0403EE689F8A1DFDFC3
SHA1:	E74E4846A34D29A4373FAE1230388411BF2E83B8
SHA-256:	187A08D268EF09AA7C9EDF6C49642451FF14BA7455B0A8F01B0585FC8B2B2AAF
SHA-512:	46174E1BE2BC7D8AD0B89A6ECE07730408A35399CBF740FC69FAC7040A60782E70C2443C1976C5530D33243FD29D0EB3304B04A13670CE435BDBE72A17DDE51C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p...#...#...#.s.#...#...#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#Rich...#........PE..d...m7.].........."................................................................./C..................................................3...d...<...............\|........d..........................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..\|...........................@..H.edata..3...........................@..@INIT................................ ....rsrc...............................@..B.reloc..0...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDLH.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155488
Entropy (8bit):	5.971299991395469
Encrypted:	false
SSDEEP:	3072:XjAmskv6L/Ec8EZ6wi8e5KNBSUC6A8VW1Lz3Cm+:7s7L/Ec8EZ6wJe5KNBSD6A84h
MD5:	CA458A30EE04278B2C99B4F9888A456F
SHA1:	2A6BCA16ED7ABEA6489F6808CD2F7960667C32D5
SHA-256:	A36452DC60A867925CD836C530FAA37ABB7164E9B57BEB8F41FCC8F1657A73EB
SHA-512:	57751042F276CE871D9419CCF03C837D41C3446EB8D287DC4686F4CE8A317598A5F70B639BBD4C5D4248B78B826527D339D944B15D9DEE836DF89FC13455D7EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D..D..D..)..D..E.].D..S?..D..S..D..S9..D..S)..D..S>..D..S5..D..S8..D..S<..D.Rich.D.........PE..d...=.Bb.........."..........>.......@.......................................p.......P...............................................0..8...d@..P....P..........\|.......`K...`..<...p...................................................p............................text...`........................... ..h.rdata..............................@..H.data...x...........................@....pdata..\|...........................@..H.edata..8....0......................@..@INIT.........@...................... ....rsrc........P......................@..B.reloc..P....`......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AMonTDnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	170848
Entropy (8bit):	5.90588176587215
Encrypted:	false
SSDEEP:	3072:GOqYDDZ3x9YQ+DqksKRHa5KNBLtuAiTradIa79:FnZ3xq3DqksKFa5KNB5uAq0
MD5:	D574CE304863D2596EDA05616D20D69B
SHA1:	46E0D6495233099ADD799094B3BA5A9D6D69C4E8
SHA-256:	F8C950DDE7397CB2FD7794944024BC282EF50EA5D8E785E72FA2F9B60557C1FA
SHA-512:	58D84A95110A81DC6C5E8E3F25C599456C2BCAF1E4076644DA658980DB463B01D5869765E114EFC8D745973C50F0C5BE921226C8DCB8F41B5D0D7FBBF1CF3FFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......GZ7-.;Y~.;Y~.;Y~.;X~.;Y~u."~.;Y~$.4~.;Y~$.$~.;Y~u.4~.;Y~$.#~.;Y~$.(~.;Y~$.%~.;Y~$.!~.;Y~Rich.;Y~........................PE..d...=.Bb.........."..........>......................................................8................................................p..8...d...P............P.. ....P..`K......H...p#............................................... ..p............................text...`........................... ..h.rdata....... ......................@..H.data...0....@......................@....pdata.. ....P......."..............@..H.edata..8....p.......6..............@..@INIT.................<.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2618896
Entropy (8bit):	6.223663881006674
Encrypted:	false
SSDEEP:	49152:5TjfSk18xCIHJ+zVPbKONmcYuDVTE3AQREHwQw:hqk1WOV6um33/
MD5:	F6262C40F3D682D635466116FFE5BA99
SHA1:	FC05D3CAED28C00F834CDE01FF6C8224801DD5E9
SHA-256:	D0BC7D93E65D432849C7160A4B6BEDFFE993959F4ADA4F45B9EB03E2720D6636
SHA-512:	D9B89B2C0A1EE849A5D36AB8E01497D8EB5DF70F2D8C6F802B8BC9469542454E9E45EE1AE4788A222DC88C830C50562EAFA8D60A893CA6B6A5AA38C0C6733155
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J...J...J...2>..J..w.;..J...28..J...-..J......J...2$..J.....J...J..tK...2...K...2)..J....9..J...2<..J..Rich.J..................PE..d......c.........."..................W.........@..............................(...../.(...@.................................................8.".......&..G....$.HA....'..*...P(..@......................................................@............................text...[........................... ..`.rdata..P...........................@..@.data.........#.......".............@....pdata..HA....$..B....#.............@..@.rsrc....G....&..H...,%.............@..@.reloc...W...P(..X...t'.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDCr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2306576
Entropy (8bit):	6.281607739604203
Encrypted:	false
SSDEEP:	49152:1b3GL2/BAJFfv9W4FAkRmeapIJJVJs/z+7Fld:0b9cpCU/z0
MD5:	C565A89728AA7EA21173C3026B65B578
SHA1:	1360FF431D6643125A9D1D17AFFF799BE3A64C96
SHA-256:	27E6E31EE68A2B9EB5BFA3E3E23CFB1C6145DDE0137D72356DD96ED083E2F3D4
SHA-512:	72860A2123CF2B2BB94C7E712D2DDF07383EE2415DEF30A6BE64DAC637ACF41A7FE05EB6313815530185C58E89DEF354656E3F141F7FE531CE46EC2B67675CCA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............T...T...T..;T...T..>T...T..=T...T.b(T...T.b.T...T..!T...T.b.T...T...T(..T..+Tc..T..,T...T..<T...T..9T...TRich...T........PE..d......c..........".................L..........@..............................#.......#...@..................................................X.......0!..G.... .......#..*....#..<..0,............................................... ...............................text...\........................... ..`.rdata...]... ...^..................@..@.data................j..............@....pdata........ .. ...N..............@..@.rsrc....G...0!..H...n .............@..@.reloc...P....#..R....".............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2298384
Entropy (8bit):	6.289632942546819
Encrypted:	false
SSDEEP:	49152:Vr2gLf6YugF/klPsgAOxwArZ65ZoKW4q77giVo:9Hxq9gZjW4KC
MD5:	860F0CF335B1F73C6F94C71BFF47FDEF
SHA1:	5A788155C8BD59927BF80107531C020D400B1CB5
SHA-256:	487429458A15DEB08E95AC350D647A075C818BBFBA33FCC0B9574871E185C156
SHA-512:	313B92C5D7F28EC265DEAF1C5CD1C3AEEA817E67C41E7D0D48A1BC857647D8CDAA3957BAA0F1AF32B02F54A1E053E0E43B67EF365E2AE733857FDC13F2EBD83E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7&..Yu..Yu..Yu..u..Yu\|..u..Yu..u..Yu.-.u..Yu.-4u..Yu.-"u..Yu..Xu_.Yu..u..Yu..u..Yu..u..Yu..u..Yu..u..Yu..u..YuRich..Yu........PE..d...=N.b.........."............................@..............................#......d#...@.........................................@v..^....O....... !..G.... ......."..*...p#..<...,............................................... ..(............................text...X........................... ..`.rdata...V... ...X..................@..@.data....\|...........^..............@....pdata........ ......2..............@..@.rsrc....G... !..H...N .............@..@.reloc...P...p#..R....".............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDUp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2538000
Entropy (8bit):	6.277489867801208
Encrypted:	false
SSDEEP:	24576:NUgLUvUFseaaY7DrZIJS1GGiFprfHRrgqhrifzh9Us+e5GT7heCq9pL1vGH1w4c2:Vz3eOH7fHVgNf99UDuGX7qHcw4QcYyiC
MD5:	3419752301BFE5EDCC0CA04D7F7B967F
SHA1:	BE54DA092E99904B788F43A5305EC78F73381345
SHA-256:	FE382DDC150F35ADFD9FB127FAEAE60A88A4955719D13824D7ABB8E2A6EF79A8
SHA-512:	189F306C333659074709EC10DA7A5B8BBC9FE0F159E569C659AF71D193A153D701FF9825A01FB9FB5C8351946D1A9FCBD3EF9FE690C13337E247B15C962267B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VEl`.El`.El`.b...Dl`.L...Il`.b...Dl`.L....n`.L...dl`.b...Tl`.Ela.vm`.L....l`.[>..Dl`.L...Dl`.RichEl`.........PE..d......c.........."...........................@..............................'.......'...@..................................................!.......$.(}....#..3....&..*...P'..?...................................................................................text.............................. ..`.rdata..............................@..@.data.........!.......!.............@....pdata...3....#..4....".............@..@.rsrc...(}....$..~....#.............@..@.reloc...W...P'..X...8&.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDWsc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1780600
Entropy (8bit):	6.470676233509427
Encrypted:	false
SSDEEP:	24576:Bml7cqS1GGiF6D81NYOozvytJcFCbhwPooNWKqZHR+6FTpo9bgDs/YU:mIOEo1KdvwJQCbmPooNW/ZHQioxgAYU
MD5:	D77FB51F3CB0C0156927963B7F613F38
SHA1:	297ED36F1820A8B34BEED4598E4FA7C4DEE2D0DF
SHA-256:	94F502D47E5D775CB9ABA572089532EC4066C921C9FE1D099E98275180DB4ADF
SHA-512:	E3BA0F46444F578F2393AA54578C86DDCBDDC6F45A9CCCB2EF8B37EF0ACA140056661302ACF823DF61FC528248662E028E8B697360DCF954D86E3C992CB24F84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............R..R..R.7.R..R...R..R...R..R...R..R.7.R..R..R..R...Rm.R...R..R...R..R...R..R...R..RRich..R........PE..d...J.._.........."......<...J.......4.........@.............................P......e....................................................................B..............x.......p9...Y...............................................P.. ............................text....:.......<.................. ..`.rdata.......P.......@..............@..@.data...x........,..................@....pdata..............................@..@.rsrc....B.......D..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASDi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4127760
Entropy (8bit):	6.128172986872311
Encrypted:	false
SSDEEP:	49152:hyCl8qkokj/jLWcNylUSh0fVzkp5r1PqKrv1DXBy23o50bB7zX:jej3fYg0FXS585
MD5:	751C5B2493358445FEFAF7D5BC87A077
SHA1:	9E90206615D6D0BE8DEABCDE44668BDDFB5D15A7
SHA-256:	D1D41CA9AEEA38A48BD41CB1DFD77E2CDAEA65566680F6B75BBCA290D4814AF7
SHA-512:	B2AFD9DEEAA5DAA4DBA462B09419DAD9DB4E3A72F96BEFCB7C2E2EF90B28456007F50C5A0DC0A8885194F72670BD3FB0FE7AE254E5FF356FF0480D351AC0831D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t......q...}...v...S;..u...}...p...S;..u...}...U...S;..g...t...p...}.......}.......}...u...j...u...}...u...Richt...........PE..d......c.........." .....@-.........h.,.......................................?.....\.?...@.........................................@.;.\.....:......0?......0=.......>..*...@?.DW..P`-..............................................P-..............................text....?-......@-................. ..`.rdata.......P-......D-.............@..@.data.........;..N....;.............@....pdata.......0=......N<.............@..@.rsrc........0?......N>.............@..@.reloc..({...@?..\|...V>.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ASTX10_ico.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	121112
Entropy (8bit):	5.587285050501772
Encrypted:	false
SSDEEP:	1536:gG7lJ2F0jYqHou3B8+xwpyYkkSg1zyoCU9kkkkkkkLkkkmkkkXkkkkkkk2Ykkkks:J7/WC93B83Sg1dClk
MD5:	BA7259E0EEDEB95B685B2D8E76D93F22
SHA1:	E866C8670F9DA7F5B8CB775B0FB63B27A13B267A
SHA-256:	E0A29D0DDEDCC1DFA933B8535AC99CC9EE2F3979118747641D3B0B43EE68A591
SHA-512:	9A5819F67B60F39DB3141E1CF7D88CA550AA3086C3A242A05386B197D965417DAD8F7E7C58FC3D417B10B1D453A9B76F00530B32335B583346DDD648E5673B5A
Malicious:	false
Preview:	............ ..J..v......... .(....J..@@.... .(B...R..00.... ..%..... .... ............... .....(......... .h........PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y..U.......L.e..$$..J.%./."....W^AP6.._......uy.WT.UD.....-..}..d.....Z......0].=..S....%U}.n.s.=..s.\|.....R8.S.}:.EML.[h4..#.G H.8t...Y-bC...e.P8...>..x-.O.P-V.%./lI.s...e.......$.>;..f..W.#......\|.P.D.6..av...l0.......f e..L..e.fl.u......s...AI@."....Arn..>...R..=c.T>..W.%.f.....51\|.b..`X.0...M..>.....(...H(K+..@;2._.SFn.8...#..1..(.l........%a.....)t.'.2...,.+.." ....:.D.us..3%.........(r.S.......:...pJGw,..f..7....p.e.......)...&......._..).&... .mK.}.........Dj.d......<.`N..mI....'{.L.....@.a.Lyk.].f.]m2(...P..Mx&Scy.UA..%.....G....JT......(..cdK.}f...=f......:.q....o..h(.!.p..a.m'E..g..C..7.G.1.W.E@.....o...c...t..T.4.k....$.&. ,9..&...ZI/...;...s.\|.P.$LV..}.8...2L.'R...u.[..2..2d...6?D....^..I..........f.a.....t.a..O..w(.h.3!.BU..6.)b...,#w....2...@..-a..b....i....5..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATampt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1698296
Entropy (8bit):	6.449038943875198
Encrypted:	false
SSDEEP:	24576:2/iJicTS1GGiFpP3ROmr1PA7PUrnVa9NtQEqayUQAZ7jGgN:2/Xcp/3RO41WsrVCHVVyUXZ7v
MD5:	35D97306886D0CFC8C9EF3E69105099A
SHA1:	843440DE4517DFD4640C2E4058805A3700A9ABA7
SHA-256:	992DFD9F3917FB52013CA2B091E5A5550763740A45596E85E2FC5B567C59476E
SHA-512:	30CC6C499A965DF05AC15987918C2FF306686F5AF4C6E7056CE83D3FF5EB4B956E73225EEF7E9B04115EC29DDBEC0A0D5FCCBD9B72D346B9AA5C39E1B6496E5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.O.>.....J.>...5.I.>.....\.=.......7...5._.....JS..>...<.......JS..?...JS..8...5.X.)...5.N.=...".H.=...5.M.=...Rich<...................PE..d......b.........." .....t...H......hz.......................................0............@.............................................b...dx..........8.......X........).......8..P................................................................................text...er.......t.................. ..`.rdata...............x..............@..@.data....^...........x..............@....pdata..X...........................@..@.rsrc...8............p..............@..@.reloc...G.......H...x..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ATamptNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	525744
Entropy (8bit):	6.010610484357411
Encrypted:	false
SSDEEP:	12288:jKUNiutxRz6Zcz8DvZJA0JJt2MwNI0/3neS8y44:2UR6OYDvnA0JJtvAXem
MD5:	35024DC79289F361A9A294A4FBD2F489
SHA1:	67B3B1F23A0ACACF97052A5A8BFF681BFE37C4C8
SHA-256:	06D3EA2D2FE4546FFE4266C2C85A5C87DC13614D00374BF634CDF111E2A5D397
SHA-512:	61F50B4D0375AA3595B9540B23B888036FE4B84E9887A2AA0526D2EE964420339763C3E80F818D33140AC7D44421BE38DDFAB9C3F00E95506C4FD7FB21A0E52D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Ma.m#2.m#2.m#2.0 3.m#2.0"3.m#2.m"2cm#2.0'3.m#243'3.m#243.2.m#243!3.m#2Rich.m#2........PE..d......b.........."..........6....... .........@.............................`............`.................................................. ..<....@...........:.......O...P......p7..8............................7...............................................text...E........................... ..h.rdata..,~..........................@..H.data....p...P...&...6..............@....pdata...:.......<...\..............@..H.gfids..............................@..HINIT......... ...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnCtlKD.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	5.95361188549271
Encrypted:	false
SSDEEP:	384:sEtW/PzMAKvMLaa3eHB+trw1b4+KIcmu0CWNf5iRwXbXqoqd4SmFadbbp/nK3nyh:gwbvMmHRCIjuKpr67q89nZkVCs3hA
MD5:	EB6F76EBBA2DE44C925595008F23F532
SHA1:	55E5BEA8C99B093CD9A8FDEA7C96739356C31893
SHA-256:	97CA53B2FE43B67D6B1BAE26693B2850692794CA557A8A5E368CB66CF7AA75BF
SHA-512:	F43C773C7C9D37445AC8215087D631CCD945E3DB048BECE225F9B26921326BA453AF756F59107C151B9278764D1588789E5417EE09CB1C42AD5C7AE697681FAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................j......j.............j......j......j......j......j.....Rich............................PE..d...`%.`.........." .....H...,......pU.........S....................................L...............................................ps.......l..d...............X....r..............@b...............................................`...............................text....G.......H.................. ..`.rdata..2....`.......L..............@..@.data................d..............@....pdata..X............f..............@..@.rsrc................l..............@..@.reloc..H............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnI2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616128
Entropy (8bit):	6.469992569412543
Encrypted:	false
SSDEEP:	24576:SgQoS1GGiFp+GY3qA+bcnvC3wJJGlZ+QoiKm3+Ea4sMXYL3KiS9/:S3MuG0qxbGaAJMoQ1KmuEa8X/
MD5:	7C35602CF615C3FAFDF5057C53756A94
SHA1:	E80B76D0EFDB37391F8E63E6BBFA922B1B7A7370
SHA-256:	726AFEFA017583C667D4359CCC3D71AAA07B6EAB686FFE656919300D3379D44F
SHA-512:	6B1EEB243D57249B9548FCF3E3C9CBC69697125431C479FF114746FB33408FE538874DBC935BD0BE8B0591055FA4EE8E4AB0BB5264138906D61FB5C8BDA9BD40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..f...f...f.......f.......f.......f.......f...g.@.f.......f.....w.f.......f.......f.......f.Rich..f.........PE..d....d9b.........." ................._..............................................A.....@.........................................`<.......)..x................................8......................................................H............................text............................... ..`.rdata..tX.......Z..................@..@.data....g...P...*...6..............@....pdata...............`..............@..@.rsrc................<..............@..@.reloc...F.......H...B..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AhnRghNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84728
Entropy (8bit):	6.275471101510284
Encrypted:	false
SSDEEP:	1536:Kk9vz1GznwtWIwMN1xgsoF9j7tP7vI1NtxxnbmnXz2qB7WkH0:fL4w8IwGisoFR7t7I1Vx6XaqBtH0
MD5:	70DED0AEB037D93D8367B9BFD2C0732D
SHA1:	09C85128610A56B14860342EF6A6D7616AE606C6
SHA-256:	4D36C2B219A7D1800381FEC548A68948CC12AB9D2D44754AF61F631E306A3262
SHA-512:	425F82B8BE0B9869DBE23ED7E72ADC5341F6891EED6AA99B8ED5068AAC9AC8569163540A92665B84D24194B9FED2A039B69EDDFB37822A645E792C330048BAF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h(F..F...F...F...G...F..TG...F..TC...F..TE...F..TB...F.sWB...F.sW....F.sWD...F.Rich..F.........PE..d...Z.qb.........."..........b.......`.........@....................................E........................................................`..(....p.......@...........H...... .......8...........................P................................................text............................... ..h.rdata..............................@..H.data....B..........................@....pdata.......@......................@..H.gfids.......P......................@..HINIT.........`...................... ..b.rsrc........p......................@..B.reloc.. ...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark32.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "Ark32.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11028
Entropy (8bit):	7.623917073492213
Encrypted:	false
SSDEEP:	192:ZgvhIYiYF82M34qFIwUtmWJfsHR9y2sE9jBFL2UzZQHn4M:Zg5IYitvUtm4i/8E9VFL2UtQH4M
MD5:	727F84AF01A30962FE25ECE73B37814D
SHA1:	01A8AA51443BEA3424FCC6EEDACBD1031EFB8E13
SHA-256:	BF5E2C43BBF220809EF7FEAA96DA5AFEA2A15B4845005E569260D4B3C913CB7B
SHA-512:	9EB0628AA88D91C8CA7B01FAE619355ED38B4B7A952539865ADA5D20A1B91874DEF396D16BD8C95109D13BBB40AC7999D240C37C4786CFE89796E80070600A3D
Malicious:	false
Preview:	MSCF............D...............................h..........b.......B..........T.m`.Ark32.dll.ahf..[<.B.B.2,2ABE06494F086D08F1B589DA910374C770089728B32EE339ADE57456A74F08B10.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... oy.9\..f_..Ac.....g.<..i...;..t.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark32lgplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 178 bytes, 1 file, at 0x44 +AX "Ark32lgplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	7.629657496141642
Encrypted:	false
SSDEEP:	192:1FIYiYF82M34qFIwzKJalQWJfsHR9y2sE9jBFL2UzZE4si:1FIYitvzKJalQ4i/8E9VFL2UtE+
MD5:	576669DA46F870202AAF654901A676AF
SHA1:	E06726A8432D53D0C093C8AB956D0C777E196C1C
SHA-256:	C122C70BF9CF551C59DF532D852DDB752E51ACBFBEE92DE9B72C5F400115F6AF
SHA-512:	14ADA27D5A70ACE63FC6E9B4DFAD15AE7B7BD540F800962331BC97D8A225C4C4498FAC6E782BE24B6A8E057ADE985EA194F6BAB5818CDC6960FEA0BC9777EB5A
Malicious:	false
Preview:	MSCF............D...............................h..........h.......B..........T.m`.Ark32lgplv2.dll.ahf..(HqB.B.2,858021E41BD9E1745E03734747EA69AC814A0E28F7021405E680FCAF8D5308070.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .N,......R.........5.1....%..u.010...`.H.e....... ...s..-@VD.`..}..5..G.k &.@.%..\|....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2085408
Entropy (8bit):	6.354856041862029
Encrypted:	false
SSDEEP:	24576:i6pbhPFZpeRnR8CwpTCZWLCwWGX7I9+vsDJNmoz8gF5B7AaRRGzNJmrqw6c+Wdnk:HpbXSR8nswC0WfdeL0s0znPTm
MD5:	D26F10BEE44D756CAD73631C1C3E90E1
SHA1:	7862102526806C87BD182076A351856420E886A1
SHA-256:	CE5F64E3308E8AAFB8FA3DC77652949EE0E1F40FCB6133CFB0AC63D1B934A3D8
SHA-512:	33EE5F6A4D2CA3028F6B56ABEDD9AE48EBE25A3A8FCC82ACC07C117C7A1D76D4BAE1994602EDD86CFD3AD62D9776CF830F913768EE5187820F0B7F37CAE04458
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.X.yt6Jyt6Jyt6Jp..J.t6Jp..Jit6Jp..J?t6J^.[Jxt6J^.MJrt6Jyt7J.t6Jp..J.u6Jp..Jxt6Jg&.Jxt6Jp..Jxt6JRichyt6J........................PE..d......b.........." ..........................................................!....... ...@..........................................-..d.......x..... . ....0..L....n.. d.... .p7..................................................................................text...Z........................... ..`.rdata..............................@..@.data........0......................@....pdata..L....0......................@..@text.........P .....................@.. data....`4...` ..6..................@..@.rsrc... ..... .....................@..@.reloc...R.... ..T..................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "Ark64.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11028
Entropy (8bit):	7.624446104806095
Encrypted:	false
SSDEEP:	192:07IYiYF82M34qFIwl7LaLWJfsHR9y2sE9jBFL2UzZEi:07IYitvl7+L4i/8E9VFL2UtEi
MD5:	7316D2E214A0FD1F5D92AC078A42E266
SHA1:	36C89819F48F4189323A9D4737B28C4F35D9CD3C
SHA-256:	4EA96C4A3137365CE507D7D89C690ACF6B1DC97FD92A102128A80FC45512AE09
SHA-512:	712F097902573F80066313BB025C59AB1B2BEA6CCE42B55315F5162BB104FB92E2ECCC7F23C227504782037D45D11EB421D1FF150B5E3EBC361E1E02A3E79553
Malicious:	false
Preview:	MSCF............D...............................h..........b.......B..........T.m`.Ark64.dll.ahf.~YG.B.B.2,CE5F64E3308E8AAFB8FA3DC77652949EE0E1F40FCB6133CFB0AC63D1B934A3D80.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... .(..9U.0..e.....Jn.32.!....f.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64a.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 173 bytes, 1 file, at 0x44 +AX "Ark64a.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11037
Entropy (8bit):	7.622721528183033
Encrypted:	false
SSDEEP:	192:ujPIYiYF82M34qFIkeuLJ0gaOWJfsHR9y2sE9jBFL2UzZsRn:ubIYitvNLF4i/8E9VFL2UtsR
MD5:	C89A3327D1023B1046DADB9EF38A9CC4
SHA1:	98DABA53F58F0E2690F9668693A55404F629A1EF
SHA-256:	B4ED00F58E44BC656FB90A29DB71B563728ADD5166014DAA883C2B8CDC5DCAE1
SHA-512:	513CE80768E457EC4978D49EE998AFB0199A2582CB64748466DDA16592B72BCD7CA41FA3C6B0AF959B89B93ED9AFD350505C7857CD02CAB3FE446D132CFE9FC1
Malicious:	false
Preview:	MSCF............D...............................p..........c.......B..........T.m`.Ark64a.dll.ahf..YE.B.B.2,4EE688FFA25A96387C68745D010D10E4BEECBB3027BC3285B484EFCA0124DC4C0.e...H........V0.R...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". %yn..M%Yu.W..8..]t.EZK.....u.\010...`.H.e....... ..."....R.%.s'O......tL...3..Q......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64algplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 179 bytes, 1 file, at 0x44 +AX "Ark64algplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11035
Entropy (8bit):	7.627543987594771
Encrypted:	false
SSDEEP:	192:B1+IYiYF82M34qFIwFbrEw8WJfsHR9y2sE9jBFL2UzZAee2:B1+IYitvFHB84i/8E9VFL2UtAee2
MD5:	1D2B7AB2A3BEB4160DAA0203D6407FC9
SHA1:	B0EA2F1986C485AE390F58C08B4740D96EE02512
SHA-256:	E7DD82367FF8A66570EAB691EAFEBCB5FA4C175A390315B5517E948F79F806B5
SHA-512:	760D5BD9198089AEE5A54AC26FCC579D6AB688ED9A4C260FBB2C88781932029C4E7E986C68198C692AC320A07F74EC2EDE03B18B7295C38834753CE01E5160AB
Malicious:	false
Preview:	MSCF............D...............................h..........i.......B..........T.m`.Ark64algplv2.dll.ahf.}W6.B.B.2,8A89C31218BCDFDA742BCF489D2E51DA0392E941FFF1E331D99B5DB718B847B30.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...M.X\|../f..6.8.!...hH....T..b010...`.H.e....... ..JA..@....].I....U...t.T....:2.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64lgplv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	640544
Entropy (8bit):	6.262981938777764
Encrypted:	false
SSDEEP:	6144:m3SlvflrV0kD/52TRIY9rPwadIthkAgUb0/cFBMDa6VgCJcQCtbcdXzMaOSNUs6J:QSlF50UuiVRe54CIapNJ6VZ+Alh1FRuQ
MD5:	7DA16EA022A35C4FCB8CDB830B1F2DAD
SHA1:	0DB6B7D23E744B6AA842DF262F138F146805608A
SHA-256:	B058BB04AD2695FDED14F06CD800D686B047C605F824287ADD2BD4EC36C18F3B
SHA-512:	C5DBE12A3DEDF3320B33797FECAC74506675A030358D82AFEE8422A2286BE839D33E02BF4B0AAD2B363BB68447511456D8C5220B31C26E225012A4323FFCDDE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T..T5..T5..T5..]Mm.\|5..]Mj..5..]M\|.^5..s..U5..s..S5..T5..85..]Mc.5..]M{.U5..Jg}.U5..]Mx.U5..RichT5..........................PE..d......b.........." ......................................................... ...........@.................................................X...P.......l....p...\|...b.. d...........................................................................................text............................... ..`.rdata..............................@..@.data............P...z..............@....pdata...\|...p...~..................@..@.rsrc...l............H..............@..@.reloc..`............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Ark64lgplv2.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 178 bytes, 1 file, at 0x44 +AX "Ark64lgplv2.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	7.620996950141226
Encrypted:	false
SSDEEP:	192:wNIYiYF82M34qFIwp69sWJfsHR9y2sE9jBFL2UzZhMX9G/:wNIYitvp69s4i/8E9VFL2UthMtw
MD5:	BC626499AF7D3F09723B76BB27304C1D
SHA1:	AABD8E8FA72A6EB2864F0107E2B12433FAF4B71B
SHA-256:	38D2E303FE97AE694F9C993736DB5B791CB523F81C095B475889022832C727EC
SHA-512:	B3036E353118D9FF15B7BCEDD2C6BBC2F0A59CC69536D623F0ACC53222D755627BC4AC111E697BC58A11030C3D792A3D0C42857156D117E38BCF95179322C332
Malicious:	false
Preview:	MSCF............D...............................h..........h.......B..........T.m`.Ark64lgplv2.dll.ahf.yWG.B.B.2,B058BB04AD2695FDED14F06CD800D686B047C605F824287ADD2BD4EC36C18F3B0.d...H........U0.Q...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .N,......R.........5.1....%..u.010...`.H.e....... ..-.\|.<......^....&{..ki...Z4.....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0...*.H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AtamptU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1643040
Entropy (8bit):	6.442596737136437
Encrypted:	false
SSDEEP:	24576:UadDS1GGiFpNr3kAoYN4KHFQ/MUDbRmzualwjCMCA4USsJ:UMZFkttKIrD0qalwGBA46
MD5:	82CB7701384A71B47792ADD297F1D197
SHA1:	C5C7C51E7249220159C5FDF16E96C3A7DFEA6D27
SHA-256:	7676C1101035D8E1AFA2BFA5C9CC12BE0139804AF45BE187F055A7184FA157AA
SHA-512:	5DE5DBACCF6BCAFD0ED53E14CD9DF3D5CBDFCE86E0BA0E33696711E234328F7A64B845F62C544D3CC5CC98BA0BA79977A9DC28F15895251F17CFB1842E056DC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................S.....#.V.......U......8..........k.....C.M.....D.......R.......T.......Q.....Rich............PE..d...b(.b.........." .................!.......................................p............@.............................................Q....i..........$.......d....... *... ...=..07...............................................0...............................text............................... ..`.rdata...O...0...P..."..............@..@.data....f....... ...r..............@....pdata..d...........................@..@.detourd.............p..............@....detourc.!......."...r..............@..@.rsrc...$...........................@..@.reloc..xK... ...L..................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\AupASD.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2399248
Entropy (8bit):	6.314705719172017
Encrypted:	false
SSDEEP:	49152:3RwgQEl1aqArZHMMv9eyr1tF8zwlycjg7aC:hO1T8zwwcj2
MD5:	03DE4ACA4BDCB56F34E17C20D5B8B128
SHA1:	6B33AED0814099B6F109A1D924BB24FE56D6471F
SHA-256:	716EAA706149F839B7D2122903919499A7514F4344F95C2C10743EE6CF104163
SHA-512:	3D1233EB29534B3015259DB65ABDCEBD4B2BF1076F6A1B3596A12F1143BD3A6AC1D8C93D529E1030336166013494746BFD8C87F44225BA422E0D8500C7B70A93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].............>EU.......@.....>E......>E..........?.....V......\.8.....Q.c.....A.......D.....Rich............PE..d......c..........".................D..........@.............................`%.......$...@.................................................h........."..F....!.H&...r$..*....%..>..0................................................................................text...F........................... ..`.rdata...3.......4..................@..@.data...............................@....pdata..H&....!..(.... .............@..@.rsrc....F...."..H....!.............@..@.reloc...T....%..V....$.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Av.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1589264
Entropy (8bit):	5.763994289322921
Encrypted:	false
SSDEEP:	24576:Xo5gXeL7ypAb8kSFoNggdefG19n29KrFnq04SD63+6xvN7q6w4Y+Mb:pNAIkooNfeej2LSDX2N7zq
MD5:	3C407401D797891872A41781962BB872
SHA1:	B7EE4976A8010834EC1A3949372956876EBF745F
SHA-256:	E7C2D733D28D537E46920D989E4872EBFD0D4BCC74E5D741EDAB49D567475AC4
SHA-512:	8DBD237D6BE244CCDF3176D7A6C42322610C37EC22774206714BBAB250C17A33F910AD964C128ED9F7B533958E04192387F9E2E8F29495F7D9DB37746DF2AEC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&O.G!..G!..G!......G!......G!..?...G!..?...G!..?...G!...L..G!......G!...Z..G!..G .9F!..?...G!..?...G!..?...G!......G!..?...G!.Rich.G!.........PE..d......c.........." ................x...............................................,.....@..........................................C..o.......................h........*..............................................................@............................text............................... ..`.rdata../4.......6..................@..@.data...@....P.......4..............@....pdata..h............6..............@..@.rsrc...............................@..@.reloc..^...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\BtScnCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29848
Entropy (8bit):	6.634755302057254
Encrypted:	false
SSDEEP:	384:T523SlaCmIevOyl8Qf4y7wa+pYnMtRKOBxQUBHp23+r/jLo+:1OSlAnmyLAyU1tZp23+zjc+
MD5:	99A40DC9A761B2A03948BD2F5F8D1378
SHA1:	AB5ED4D4A38842C972AC8E85305E5D7EB067B5E6
SHA-256:	2837C994037D9D3ED31F4A4AA2912BAD8CF751482528AFDBF43A80071C99AEC6
SHA-512:	D05AB5B330C83F1F92D3C50773AFBF74828F21FD502545E8F71138D813BDCBAB00DD64BAE00DCA3937D7793747B9367C8F6F449039BA72998F9E4FEC06316C64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!P.U@>.U@>.U@>..5@.T@>.#.S.S@>.#.C.T@>.#.E.\@>.U@?.g@>.#.P.V@>.#.D.T@>.#.B.T@>.#.F.T@>.RichU@>.................PE..d.....^.........." .................%...............................................................................................<.......7..d....p.......`..,....8...<...........1...............................................0...............................text............................... ..`.rdata..~....0......................@..@.data........@......................@....pdata..,....`.......0..............@..@.rsrc........p.......2..............@..@.reloc..H............6..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Cdm2DrNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92632
Entropy (8bit):	6.674944255059838
Encrypted:	false
SSDEEP:	1536:bmZ/ROM+RR1Vk3ZsgMJ0LLLGS4A3vLcn0zWq7AD:bmZ/MMqR1y3Z5Mi5Lc06q0D
MD5:	69B34600118F281D507261F04A8FAB66
SHA1:	957942CCE6C8289119513B184B5EAC04E14E03FC
SHA-256:	E05D1F6470F50F2F46481AC799C96F65FEBEADAF3AA50B48172C4BF76BC7B975
SHA-512:	D960BB343E5DBC885A1B3C9DECF733525F9186084987B8C8403953B61F5B8ACD53E58A82F8D9074B0AB9BE90D810666F13A0509DFC179BCD1BA51A067B4CB48E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[..[..[..[...[......[......[......[..4...[..4...[..4.:.[..4...[..Rich.[..........................PE..d....~.b.........." .........l.......`...............................................W....`..........................................P.......`..(....p.......0...........O..............8...............................................p............................text............................... ..h.rdata..TX.......Z..................@..H.data... .... ......................@....pdata.......0......................@..H.gfids.......@......................@..H.edata.......P......................@..@INIT....x....`...................... ..b.rsrc........p......................@..B.reloc..............................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmAPI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	183608
Entropy (8bit):	5.925006152484248
Encrypted:	false
SSDEEP:	3072:mON3OrQ48MQTKxZBhMeldB1DBHxN0QWADUEekU+Y:mON3eQTKxZBielXcADUl
MD5:	D63FE44D767DE4D36943DE9DCBA5AAB7
SHA1:	1F0E72AEA935FE970999C2DF6A644EC9A4B52CC0
SHA-256:	FC89A9B2B5D8D7FDC3BD49D450A5135BC52832430989ECADAB3FEF20478B6DEC
SHA-512:	D9390AA01ADDC4FFAA10666ECB337884195489D8360E7B0D1919585468FD6EA720BE73687855C414A71F766155A0FFA3781178F2D7592A9E75A1335977954354
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,..,..,.....,..,...,.....,.....,.....,.....,.....,.....,..Rich.,..........PE..d...-.fb.........." .........$.................S....................................`...................................................Y......d.......H...............8#......x...................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\CdmCtrl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95032
Entropy (8bit):	5.702613415046306
Encrypted:	false
SSDEEP:	1536:3hsnrVygg8kxEzvUZ3nBVnwF1Ms8gRffIhL6rUJe+/nPNdBpl:WrVvg8tMktfQx6sNdBpl
MD5:	0319CE5F5E28235E8DBA9A9F669A2CE0
SHA1:	E71C781BC99CFD5C0A351EF4A569D7CF0220A4D1
SHA-256:	E758B88E8A1B3F9E4C474F0AC494C7A6890A16580A9F4EEF701B1E70F74B3828
SHA-512:	2350E5A7A41948063BB05AE2715BAAB0D25A426DAFDFDA21E968207843C1FAC4D07CE7034B0BCE679EE9D1A616AE9516FE856844407008B02A2A94E27E71EBA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.G@X..@X..@X..6...IX..@X...X..6...FX..6...BX..6...KX..6...AX..6...AX..6...AX..Rich@X..........PE..d...+.fb.........." ................P..........S....................................................................................PJ..7....@..d.......P....p.......P..8#......h... ................................................................................text............................... ..`.rdata...`.......b..................@..@.data........`.......8..............@....pdata.......p.......:..............@..@.rsrc...P............H..............@..@.reloc..B............N..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3407376
Entropy (8bit):	6.083562418610337
Encrypted:	false
SSDEEP:	49152:+KQVSmZZj5+LQPhsb/hvKgInTI6VV2AFpCR0+tyHlQAXyPvChxwQEHu2I7Fsf:7i8KEcchyF7xPEHzGsf
MD5:	7465FD034D92B69DD89FF32493972FC0
SHA1:	F21982CF025C47A466746C6F1ABE506A41B5B419
SHA-256:	186FF32054F9B4F66B7EDC7B3303DA5BDC271B77F7EEB369E6E7B596CE211949
SHA-512:	8ABF052BBBD83817DCA796135B971D006815E32B5F12250512E646E5FD2608A8D3A0D2A89F1DD729C102937BA5FEE5B62F2B82042ED8B9C23842B87268329FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......X...X...X..\X...X..YX...X..ZX...X&OX...X&.X...X..LX...X&.X...X...X...X..FX ..X..KX...X..]X...X..[X...X..^X...XRich...X........PE..d... ..c.........." ...... ...................................................4......4...@...........................................0.q....c0.@....@4.......2.t.....3.....P4.,J....!............................................... ..............................text...L. ....... ................. ..`.rdata..!..... ....... .............@..@.data.........0.."....0.............@....pdata..t.....2.......1.............@..@.rsrc........@4......d3.............@..@.reloc...f...P4..h...l3.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2680344
Entropy (8bit):	5.846107201304436
Encrypted:	false
SSDEEP:	49152:VuaqnXgTj2qYXqeVDd0nyvb7792klH3hJvx3ZOVjzw:V5T8qeN92WZJ
MD5:	D5DE2FBF011CD87778931A1687DFEDB0
SHA1:	9B31D1B262D06CDCD677043D0AE22FEE1E9F36F1
SHA-256:	6AC3304FC9C8A6F4FDD8F06C8D6B36564C7221720A42D5748D190400C8C71FE0
SHA-512:	63D7B7387C7C27E654D8CBC04182DC35CC33F838219707827823575013C2D6E575194BF0747C429A7575983DAA1AA0B67EC33D1EF6ED22B6E2B63B5A8F7E78C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.v....N...N...N...N...N...N...N...N...N...N...N8.cN...N...Ny..N...N...N...N...N...N...N...N...NRich...N........PE..d.....c.........." ................x........................................`).....v.)..............................................Y&.f.....(.......(.......'.(y....(..*....).H;.. .................................................(..............................text...g........................... ..`.rdata..6...........................@..@.data........`&..&...P&.............@....pdata........'......v&.............@..@.idata..6>....(..@....(.............@....rsrc.........(......X(.............@..@.reloc..w[....)..\...`(.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbCtl32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1699352
Entropy (8bit):	6.78854889801263
Encrypted:	false
SSDEEP:	24576:Sh254bNhfyVXbW5cCnYEYSOc8ctKSYn3bzMXpwWruZp1pSrdfkCG3NDZnPPM+GhL:STGOYF6CQwriGvxZnPP5GhPE+9
MD5:	969D634F75112D9203FB678C3CD7BB5B
SHA1:	AA65079E33DF01C519F94610A4EFA2B8006E9791
SHA-256:	2CC8C83DCAFC45438B15C2AFD8C122F24C0BA623AB30BBF00F5962FC339D859E
SHA-512:	3C8A3B6DA004179416F1198646575FD047D674ACF6BE00E577EA871F13B5B75F3577CE61589A1E1ACD179E7C328304D0D0BAFB6599E2C265A5F339AECCB2C0FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(g{.l...l...l...e~..h....I..m...e~..`...e~......K.n.}...l.......e~..q...e~..m...rT..m...e~..m...Richl...........................PE..L......c...........!.....x...H.......b.......................................P..........................................W............p...................*......T......................................@............................................text...nv.......x.................. ..`.rdata...R.......T...\|..............@..@.data...Dz..........................@....rsrc........p......................@..@.reloc..v...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\HsbDrv64.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178624
Entropy (8bit):	6.154085729231531
Encrypted:	false
SSDEEP:	1536:qO8z5DBbAwdnlssCFZi3zor28EkS4Aq0LLLcVoxrbtnSf9Xzu07KU:/8tdhJjobKEixrbtSf9X9+U
MD5:	5681909BC6996A5F8AF15985CA222778
SHA1:	45BA737EE702E0307D3607B4B70C3BAA7D74088F
SHA-256:	E2E6F3067E89F67E470701BF0890F87A8DF58C3629A7F4B122A59D10F0CE8B0D
SHA-512:	DE60FF64CC9ECE1DECCEAEA108110CC7B53622F6B3CF624A87F86CA0763DD45EB6AC0384A95092F549B467247A81B28633B200B5A280D4B399821F3C42B015B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N.W.N.W.N.W.N.W.N.W..V.N.W..V.N.W.*.V.N.W.'.V.N.W.'&W.N.W.'.V.N.WRich.N.W................PE..d.....b.........."..........z.................@...........................................A....................................................(.......0....p.......j...O...... ...0S..8...........................pS..................@............................text............................... ..h.rdata...Z.......\..................@..H.data........`.......L..............@....pdata.......p.......N..............@..HINIT.................X.............. ..b.rsrc...0............b..............@..B.reloc.. ............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44560
Entropy (8bit):	5.893482922203998
Encrypted:	false
SSDEEP:	768:IdJtnfDOV7zIKk2AIPzwfJkdFLYityXlEnZF:ofDOV3IKk2AIPzwfJkdFL7MXW
MD5:	BEC8A457871D528FD364F49CCBD440B7
SHA1:	FF7DF1FAE7E308B47C3F2F6D0B94C4421A59AA99
SHA-256:	9D30971F21A14CF7EA0E04EB70FC1B08903038FEFC275B74FCD55E39EC23F687
SHA-512:	94F9ED7FF211731A76947D5869DF76FEFB5D4D1EBD3ADD3B5FDD20BCD4538F54C1A40F5DC39CECBE566DADDA022D2AACBC9B95DEA5078359D919ED078FDFEE3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.)...G...G...G......G......G.<[...G.<[<...G...F.".G......G......G......G......G.Rich..G.................PE..d.....(c.........." .........r.......................................................................................................}......,w..x.......(.......................... 2...............................................0...............................text...1........................... ..`.orpc........ ...................... ..`.rdata...N...0...P..................@..@.data................b..............@....pdata...............r..............@..@.rsrc...(............t..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\IAccessible2Proxy32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39448
Entropy (8bit):	6.349725786408787
Encrypted:	false
SSDEEP:	384:saTPLFr83naeA5z7VbbQ0SKvB2S8MgHHrKIYitv7tvXG8E9VF0NysI:saPFraa1ztbQDCPRgr3YitDdXlE
MD5:	6B53A59AD800614B3866D24472C41C22
SHA1:	FC470149F8E81D952A84AEF0AEE7663BE4386DD3
SHA-256:	6B2B3B3186177EE9366DDA6FC274B1F0F9443C8474C8B125CB3232F2F6C8EC5C
SHA-512:	ADE1DAAB764D21814AAEC1A72CACB12549D3E1EE332ECA8A17615EC665FA9278AA794AC9D0094ABFA77038A8F4FB836C34F2C0DE6D94309138207656C85E6D9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........".R.C...C...C...;,..C...;..C...;;..C.......C.......C...C...C...;<..C...;-..C....+..C...;...C..Rich.C..................PE..L...X.(c...........!.........^...............0......................................K................................q.......j..x.......(............p.........`...01...............................i..@............0...............................text............................... ..`.orpc...u.... ...................... ..`.rdata..NB...0...D..................@..@.data................V..............@....rsrc...(............^..............@..@.reloc..\|............h..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHS.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35664
Entropy (8bit):	5.58023144464701
Encrypted:	false
SSDEEP:	384:wwxPHe7hDWEWy5uxcx37Xtqh5iHulR1uwTvh6dKe/VD9OLH1zLz4qjXHUB:LShL2ctXtqPvRhvhynOLtz4qjXHUB
MD5:	3D158F9970E98046E9D1CFEAF3F80007
SHA1:	C5A9CE5266AD2E1A635719C05FAAD3BCC6F6AE94
SHA-256:	71415D14B066E8A70190197FC09686AD0166D3D2C75ADBD31E6C1830C7E18371
SHA-512:	F49CFC46AB5FEC9AF14EF94A6EA07D8DFDD4621A037668B1417052078FF69B2FEFC89EA5DD4C055F8B1E8E43DEBE2C4F617B4CAA048A7013B77F962A629AB60F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." .........r................6]....................................B.....@..............................................................q...........t..P............................................................................................rsrc....q.......r..................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90CHT.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36672
Entropy (8bit):	5.588028174926814
Encrypted:	false
SSDEEP:	384:ldPwznjqQOl6HyLW7WyJMU9sNCR0OL5AlKwKTF1ECAiJJSLz4Z1joQ3C/:zki8SS19sy1KKwQ1ECDJ0z4Z1jZC/
MD5:	72C8232A2626743724D79F4D1684F3F3
SHA1:	44131077ACD660001C7C61409BC7E38C5D95FBD9
SHA-256:	8585A855C4A8FDB975A2B26CDE76B22CCD23FE19152D92FB47B30C7ACC7A966B
SHA-512:	A2E2864F8B75FCFF44CC791E9A394E928D3E628D5481E532C4F851114F1CB95A307B31CEEE10DDEA7E529C14DB7C804FA7E559DB5921A1982EAC4647EB601464
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." .........v................6].....................................a....@..............................................................u...........x..@............................................................................................rsrc....u.......v..................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90DEU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63312
Entropy (8bit):	4.147046570661323
Encrypted:	false
SSDEEP:	1536:4AhosbkV8vJVQPu6V4Z+e0petNSaQhp0vcsjsrAGeoDsaKtq5w:vhosbkV8vJVQPu6V4ZX0bhp0vcsjsrAF
MD5:	275AAC23549087011B2996C57B6AAEFE
SHA1:	F326FBDC1ED197EED3663A642609CD1425FF1905
SHA-256:	466E9AB397CE17633D2848B05435B49F62FDCE16592ABC247FA5BAA2B59CC850
SHA-512:	02FF0B3F5B8FCABC85BD6645CB1CEDA6F189E371BA00A8E57C501AA1115ABAD505672327B727F0E993FC99A330058B55FDBE04099149D7D6651792D766F9C965
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................A.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ENU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53584
Entropy (8bit):	4.231898414434443
Encrypted:	false
SSDEEP:	768:3UrE5Ev1Y6BwLPLNq5f/nWHBN1eOU2fd5iz4qjpv3F:301Y6BkPLNYf/nWH5TdXq5V
MD5:	FC70F49F1B15802F5AE7F818AE3ECBC8
SHA1:	059F44050DF886BC74F60AE29178D634D328E848
SHA-256:	1F471B87324666B45DCDA7AF69D8109240E632F289A81A02FDBE1EFDBE75DC7A
SHA-512:	8EA60C31B49E1C839C5099A9518298E4DD71A056A7D774139BE319A30A6C4D3DAC441F06E2EB76376D08646EBD4F10C0A19FFA50B5E7309488189390E7BBB3D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................4....@.............................................................P...............P............................................................................................rsrc...P...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61776
Entropy (8bit):	4.107682732404191
Encrypted:	false
SSDEEP:	768:cOmcQ3ulNtMFZEGBFCDCDheB5xaV59+IIN5Rz4qjXHUo0:FlNtqZEGBFM0heB5+99ICqrHU7
MD5:	6D9A46F763040C86ABF1950F211FB1BC
SHA1:	17AB5398C9B1B5B564FA478CBD5C29803DEA6EE4
SHA-256:	CA8556A58B920D799BA52C07AC85D10C0208EFBE4380058C47C124DCAA92F67A
SHA-512:	745BF74E64A3A62983E3FC1D98EEEE82274397397D13C292DACFA0734FC66131713EA758EBE933365B2731DCE23527E0492310A2656199902BA1B558F22EB90C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................L....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ESP.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61776
Entropy (8bit):	4.107209507419263
Encrypted:	false
SSDEEP:	768:4OmcQ3u7TtMFZEGBFCDCDheB5xaV59+IIN5Vz4qjXHUM2Os:p7TtqZEGBFM0heB5+99IWqrHUM2Os
MD5:	C310853379DB86E6B0C5E4095F156F52
SHA1:	C1B2AA46AF4995717C84CE0BEBAAA47A2D3DA237
SHA-256:	CF9F783DD28CB8BD81D98F0F88C1AB924E233DF7DE26788720D181C0034268B3
SHA-512:	318ED84728FE2D4A3942FEDA6029B64E603DA7396B9BA04576BA32FA697CD736930488EC9C583CB68B8586051D8B13F209534D066074565115D94969E3CAB724
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................(.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90FRA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62800
Entropy (8bit):	4.1190781529301965
Encrypted:	false
SSDEEP:	768:3WcDf8GOQOj7e3RAaTaPCeyGdZmZ5fyyyyyyyyyyyyyyyafyLVyWong3+vz4qjXc:xgQZA2SCeB0vQJqrHUm6
MD5:	AFE56D7623448D4C3729DFDC8E56C2FE
SHA1:	FD5BD8C48537AA145E02EC143D0E655818B96E0C
SHA-256:	311461ACA503F947113D5E66DF8BB996A3FC2506A2763FFE8C97AA66103D7A75
SHA-512:	FF06FA8ABD8AF6D6C680FABABA4B7B26A87AEA8E5A54E42FC94D9C84012308BB01FAAC2378B9507317DDE7FB616CDA13C1109BC42F4AC72EEE0FC5B4D32F7B3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................[.....@.............................................................`...............P............................................................................................rsrc...`...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90ITA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61264
Entropy (8bit):	4.101771776541544
Encrypted:	false
SSDEEP:	768:5fhqLysnKliCz7PxdIlWXgiCnPOCeFO/hDsiZUWTr+z4qjXHU8t:OJuiCz7PxdIlWX/APpBT5qrHU8t
MD5:	4FF530BADEE863866EB1A02482E3BADD
SHA1:	04C679CAA989A4B10B45FCC404EFDD0CCA0A32DF
SHA-256:	E96126F9D9F5ACE396A7769470A77E035674A583771F200E393D6389E47340D0
SHA-512:	D489379A471CECDCB7417112E42E3CA727DABC2764DE222EA74FBC88DA2FFF5267B8EA7F7A1A0151FEF829BD615D0A1BD37118BF48E28A50A5DC72CC0F340995
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6]....................................$.....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90JPN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43328
Entropy (8bit):	5.431136968953999
Encrypted:	false
SSDEEP:	384:iIxeR48c4rAmWoWyI6JMQ7axr10ahVIpbhYZTZ+HLz4Z1jg:5ARcEI6JM1r10OIthDz4Z1jg
MD5:	B5E78AC7392C21AF9AF0D34CCED932CF
SHA1:	AA6E4AF6BD85D58E52456FF1E86BF90187B2E423
SHA-256:	D397D7C2BF5C45E1C8B6129248D23DD7B053CE6E70C2633DAA3B931B054E9984
SHA-512:	E2A49519B60E4D59A968EB90A73F6C1C54B2ECDD1D5806F0A5A223958947FBE32EC42C9A7251ECCF74DEA836DD94BAEBB23DE2133B3FF7843ADE697EDE47EDBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................V....@.............................................................8...............@............................................................................................rsrc...8...........................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\MFC90KOR.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42832
Entropy (8bit):	5.538055863229217
Encrypted:	false
SSDEEP:	768:GekmG+rCzaraHn9vxB2c7Cvqnz4qjpv5E:GEGlzDn9vD2c7CvqEq55E
MD5:	120B9C7E4EE56BE14F7714AA7F7E9EDF
SHA1:	8F9A0189A53CA4EDA211836311E7466808EC16F6
SHA-256:	F3733F7A07CFFF9C6F8027F18FECC7D95B6FEA6FF9399494F22DE4A4B0E9EE46
SHA-512:	27231F6367B379BE8B336DBCF91876FB54C190624025E2F6687D581F21C6A87E4333E0C0D2577365C81AB3AEF316686B35D40B28295424316C18D3F6C5138491
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d....gYJ.........." ..........................6].....................................t....@.............................................................................P............................................................................................rsrc...............................@..@............................................8.......P.......8....... .......8....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................;.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.......H.......`.......x...........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	5.38478122745935
Encrypted:	false
SSDEEP:	48:3SlK+vU6gaAg09kkKb+Ezo09kkK/zzbK5C09kkKsrzY:Clt8UAgXk8+E8Xkaz/MCXkJ8
MD5:	A806C2A878EBCAA97F095E204AD23527
SHA1:	83EB34D7CED2B9DC71DBB849AA21EA78EC45A78C
SHA-256:	6B737568E1A12AB56EA091427B691B0FB5391997EBBDC4353C4ABDD2786E110B
SHA-512:	52149492ED4FF37115CB8D16203BE2419B692074824EDE86647CBC1B9CAA46D23E04C9C9D8979E512EE09933D46F69B7B384678E05B74ABEDB81BB9AB6917263
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="1b065fdf0cb8516b0553128eae4af39c5f8eeb46"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Vy8CgQgbu3qH5JHTK0op4kR8114=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="45d3027d87eade77317e92994790598c755b3920"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	5.368010340567118
Encrypted:	false
SSDEEP:	48:3SlK++U6gdeB09kkKLzs09kkKDIzZOs09kkKJnzE09kkKK3MgzY:CltFD6Xk24XkBUsXkEnwXkpMg8
MD5:	EF0ED5B8F33C0B526101778EB14651F4
SHA1:	59FC443FE4A93669ACE0F59FA7986BC9A04A400A
SHA-256:	0E840B3AEA14A2DD7F84E0E6A923ED4B40EB139BECC2941C2D67A395DA26879C
SHA-512:	C0AEB711A3DC8C074577EB64433545A05DFD7BAB1259AECDD10FE2DC54BFC45463CE62D70C21302F3F136FF10E4FF48DDEE4F51CF018CD162D7FBC3834802BB4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="7a86bbafeb8fab5ec5e6b34f226cde1ce9a1ae9b"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>jknaTCuYm0hCeoiYG7L8EtQPel4=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="1817389f2b3d7b9fe5c4468c6592c536a5c2b842"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2Nadr.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	195528
Entropy (8bit):	6.077374996014525
Encrypted:	false
SSDEEP:	1536:3NyTUYGYVe4VVaoVvDqDwdkNnkS4Aq0LLLXG1VgmnUwZz3W780:gTUUe4VVaSLkw8mVgmnSA0
MD5:	A5DEE08B25BE259017ABA062DE62A8F4
SHA1:	A0630F5EF42611CACD32ADAB662F722060CBB260
SHA-256:	D670E36344AFAE809588CF7B0476C4A9322A977DC3832A9E4B92BECE558A429C
SHA-512:	B45562FA433645645C7EDA4E7CACEDB3C7BA077D1D2A2D524076E15703278AC58C6E5765C74EBD79FFF0FDD333AA21CBAC93686BACD9578C4B7AC21BBD8251FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.3...]...]...].y.Y...].y.^...].y.\...]...\.W.].Y...].....]._...].Rich..].........................PE..d......b.........."......,...~.................@.....................................}....`A....................................................P...............X........O..............8...........................................@.. ............................text...$!.......".................. ..h.rdata..\|^...@...`...&..............@..H.data...P...........................@....pdata..X...........................@..HINIT................................ ..b.rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Mkd2bthf.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	154048
Entropy (8bit):	6.152804361167168
Encrypted:	false
SSDEEP:	1536:sM6QLsRni9yPlUEkS4Aq0LLLZ6JaNnB3cf9XzuH7VwV:vLFItUKR6JaNBMf9XaRwV
MD5:	DA9F775610EBB9EF7BAEFDB916033ADA
SHA1:	F4A659ECD5CD10C43ED9E7EA4B08EA94EEBFF3BC
SHA-256:	B666B68C6BC91C3D676CB3BEC67BCF22BCA35305726831E82131902149185401
SHA-512:	D1A4838CE6183FBA94F24AF2A1A12E21E724691EBB01CA5E2CB968EA6025A229FE7AE0E29D7BB2B395F52442B602923543E2FADB592FFFC903CC18A0444FE724
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j;...Z...Z...Z...Z...Z..A>..-Z..A>..+Z..A>..+Z..3.. Z..3=./Z..3../Z..Rich.Z..........PE..d......b.........."..........l.......0.........@.............................`............`A.................................................0..(....@....... ...........O...P...... ...8...........................`................................................text...B........................... ..h.rdata...W.......X..................@..H.data...............................@....pdata....... ......................@..HINIT.........0...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2347024
Entropy (8bit):	6.3669123532265175
Encrypted:	false
SSDEEP:	49152:PmWZah+WDtlQGm0r3CMASFJC0nesPYQxDC:1iIqFJxPYQU
MD5:	1E2A026243354636BA47D92280C9EA08
SHA1:	589BF434C3396EB7587DD6091BFB8BB4C14CA2A3
SHA-256:	C0BC98F6BEC4833980DFBD8D85192B9AD9AF77DC6C80DFEF52A58025DE312543
SHA-512:	ADDD97A337E5C89BCD088CBDC09746A4DEDF07796A676B29BFC8347EF576A1E637430634261D7EC0F98C92F45EBDC4CFFE70DDC201E27545F5A881275589DE13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........}=...S..S..S.....S.N...S..>..S..S...S.d...S.d...S.d..p.S.d...S..=..S..>..S..(..S..R.O.S.d....S.d...S.N...S.d...S.Rich..S.........................PE..d...(.2c.........." ................l.........................................$......A$...@.........................................P. .Q.... .\|.....$......."..C....#..*... $..C.. 4............................................... ..@............................text............................... ..`.rdata....... ......................@..@.data........ ....... .............@....pdata...C...."..D....!.............@..@.BrcoSha.@....#..@....#.............@....rsrc.........$......B#.............@..@.reloc...X... $..Z...L#.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzBrcom32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1985560
Entropy (8bit):	6.652362960735125
Encrypted:	false
SSDEEP:	24576:488wU8fI8ovSKAtdRGKWgVXwzxJzxOQY4txcbo/l8yMYJB6DPmo03wfrXeLQZ2+k:mw0hKDQNCo/MJ83IeLQZRJDLJW1
MD5:	5BB25B99733CF293B853B58166ACDF2F
SHA1:	FADE410FB456F900CDB34BD9B214F4E063D2DF88
SHA-256:	3CAEC4E2997E45A96FF2BBE050B63F71D12D8E40B6E16CB1DBBB1435601762A0
SHA-512:	950DF8A08978E8E22E18008D661AEA3C9FCFD8F2104871DA9841876123A664D5046090650CF498D6ABD06D14C35D0977140A781740D6696D442846F21CE86AFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........g{Y..(Y..(Y..(G..(\..(~3d(P..(.(Z..(P..(V..(P..(_..(P..(...(P..(F..(o..(X..(o..(]..(~3r(~..(Y..(...(P..(...(P..(X..(G..(X..(P..(X..(RichY..(........................PE..L....2c...........!.....H...........g.......`......................................0`....@.........................P...S....~..\|...................."...*..........`j...............................................`..d............................text....F.......H.................. ..`.rdata...F...`...H...L..............@..@.data...............................@....BrcoSha.@...@...@..................@....rsrc...............................@..@.reloc...M.......N..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzInst.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	950296
Entropy (8bit):	6.715241814776746
Encrypted:	false
SSDEEP:	24576:+HEScP9+67jL5XqjowYEF0ybLdJIQYJQo:zEEjL5ajPFfGQYJv
MD5:	F380128EFE73C2896CC50ABC0BEB5FDE
SHA1:	FFF334A03B7D3B67F4C8C9BFF31C2DE1626FBC80
SHA-256:	5AF161C4FB7C3522FAB909AD03A05456C05DFD968A328CF317B3FADD3EB9C933
SHA-512:	A4438839C43FE61F86D843746C4B3B02AC52E20DF6175EEFCDBC8B3714816EA672B3E69B94CB5D0133AC1BF817D6B5AA671D43FAABA1FC3A47BC62B9DA4C9D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........r.I..}I..}I..}W.}L..}nxq}J..}nx.}J..}..}O..}@.}K..}@.}F..}@.}O..}?#r}H..}?#q}M..}nxg}T..}I..}X..}@.}{..}@.}...}@.}H..}W.}H..}@.}H..}RichI..}................PE..d......c.........." .........:............................................... ......4L....@..........................................G......(#....... ...........6...V...*......@....<...............................................0..h............................text...~........................... ..`.rdata.......0......................@..@.data...H....P.......8..............@....pdata...6.......8..."..............@..@.rsrc........ .......Z..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzInst32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776216
Entropy (8bit):	7.0387779534461155
Encrypted:	false
SSDEEP:	12288:bw8eWpY4zGbdHs7gWSqqn6HZBh5jyuFWRY2SpgHjbf5h2ke408WJKTWiGPYJetX+:t0dMxSq+6HZB7jyEF0ybLdJIQYJgO
MD5:	F38A5F8A996CDE64121406D00E927DC2
SHA1:	9FC677351A1E3ED2E1DCF310CE73C874F7E70FC4
SHA-256:	01321265ED83F52933F27116FC805EAD378689A26DC612F04E6DA227129366D0
SHA-512:	9D20ACD4561C4022BAC58400E4B378D767DBCA65F9A81EB159FAD6B0C28F286FF45945D94A19F06B50346E63E35A70C1D8DCCF8E8190BBC3D573A24993AAE54E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t...j.1.q...Ss.r.....#.r...}. .}...}.6.{...}.&.r...B...u...B...p...Ss.i...t...c...}.1.F...}.?.0...}.'.u...j.!.u...}.$.u...Richt...........PE..L......c...........!................6........ ...............................p......%{....@.......................................... ...................*.......4...%............................................... ...............................text...\|........................... ..`.rdata.. .... ......................@..@.data...8^..........................@....rsrc........ .......j..............@..@.reloc...T.......V...X..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\NzPlugin.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2103832
Entropy (8bit):	6.377059327231297
Encrypted:	false
SSDEEP:	24576:kgZXygXGzym/nTzSxXOmXxgn4N4+CmSc07tDDEZP4RJY5FGLO+6H5AxZNf8:fZ2y5XOmBgn/zmkxDPRO5FGLJ45UZu
MD5:	359AC0FD7970DA4E5C4F66A45C027031
SHA1:	46252ABC6B70393B9D25E5F1CE50C9CB1AF14D51
SHA-256:	7717124CB6F5D87E64E20F97510CB14CF2BEC36F7D560C85852D2704FC502413
SHA-512:	87CB2C4C50C6902E49F270F8C7C63C6F5A3880B58EB39E6F7C50F1AC526490B55EE506AF4168BD359E1EF60C14A5EFD0B2D610884661832B3D3B19D927BCAAC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........W. .6.s.6.s.6.s.d s.6.s...s.6.s..$s.6.s...s.6.sFy2s.6.s.N1s.6.s...s.6.s...s.6.s.N's-7.s.N7s.6.s.6.s.4.s.N s.6.s.N.s.6.s.N6s.6.s.d0s.6.s.N5s.6.sRich.6.s................PE..d...&..c.........." ................P\|....................................... !....... ...@.............................................u...(n........ ..................*.... .H=..`...................................................(............................text...N........................... ..`.rdata..u...........................@..@.data... ...........................@....pdata...............x..............@..@.rsrc......... .....................@..@.reloc..fP.... ..R..................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\PdCfg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	349720
Entropy (8bit):	6.0144852370364505
Encrypted:	false
SSDEEP:	6144:AuiF2ruN1L+6j8ndDCpJTXjUHe87ucxERWvfpqqDL6B2JoRtoPOpOPdpwSBR5K:7ruN1h8ndDCpZXjUHeUHxe+Eqn6Bg2og
MD5:	F25184FB0FE43527E1C5CBE7E0C63781
SHA1:	6014C15E299E173F3E746DAEA0522A12598DE792
SHA-256:	894351DA16B15ED251441A9C859AFB812491AE1ACD91A3F39829E52714A7FB23
SHA-512:	B29DCBE612D8A51C520A8996B49FE21EDCB969EDF12730CA27E717335EC706BF3371AA386FBA98B86B7A61E22D25CAB2A10E045A77262C49A7EC9726D6EE4FAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.......................................................-O......-O.................. ...........................Rich............................PE..d...^..c.........." ................D`.......................................0.......r....@.............................................................L........3...,...*... ...... ................................................................................text.............................. ..`.rdata...C.......D..................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...L...........................@..@.reloc..\.... .......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\Product.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.8552326097808525
Encrypted:	false
SSDEEP:	24:PCkwvMK2CHxb6CLiDQ9p7iVqVQrd8opv6lVooaS+xQW27IJa1RwYcT:qkEsCADIxiiQrino4+R00rT
MD5:	54586C0C3EE89A612B34B782E0CEDAA3
SHA1:	0920E756DCFDA141B0E5FA47054B9765EBEEBF36
SHA-256:	6ADC304A183015DE1FBA7B5CBB76CED2D6AD59C999B80824603F3DFE4949B2C9
SHA-512:	814A68A5080B59DC00B5A89203D63B74358E6EEF0371348E4DDBE2230B93BB0486768FD73353E8CBC433B6652B19A5219A8DAC489274C42CC8B9E858BC43C689
Malicious:	false
Preview:	...@....3..=6F:....bM .,....s..L..../kP...W"...!....gu.Zm=......M.r...;..80..QF;.YmM..uL.=TNS....Y>....4.....o....s12C.......f.......#...,.G`._....g.7.m..H. \|.=.pRWX.\.2.)^..J.,....v.....;..c.A..H5..{bz3...Ih@.bq........"}e..a.....j..#.4[.....v...7l....8L....oa..Tc....qd{..{.g......u..r..}.S.........52 .!..so.........s.PI.....e].....+..+..4e.C6h.....}KU..d..h...:9>[2bq[E....q..f..%W~.f..W...e...<.d....[A....o........K....$H[......[.s....@..".4O.......rh.Z......6.I.7....P\|.....].qJ..-5."0S....V.4...J<.L1I=...W....3./".+j..Qt../X.....X.(..r...'Lo.1pX8 Gt..D/..K6:...M..i.....}..V..x...q...crK.....c..w..]..)m.....=.....`.F)...mG/......}{[.4X..(.\%..=.}I.h.#],.....u.....Z...S...Y....,J9..Ld9.....~..m.}ZW\.2$...2.&.=u.=rC4v'.?}.,_h..3!4S/L...6H.)......!....9......&..L.t....T.lG1V..1.I.O.c.......,.`.....h.tl7sD.4...$.Y.....S..;G.....Z..2CMB......W.n;W4.l-@..S....4....H...5.p....g.(..e...{'..j.........v.I..L.Z.k..V...5./..3m.).. .....U.~

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\SCTX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2078736
Entropy (8bit):	6.331672076007469
Encrypted:	false
SSDEEP:	24576:S4gMSMr6fXfdYS1GGiFpwGMvpWBinyEH5H+xXfVco6Uz+657oGSS81:TSl8AGiO2yEZexXfqRUCw7oGw
MD5:	56D6A30EB2B620A8D6A56B5875521C65
SHA1:	0D23D4A4B8682291986E026BDB3C1775FC0CD597
SHA-256:	7A6E934C3E2E6A2854168324F279716B5CCC5953B96315BC2E4B3BBAA6331612
SHA-512:	ED0F9BFFAEDF8447CB7F4BCAEB4DB4168EE5F2BEDAC33F355065AAF2FE609887BA6ED9AB9D36877E0E68A57655D3D19171CD03F36264E464618AC3B94B963C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l.sMl.sMl.sMK+.Mm.sMe..Mn.sM..Mm.sMe..Mn.sMK+.Mm.sMK+.Mc.sMl.rM..sMe..M..sMe..MM.sMe..MA.sMr..Mm.sMe..Mm.sMRichl.sM........PE..d...BN.b.........."............................@.............................` ...........@..............................................................G......,........*.... ..;..p................................................................................text............................... ..`.rdata..jE.......F..................@..@.data....t...@......."..............@....pdata..,...........................@..@.rsrc....G.......H..................@..@.reloc...M.... ..N...@..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ScrMon32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175448
Entropy (8bit):	5.709803202914344
Encrypted:	false
SSDEEP:	3072:c49ibPhtasusSfMxbXMqqDL2/LOt1hVaoQnPT/TzTi/NH:c49ibPXusqqqDL6LOt1hpQPT7zTu
MD5:	21D4A7595C7AEB3D2FBF862A2C30E9E9
SHA1:	CEB75CA163673088C0C57AFA8B4CED38BC760448
SHA-256:	B6C6812B01E0CA9CF4FEBA0E5904DCFB6C967F776C0C805450A86C420856F502
SHA-512:	F0CAE14EEC7D964A0B80C6C2CDBE915A591F45484288589BBEA218148DAB7A428091B118EDDE699A2B39FE6C5F819E59C38E4A1E607025ECECF5DB388E061757
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.^<...<...<....V........e.=...5.f.>...5.p.,...5.`.;...<...K...5.w.7...5.y.....5.a.=...".g.=...5.b.=...Rich<...........PE..L.....yb...........!......................................................................@.........................0.......Dn..........................X#......d...P................................\..@...............$............................text............................... ..`.rdata.............................@..@.data...H............n..............@....ScrmonS.P...0...R..................@....rsrc................`..............@..@.reloc........... ...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCli.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804816
Entropy (8bit):	6.459209661172028
Encrypted:	false
SSDEEP:	24576:vH0zLS1GGiFp72aGXENzZbieYsEqHa+E3hc/XnN3EflL+6Rj/1r0Bz:4RL3GSzJTYs3H5EqnN0fl68jF8z
MD5:	C851706ADC35EF9E4B3C306CEC3B9435
SHA1:	EBD1F899BFBDB6EB475D706BEB0FC6DAFE1B7A45
SHA-256:	0CA7BFB5022796346780F441AC7DBE7369477F3FD8BEC75DE19F5BBA09328ADA
SHA-512:	9B98F1F87A8E95EE3DC6218AD30F0DD4B87DE021DB91C67762E754030472AC05BAA686C72F00D82D850F5E11AC32B29256A7D1CD0E3CCCDF1ACFC1E4C64391EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%S.D=..D=..D=......D=..<...D=..<...D=..<...D=...F..D=..D<.GE=..<..uE=..<...D=......D=..<...D=.Rich.D=.................PE..d.....-c.........."............................@....................................(V....@.................................................8........................`.........t9...................................................................................text............................... ..`.rdata..............................@..@.data...(...........................@....pdata...............V..............@..@.rsrc..............................@..@.reloc...J.......L..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtInst.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	171864
Entropy (8bit):	6.116740185924319
Encrypted:	false
SSDEEP:	3072:gYGYC3LPOUSOCEKzRtp19RV+RiMqqDL2/9PtIMOlaXDUrD2uBj7v:gB3KUSOCEKltp19MqqDL69PtNOlaXDUV
MD5:	45D0972B1DA80A06A396A5413BE63F06
SHA1:	57C82B08BE11B3C4D176BF0FC9A52D986C066ACD
SHA-256:	F581E4492F3C8369BFB4D10AD63BBD5A1A56D86B6EAC84C27E760EC2A2B5C710
SHA-512:	B516E1ABA26A1D5F115CD9B7C538E71401ED75DAB19B4524C0A200854E770ADCEF6065B0F22DDFD921A7D6722B0A5A12AA708D676B32D0562DDF1B6085827FB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.H...&D..&D..&D%O]D..&D..D..&D..D..&D..D..&D..D..&D..D..&D..'D.&D..D..&D..D..&D..D..&D..D..&DRich..&D........PE..d...V.yb.........." .....@...8......X0...............................................8....@.........................................PF.......'...............p.......\|..X#..........@]...............................................P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P.......<..............@....pdata.......p.......D..............@..@.rsrc................X..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1981464
Entropy (8bit):	6.417695231214171
Encrypted:	false
SSDEEP:	49152:oGOBd4Jg6SNpVzvAVxw6AWIs8q1v5bP0v5gOSyl:3OdX6TjvhP0N
MD5:	EA18F7879E245EB444BC97FF0F5F9336
SHA1:	2C6B354BE2B9C361E5A2F10F10D6D3BAB57A74FF
SHA-256:	576756155AA576960F059E78B5AB7DE05889FE5CFC9DDF9714FD75B4ECFB53EB
SHA-512:	75DCD91B3022EAD5AAEBBB6A9497D19B09199A42ED5DA41BF56F5F49E3F4F02CCBDBAF6610FB328267DFC493BA41220EA37F3BACCC16D6BE4952C4BF14C3D706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?....K..>....K..>......>...6...=...6...9....K.."...?...o...6.....6.......6...r...6...>...!...>...6...>...Rich?...........PE..d......c.........." .........<......P.....................................................@.........................................p.......X...........x!...p...........*.......>...................................................... ............................text...(........................... ..`.rdata..............................@..@.data...8...........................@....pdata.......p......................@..@.rsrc...x!......."..................@..@.reloc...Q.......R..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StCtl32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1649176
Entropy (8bit):	6.732347194366768
Encrypted:	false
SSDEEP:	24576:l9ZzvHSTYVXBjmK5ZEuj4r3YCjPmt8picRWAUr3p2J8K+v9qzf+Ym+6KZRiSiiVJ:Nz/SY5S8kRPB91Yk6vwf+YBVZUSMW
MD5:	E7D02E228137AC2C5E58D9C88B3EB734
SHA1:	5F80460F2F341FBB6A3234D80B1A7FCA37AC287C
SHA-256:	DDA3B19D05EEA3D7C312E17180C8228B6B7C5FE3BB56665146D814AF58DB448F
SHA-512:	06CC0963FA36BABFE5ABAE741EF8A0281E5BF5F50D3A81A48B65E158D8E5541EF2F20E2FDF378F5A771EA8BB25467D7A18577896D64704392C23C281DEBE3766
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E?...^.V.^.V.^.V&..V.^.V..LV.^.V.&OV.^.V.&IV.^.V.^.VM].V&..V.^.V.&YV._.V.&^V%^.V.&PVL^.V.&HV.^.V..NV.^.V.&KV.^.VRich.^.V................PE..L...6..c...........!.....`..........k=.......p......................................q.....@.........................@0......h...,.......t!...............*...........{..................................@............p..,............................text...._.......`.................. ..`.rdata.......p.......d..............@..@.data....p...@.......&..............@....rsrc...t!......."..................@..@.reloc..b...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3336216
Entropy (8bit):	6.441350645281096
Encrypted:	false
SSDEEP:	49152:k5tUW/bpXQg1iUY1reWeTYA9EDkTIvfXS8qNe97TFrRE75DFnQNAS:kme2/ZRFFEJM
MD5:	76355E8115666B67345435C7A39F61F2
SHA1:	321E110E144B7AEEE6965503A09EF27AE1FC891F
SHA-256:	4775A0F5EB9066DA4DDD8EF63C35D30E77ADDB0B7D709722B9FADE30D31DAF1C
SHA-512:	CBCCADC9162BEE48D599E85CD2ADD9D70BE6A4AEEC0EDBA940DD9CD0D400A1EB08FC01E7B9295E9A03D43F3CBCC38F24A3F4236C92036B040AA96A2452EBD89F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......c...'...'...'....2[.%...9._.#....2..#....M.%.....N.%.....H.!.....X.....'...+....2........_.......Q......I.&...9.O.&.....J.&...Rich'...........................PE..d...u.'c.........." ......!..........G!.......................................3.......3...@......................................... i-.....p.-.T.....1.D...../.......2..*...p3..E...$"...............................................".(............................text.....!.......!................. ..`.rdata...[...."..\....".............@..@.data....!...p-..<...^-.............@....pdata......../.....................@..@.rsrc...D.....1......r0.............@..@.reloc..Pd...p3..f...X2.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSdk32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2687000
Entropy (8bit):	6.7111248929166045
Encrypted:	false
SSDEEP:	49152:Xz4sEXrL69DT+PkB6+/MJ1QYzp0xZZGBnWUN/vC54:XkbXa9DT+P7+/MJHixKl
MD5:	D5919888A83C386DAC463F8BB943161F
SHA1:	92B2E200643127F1265EB2FBEF9DC52D6D6C9917
SHA-256:	44561D2D5FB6C5797D716A839D2FACAF8B6B4AE0C9C140547099BFF008E28FE0
SHA-512:	005A2A7BE00FE3FEE0A691F8F3AD21672131A1245F6717D839142F4194D0685D0648EA4AAA73ED899221560B50F0299EC70695AEDC86829C20C11916518CA9F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\...\...\......\...1...\.b....\.....\.....\.....\...]...\...'...\.....\...}.\.....\......\.....\.Rich..\.................PE..L.....'c...........!.....f...l................................................).....].)...@..........................d$.....<4$.T....`&.@.............(..*...P(.LL..................................H.#.@............................................text...se.......f.................. ..`.rdata..P............j..............@..@.data........p$......R$.............@....rsrc...@....`&......n%.............@..@.reloc.......P(......T'.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7092240
Entropy (8bit):	5.977142176247476
Encrypted:	false
SSDEEP:	49152:wK9i1SDDJlLFylPDbvXsQSFxkODI37WpqTXGZUWJkPuwAOHgftXAkeLAJIR7djXp:wsV48bst5gFXQLAAHkiWglga
MD5:	3788CF099E2B65810B7EC53430E59CB1
SHA1:	79A8A9F4E60E0AFB2C08FE7F7DAFC781762A6F8D
SHA-256:	E715AC15FD9EB9729F558418E41D82ED6EA0C309F7669ACFDC1A94AB399CE3AD
SHA-512:	4F2A108598A4392A13D3C9063A3019F0F9BD80DE54464D606F0E6B842B854AAF025817FD5F561363EBA4FA6355C57F15013C36FB31D22DE3A212FD7F872185A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H...........L......Z......Y......_.....q......q.......O.`....H..................F.?....X......]....Rich...................PE..d...aE5c..........".......A..p......w=........@..............................m.......m...@.................................................H._...... g.......c.......l..*....m.h}..p.A...............................................A..,...........................text.....A.......A................. ..`.rdata..8.....A.......A.............@..@.data....E...@`......&`.............@....pdata........c.......a.............@..@.rsrc........ g......le.............@..@.reloc........m......Jk.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSess32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332824
Entropy (8bit):	6.166551546859396
Encrypted:	false
SSDEEP:	6144:TPXtx4i+1SqqDL65OQHrwPTE97W2WY/ey:TPXtxr+Zqn6dH75t/h
MD5:	7F2ABD5AEA61B3DD4E1798E6DD1E542B
SHA1:	5A2C48F924F80B0175BC72B9E1AC632B47119190
SHA-256:	F163B5ABEEED2E4D1D909DE5366329DA21B8D3551C64BE7BD7E24D653D151B5F
SHA-512:	602D682C242591EF004885FC9DB79952F822A3C6DECF85C219C81A8EE88E0BBBB6397CFFBF7F11931C5E007E2DF518C122F4810E806F480ADBFD613A39699E36
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x&B..uB..uB..u\.uF..ueN{uG..u..uC..uK..uF..uK.uT..uK.uE..uK..uD..ueNmu_..uB..u~..uK.u...u\.uC..uK..uC..uRichB..u........PE..L...+..c.................L...........B.......`....@.......................... ............@..............................................................*....... ...f..................................@............`...............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data........0......................@....rsrc...............................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\StSvr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2034712
Entropy (8bit):	6.42432614740446
Encrypted:	false
SSDEEP:	49152:3OpRl2lfu2ubIuuuKtKrD6MPjX/jNS4c:73duusrFr/jN
MD5:	3A79D928348E36991FE1E9E89A797E25
SHA1:	44018020982345804E284B84B2B3F128FDB148FE
SHA-256:	F5F1554312CDC717E5E638458D4E0CC9B45C16ECB2B40F5F2BAE5BCD08288B88
SHA-512:	7D04ED61B633131790BA79A09D79F7D71570EABAF9430D3C26FE5DF5D7381236F3CBC8BCF9E019142846F6660B8D3B941D693DEEF2BA7B968B702B2D488990A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.N.:...:...:..+uc..:...B`..:...Bq..:...Bf..:.......:...:..e;...Bv.h;...B...:...Bg..:...ha..:...Bd..:..Rich.:..........................PE..d...N.'c.........." .................M.......................................`.......]....@.............................................J........................5.............8E......................................................@............................text............................... ..`.rdata.............................@..@.data...8........T..................@....pdata...5.......6...J..............@..@.rsrc...............................@..@.reloc...W.......X..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TFFREGNT.SYS

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	211888
Entropy (8bit):	4.280846560531454
Encrypted:	false
SSDEEP:	3072:4+jcrSnu1GwN+CKr1ZSntm5lOjw2xyQNElr+A61yue:4+orSnjn3YU/5
MD5:	2F04888FC02BB091F73E4BD73F59D867
SHA1:	D130250F27D3C94D931EBBA098F2BA7BC675DEF2
SHA-256:	0FD6C35C03D5060E820275CB12B79A5565B2E51241C4C06180FC162AD4F76F6B
SHA-512:	E0C29EBA1A9F501D784107E1DB2A06F5907DE17E4346AFEF38672E94A17BAA5378B255B85C3EAEB2A63CB3DE83316541C23E5C4B750D527E786A61E5B2182467
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..W..W..W...T..W...V..W..V...W...S..W.z.S...W.z....W.z.U..W.Rich.W.................PE..d......b.........."......x...x.................@.............................@.......R....`.....................................................<.... ...................O...0..........8............................................................................text...pf.......h.................. ..h.rdata...............l..............@..H.data....P.......J...\|..............@....pdata..............................@..H.gfids..............................@..HINIT................................ ..b.rsrc........ ......................@..B.reloc.......0......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TNNetUtil.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1828368
Entropy (8bit):	6.404704447013732
Encrypted:	false
SSDEEP:	49152:ZkZBU7xHRShPdi0aF3PkCHPSEJhBrormt:ZUxIpPxhBtt
MD5:	9E9446AC1FC8A4E5831FEE643FB26AF3
SHA1:	DA5039F4B49515FDD79DD8B4C067FC0BAA2689FA
SHA-256:	048908489D43F4640DB1857799655C3692DF2661B0CCBED6E1BDB7288A94497A
SHA-512:	E0598923DD54EA2A24A1175FA6257460AEB00439C9E47BF525A8F98EB80666402427AC929540FCFD0D7646792BA2194003ACB953ED4007CCBA807799ABAB3877
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s................a......jr.....N]w......jt......jb.'....jh....................je......js......@u......jp.....Rich....................PE..d....N.b.........." ................d.....................................................@..........................................S..a...`,....... .......0...........*...0..(;...................................................................................text............................... ..`.rdata..qs.......t..................@..@.data...(....`...0...F..............@....pdata.......0.......v..............@..@.rsrc........ .......f..............@..@.reloc...J...0...L...p..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltCtl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	207896
Entropy (8bit):	5.956963782260381
Encrypted:	false
SSDEEP:	6144:5rnJR6PnqR43LEq8GAXgnz9Sqtqwjqhj/6G8Qz9zmm8RpT4OlsW:5rnJR6PnqR43LEq8uL
MD5:	CF486F6361CCCC70B76334D5BC6747F7
SHA1:	8CEBB0DB202FA2156345882A50D5083025D924E8
SHA-256:	96F2A1793EC1E19D4470928E355E013FA61246C70553B4DB162DD00443DDE63C
SHA-512:	13BAC467951757DD7CE1DEAEC9FD5276E93D69199DAD3859857F33435AE757C9A68A1F1A1DA923D843F0D9630E55D6018DBBD3692E3E30307E86C957B08AE23C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.9.c.W.c.W.c.W.j..a.W.....a.W.j..a.W.j..h.W...,.h.W.c.V..W...9.`.W...:.g.W.j..v.W.j..b.W.}..b.W.j..b.W.Richc.W.........PE..d.....b.........." .........0...............................................p.......6....@.............................................d...d........P.......0..h........*...`..L.......................................................h............................text............................... ..`.rdata..D...........................@..@.data...............................@....pdata..h....0......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\TSFltDrv.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534488
Entropy (8bit):	5.8618115032821985
Encrypted:	false
SSDEEP:	6144:8LpLUdvdJX+pHrfZjjxShb7+JsNCSOmhtdO1nUNrfT9vEzmPDH:8FodloHrxZXGCS5h+VU19vkmPD
MD5:	9A9722F87DD767FF048A50BDEDB7865B
SHA1:	5174873F2C3B42D6EC373406213E859E87EA8617
SHA-256:	4EB6F7141941806843A9714B25B852C2AEA64ADECEFBE4FF703EBDA68EA070EE
SHA-512:	D73256E291B1251B881CD2DCFEB9D2A76BE46CAFD45FBBCCED26F62E4E584EF97B34813BA7002BAF20CE35F4D4020B1B484A8569F5E0084BF33B132A9878125F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`**.$KD.$KD.$KD.I.E.!KD.$KE..KD.I.B.%KD.I.G.-KD.I.A.-KD.I.@.9KD...@.gKD.....%KD...F.%KD.Rich$KD.........................PE..d......b.........."..........V....... .........@.............................`............`.................................................. ..<....@..`........2.......O...P..........8............................................... ............................text...1........................... ..h.rdata...Y.......Z..................@..H.data..............................@....pdata...2.......4...\|..............@..H.gfids..............................@..HINIT......... ...................... ..b.rsrc...`....@......................@..B.reloc.......P......................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\UpEx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	757784
Entropy (8bit):	6.019433950422385
Encrypted:	false
SSDEEP:	12288:PSNg5GRag8QEswaSiLp0raJvrOkXfb/zMLUht1SiWOHnuUYeYJveyRxqn6goizzs:aNg5GRaSEs9rLp0raJvrOkXfb/zMLUh2
MD5:	0CBECE6026A196F8EEEA2C37D1A4BA0D
SHA1:	93876327C26DB8C766A5907E4AFA089BF003A6FA
SHA-256:	D2B994F9081CE57AFE43119FA334D10FC4BF820EF8CE2CADF242E6BFAE6B6588
SHA-512:	2643C466E216481D7800605D807E7290A54AA92152A15DF285E601E2B6513A2DA1463B299C2089B1CDBC72CC9492F9BA65750D188801C5F7E5D67A6EF35F5CAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a..8%..k%..k%..k,.Ck'..k..Fk ..k,.Ek'..k.7.k'..k.7Pk'..k.7.k6..k%..k...k,.Yk<..k,.Tk...k,.Sk0..k,.Bk$..k;.Dk$..k,.Ak$..kRich%..k........PE..d......c.........." .........p...............................................p......1e....@......................................... G.......(.......P..`........W...f...*...`.......................................................................................text...<........................... ..`.rdata...8.......:..................@..@.data........P.......0..............@....pdata...W.......X..................@..@.rsrc...`....P.......P..............@..@.reloc.......`.......Z..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Cert.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88408
Entropy (8bit):	6.434286569256578
Encrypted:	false
SSDEEP:	1536:1p8YUm3aOi/Lt3ypYxcA1abrhO4zGMqqU+2bbbAV2/S2LpjCbOlHlE47T4J:6m3aOIlTxj1abFVzGMqqDL2/9jAOlHlG
MD5:	931F74D43AE626D40FD045F1EBD7E6E3
SHA1:	79B23A795588DB0B72C22F97E5D09AFF2602404A
SHA-256:	51D45A416B396BA4691224E90B975ADA37665AF6A89E4CCAB97DB90E392E661C
SHA-512:	1A358ACAFC0FB71868F1E85DB5F15EA36218F18926B0B1ABCE89E4C5D6CD074C91D6886E6CAB8D9AAE77119172CC8E7AC0564D62EB62A6149E74DA1045F3612D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d...\..d....O..d..j+J..d....I..d...._..d....X..d.....d...d..Md....V..d....N..d...6H..d....M..d..Rich.d..................PE..d...Y.yb.........." .................\.......................................p...........@.................................................."..P....P.......@.......6..X#...`..X....................................................................................text...W........................... ..`.rdata..6o.......p..................@..@.data...`....0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......,..............@..@.reloc..2....`.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamCt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47640
Entropy (8bit):	6.102382900076391
Encrypted:	false
SSDEEP:	768:Q9/KjnoLT0NVtCK30V8vCipSCKL2yfpzDRzjOwCOlTjdyYitnkmeEdM5a:Q9CjoL8PCe0GvCC7q2QMwCOlTjdy7VRD
MD5:	83D667606D70516F3D8DDBD91C152D79
SHA1:	704BDEB20AB573BC7B975489FCB672CF97B53940
SHA-256:	F4CC64418BE0E6FFC80BA79FDD4580DCF7FC4E0E2FB4C435CF56740F5EB93F8F
SHA-512:	7003C7C5D4B4BC6B4A636ACE11A15C077BB7BF8B5C7F62C92CBD8B139AEB3967513A3F91AB0ADA63D9858D20E56BCE3DD89A89D1A1AB494F4B032CBFE6806FAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..x...+...+...+..&+...+..#+...+.. +...+8V5+...+8V.+...+...+N..+..6+...+..1+...+..'+...+..!+...+..$+...+Rich...+................PE..d......b.........." .....R...:.......Y.............................................................................................. ...d... ...d...............(........*......,....r...............................................p...............................text....P.......R.................. ..`.rdata...&...p...(...V..............@..@.data................~..............@....pdata..(...........................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	11060
Entropy (8bit):	7.299919649499237
Encrypted:	false
SSDEEP:	192:vMEk+MkvZyhJCRvyyKwnsFWQF+vw4oq21eX01k9z3AR9vQ/od:YirnsFRuw4ol8R9zIa/od
MD5:	D2D74621B89258D22B9B372C53007E4E
SHA1:	7ED8D616B711C7A16CC3233467E32F01AFA8B2C0
SHA-256:	1BDF93E02B701495EDF5165B42C504FAE8A40BF6245CD13082A2E86F7A48B805
SHA-512:	B2C485D65B0958A4448006A4C389B4D992E85D4680FE912C2DCF3F53CF546B3106D4033F68BC7C1EC83A40E2CBD6C8AEFB3B33D53489F4964D86BDD2496C2A89
Malicious:	false
Preview:	0.+0...H........+!0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....=......B.W..c...220218064208Z0...+.....7.....0..X0.... .}.6....U.....(.....I.g.2m.j.._.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}.6....U.....(.....I.g.2m.j.._.0......1<.">.i.{r..q.I..U1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...i.n.f...0.... .".!.Sex0.(...jE9.b...A..#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .".!.Sex0.(...jE9.b...A..#...0..........%V..!...F._n1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...s.y.s......30../0J.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.0535325046738295
Encrypted:	false
SSDEEP:	48:uLfHsQTbiy+ElBjB0Ve5LAUfk35pD3nw9m:uLfHdPiybZB0c5LjkppD3nam
MD5:	60EF12FB5FCCA038EA99C77440E4A073
SHA1:	CBDB313CA5223E1B69A77B729EFC718449A9BE55
SHA-256:	0D7DD636D016820255B6820DC09F2897E9F8C3D549CE67B5326DA46AA1945FDE
SHA-512:	4441A8B2E97ECB8E8718E4C5F326B0462EE79F05057DFE9D4186AB3B4ECD5672983A785CC9EFDBBDDC23A9E5F0CE5580BB26B6D680339A78A51EFDBD6415726D
Malicious:	false
Preview:	;;;..;;; V3ElamDr..;;;..;;;..;;; Copyright (c) AhnLab.Inc All rights reserved...;;;....[SignatureAttributes]..V3ElamDr.sys=SignatureAttributes.Elam....[SignatureAttributes.Elam]..Elam=true....[Version]..signature .= "$Windows NT$"..Class..= "AhnLabELAM"....;This is determined by the work this filter driver does..ClassGuid .= {D7D1DBFC-3F64-4684-99A3-EA59FCB7FDBC}.;This value is determined by the Class..Provider .= %AhnLab%..DriverVer .= 07/14/2012, 9.0.0.3..CatalogFile = V3ElamDr.cat ; A CatalogFile entry is required for a WHQL signature... ; The actual catalog file will be provided by WHQL. The.. ; catalog file for this sample is not provided for use...[DestinationDirs]..DefaultDestDir. = 12..V3ElamDr.DriverFiles = 12... ..;%windir%\system32\drivers..V3ElamDr.BackupFiles. = 10,ELAMBKUP....[SourceDisksNames

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ElamDr.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26552
Entropy (8bit):	6.238330022661952
Encrypted:	false
SSDEEP:	384:XiaR0JFutJh0H5f9voCnCfCjCrs0cs/LqSlGss1Yc/:zeu45oCnCKjh0DM1
MD5:	5340F8746457FA07150A1BE143AA329B
SHA1:	1F09565BE2959D1F96EFEE1D92379EEF3022D0CD
SHA-256:	4B364217AE68446BDAEAF61465ACB99ACA1E0851FD8585EA9B926217A247ECF0
SHA-512:	A4AB7873D0E64BBDEE78B7EBC2894C8EEC4F328503882C6AE4C24E8DEF6039F4653FFC3DAD93F419707A1BC277CAB8C406B15F290C5D68878C0C48D92AC51089
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'..'..'...z..'..^Pg.'..'..'...z..'...z..'...z..'...z..'...z..'..0y..'..0y!.'..0y..'..Rich.'..........PE..d...}:.b.........."......(...*.......!.........@....................................>m....`.....................................................<....... ....p.......F...!......$....@..8............................A...............@...............................text...v .......".................. ..h.rdata.......@.......&..............@..H.data........P.......,..............@....pdata.......p......................@..H.gfids...............0..............@..HINIT....b............2.............. ..b.rsrc... ............8..............@..B.reloc..$............D..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3ISStr.atb

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	120204
Entropy (8bit):	3.8017798349445084
Encrypted:	false
SSDEEP:	1536:U+ftrCxjZtfn9jU9h+VY2V4vp+A0bAsqCeLXIAme8wb:UCrwPj6b
MD5:	40016985276293F6D84939788542A175
SHA1:	8FE83A2A9210E3B49BE0705C7B74E0ADFFF3AB64
SHA-256:	549142F68D8324B4D8D75B1A4BD762460ED58EB474573ADC65BB137D396B2D49
SHA-512:	BB53102A67F7703B36269B73E7AF57FD46F982FEB143BFA9DCD7378948E24095412C3917D200E196B352616FA30A6662AC4CCAB0D7A3863BC1B3115ACAEDF415
Malicious:	false
Preview:	1C7344A8-924A-4981-A212-69091163CB30_RESV10.......tJ.Qj..q..yW.............................................................en_us....................... ...AhnLab Safe Transaction.............................................................................................................................................................................................................................................0...2.......V...........P...................8...........T...........>...^...............T...........B............ ..Z ... ... ...!..0!..\!...!...!...!..."..L"..\|"..."..."..."...#..H#..\|#...#...#...#..\$...$...$..L%...%...&..t&..r'...'...'..8(...(..F).....<+...,...,...-..>-...-...-..D...........h/.../.../...0..R0...0..81...1..\2..j3...4...4..25...7...9..l:...:...:...;..J;..~;...;...<..F<...<..X=..F>...>...>...>...?...?...@..\A...A...A.. B..HC...C...C...D..BD..\|D...E..`E...F...F...F..6G..xG...G..6H..~H...H..8I..zI...I..dJ...J...K..<K..vK...L..M...M...N...N...N...O..tO...O...P..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Medic.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1273088
Entropy (8bit):	7.970271479260553
Encrypted:	false
SSDEEP:	24576:wNGIXgjlFB/AhGDW3U1Nps9oYlK1znWBT4Lx2yyFlRInP72DB//:XpJf+r3ESoYOxM7RIj6h
MD5:	D580C855EE3489FA4A562756E9166B6A
SHA1:	5C4E1C7AC46769D082718A4323D2C275D10827D4
SHA-256:	8109445253EBEB5EAC2FA655FA49072B84DD32D38D1F6DB1958951C2F74D2E42
SHA-512:	2F238A7B9723724BF485D69B53C8EF3EC7A2CC5AAFBA39B1A78F4673F978F786105348303DB08114B59DEC8CE64EE3A22120386BC553CBB0E20C3A4CDACF0368
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................M............h......m.....Rich....................PE..L...9v.`.................d...,......(5............@.................................m.....@..........................................@..8............B...*...........................................................................................text....c.......d.................. ..`.rdata..8............h..............@..@.data...<...........................@....ndata...................................rsrc...8....@......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\V3Prtect.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	30704
Entropy (8bit):	7.994687726116243
Encrypted:	true
SSDEEP:	768:j8ln2GseEwWSsCJnvjjyn17sSt+vJKZY0Bl:YEGlwc7j65sSckzl
MD5:	2392F1EE01FDF107DF218799B881B7BB
SHA1:	F32466DC5920657DDD8957C1B67EA9F1C3C365FC
SHA-256:	21A2C611DEEA9BDDE659DB16CD9AC4492B9E994B1F5A66886EFFE953AED75A09
SHA-512:	9776C36AC288D532FE7A8FCB81A0E088FF2AEA3866A355A233611F4C87E26414A528904C76EF3C5B06323E88D77368771132A857009ABEA8216C5780395F6730
Malicious:	true
Preview:	...@....3..=6F:....bM .,....s..L..../kP...W"...!....gu.Zm=......M.r...;..80..QF;.YmM..uL.=TC.BLI.R.I..Z.;6..;.\.].\;.G...1..q.tl..N1.._2,.Y'......(.).......sG.C0..Y...O..x5&.5..D.........=t9...0..Q..v..H...B\|..B.Af.6.l......uj....\..I..B.3B3.?t.k....G.M...}..............bI...O.P7kor....F. ........!..`j.-{.. ....1V.....4..Rj..P#..X.#>:._.,.E-.N...x.j....-\|tDDR.EA.j,.+ru=..1ZR.2.3.Kt.{.!O.....M:..Ml'.]3...uTzh}.i....[..,u4.l.....{.R.%.]..H0!.Oz....'S.V. Rk.\0..!.H$..IY2^a._w...>a....,.....m\|.cDp....6'.o79B..HWR.%.^.wP..=.:......g.......WZ.L..7.K.l..Z.....A..K.?..qkw...A..2PF...G.D..;=koz...F.10U...KA$6-n1..%.....D...+..c......n..P.wU.f[]xo.\..%.b0@q.....F.[B.A=...S.,... .'..ke........Y0.o...^'H.he2&.)z'..Rvf.ph.D!..f...!>.....4....n..F..Y`.....>....%Pa6..^.PT......+#B.........". ..$.M.[..1"..H$......l.`.r..].}P..H..... :.RJ..C.n.tBJ...]C.{...K..+>I..Fz......Q\|6.3...c f...K`O.#n.M....ar.(w..WA5...v!+uI..54q.p.......yf..l.._....U......(.8..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\WinFWMgr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54992
Entropy (8bit):	6.2151261400912885
Encrypted:	false
SSDEEP:	768:d9DpEJKW7TkYuVags9rZ3n9foQw2EOlOEDG2s1hykp23+zj:d1W7I3Vjs9rZ3n9foQjEOlOEbsXc0
MD5:	CE5126092A96047BEFB273A6FE44D4CB
SHA1:	40D11CAE0D69E2653998661BC2CD07E2BA7BCD1A
SHA-256:	050B372DBD24D250A08AAF0FDB04AE7CC8E2B04089A91F619CC48E698042E400
SHA-512:	9FC1BA5A2C322E27B608288FA33940E1C9D89C486E2926C7AA91862567DB0B7DC312F1195762A2584CABDFC35A5C775D1D75BDC9909702DAC06DD18E64EB01C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|...u.G.~.....B.}...u.A.~...u.W.u...u.P.x...[X..{...\|...N...u.^.~...u.F.}...b.@.}...u.E.}...Rich\|...........PE..d...>`9[.........." .....L...H............................................................@.....................................................d...............<........>......,....a...............................................`...............................text....J.......L.................. ..`.rdata..q3...`...4...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ahloha.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	645656
Entropy (8bit):	5.899960831822906
Encrypted:	false
SSDEEP:	12288:SOxxQ+dinSaJc4Hf8XBX+LdQM69V+Mzb6eb3kGE:SOxHdinSa64Hf8XBX+LdQM6vb6G3kd
MD5:	86C1BE5AF8801AAC17D9B566F5EF1B73
SHA1:	29BFADA2BE4337AA5DD9467EE7E75D78D52E1B47
SHA-256:	138E5FA33CBBA98E794F0378A01716BD744AE0976D33A878E756B3146CF1E87C
SHA-512:	75333ADC41DAA6899427D8348C7683F1321C60B10DA201001D65CFA0DDF3AE7DDD40ACE9D6D6EEB4E2239547716B009E5EFA5DE92BAD0B3949E8CD381D520F6C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x......................................................<m.........:...................................Rich....................PE..d......b.........." .....<...p.......................................................{....@.....................................................d...............lB.......*.......... U...............................................P...............................text...$;.......<.................. ..`.rdata......P.......@..............@..@.data...............................@....pdata..lB.......D...^..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ambassmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2725376
Entropy (8bit):	6.421867300252698
Encrypted:	false
SSDEEP:	49152:PTleOXbolSKB2ig9vU13nj24G29VNoUZTj+uFE:gsKesjtoUZf+uW
MD5:	21B9FF4DCC911D9805437616516277D5
SHA1:	D26E52AD1633E582E938003CB388BEA116482596
SHA-256:	71063323DC029834DC4495BC818940E3339E3D2E54601F3474A782DD21D7B088
SHA-512:	03C5E96A7A9337F43BC469607B5BB2DF0391A1EDEB4F705F0768A05F5D6EF028A59D4D0CF296ED4116D7D1F68009D65100B6053C7D56A2AE802086A7E22FB480
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.....d...d...d......d.....,.d.......d.......d.$Q....d...e..d.$Q....d.....3.d.......d.......d.......d.Rich..d.........PE..d......c.........." .....j...................................................@.....`[...@...........................................'.....L.&.......)......0(.D....l)..*....)..J......................................................8............................text....i.......j.................. ..`.rdata..9............n..............@..@.data...0.....'.......&.............@....pdata..D....0(......z'.............@..@.rsrc.........).......).............@..@.reloc...b....)..d....).............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aos.sld

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.186704345910024
Encrypted:	false
SSDEEP:	3:f0TWqlcr1+sAB6k:feWewABB
MD5:	7998105AC905A8BF889A97EE8939F574
SHA1:	975E410CE656F7E7B61BC5B71B65242DBDA1BF1B
SHA-256:	C2737649D652E9DB821F95F3B05B9089AA52D3D6DAF6A0A7CAF274E9A541F3EE
SHA-512:	BFCFD876FBB66997F8E3EC151C3B78276D79CECF1B169C9694ED6B2504C7A44A65D16209C740110867717FA004116A54E648B986708E8E75D982B7345FB497C2
Malicious:	false
Preview:	slpk a0.......M.....b!....9..K.....2z.%...s

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74744
Entropy (8bit):	6.618122985098431
Encrypted:	false
SSDEEP:	1536:7UpUEXzDnqtBZBenA9qpYZUGcQ4IJ5KQXOla+cCN:7UVqtx9q6Ui4Q5xXOla+cCN
MD5:	DC68A111EA41BF5BA63E0F2427D89A31
SHA1:	E3B46146E5B1380C95A7AB74F6475669C9A486E2
SHA-256:	ECD20EE070FD8F0EC96033DD49A569BF8B50FC427B25D97CAF2E1D5634871FF7
SHA-512:	F0590903D418AC19813BF4EDF21A5E0CE672964A246354354646D73480173642B719F57C0085B6C329E157AAEA52573B58E9207096628FB5E8B48184D785D066
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.U...................R_H......hK......h]......hZ......hM.........&....hT......hL......BJ......hO.....Rich............PE..d.....H`.........." .........P...............................................0............@.........................................P...M.......d.......<.......\|........?... ..$.......................................................P............................text............................... ..`.rdata...1.......2..................@..@.data...`...........................@....pdata..\|...........................@..@.rsrc...<...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aostrust32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62456
Entropy (8bit):	7.0262724518425435
Encrypted:	false
SSDEEP:	1536:ilHPEY1pLigcXI+/Uxxe0qncZiodfOtEpMij1:mEY1pLigc4+/OI0scZio9OtEpL
MD5:	2AB6F2A73BFC656016ECAD8B167B7367
SHA1:	896A354BB46F4295CEAF720DE3E8468FFD770A79
SHA-256:	839236E93DB47C8B345E7969CC9830DA1868AB64EE6CE9B9FA490F58F2770A1E
SHA-512:	9B03D4BC83D8C0A0DAB06965B21BF0552BF64B71CC28260519160C8CFBF2C1012DCDEAD60DB06B00BF9908F67D758B2C468828EFCE703131A06CDBB5A84B85F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q.q.q.....q..>p..q..s..q..e..q..b..q..u..q.q.wq..l..q..t..q.#r..q..w..q.Rich.q.........................PE..L.....H`...........!.....z...6......'.....................................................@.............................M...h...d.......8................?.............................................@............................................text...Uy.......z.................. ..`.rdata...............~..............@..@.data...............................@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\arklicense.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	26046
Entropy (8bit):	5.152056526050458
Encrypted:	false
SSDEEP:	768:KL/5BD3UtnF/ijw3Xenxw2hTGMxQxUVZUh9BuzpDJFql/Mns:KL/LOFajwHsy2ZGMOoZUh9BQrS/Mns
MD5:	9AAC93C4D25C55BB259012F580C3233C
SHA1:	A2DF73985B1CCCEC3697859C07BA318BA7E67063
SHA-256:	5D2E8EFD104AD8D5FF24BE904C019226554D0D89677B388508FBE9D615814396
SHA-512:	17AAE966F69D4DC84FB452124DF47D0C9286AFA46A9FE850E135F3F2E5CBC755EC1628D8287BDDC47F9474FD1D62D77BA9717088F9AB345573160498186D7BD3
Malicious:	false
Preview:	..... Ark Library License...... Copyright(c) 2008-2020 Bandisoft.com.. All rights reserved except as specified below....================================================================================......* zlib : http://www.zlib.net/zlib_license.html.....Copyright (C) 1995-2010 Jean-loup Gailly and Mark Adler.....This software is provided 'as-is', without any express or implied...warranty. In no event will the authors be held liable for any damages...arising from the use of this software......Permission is granted to anyone to use this software for any purpose,...including commercial applications, and to alter it and redistribute it...freely, subject to the following restrictions:.....1. The origin of this software must not be misrepresented; you must not... claim that you wrote the original software. If you use this software... in a product, an acknowledgment in the pro

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asc_main.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	129056
Entropy (8bit):	6.294528208901257
Encrypted:	false
SSDEEP:	1536:shUPJasOeUQhVFfuc+9e4/2pv/SXpedpVH8fBTwN2akiItSWp7M:seU1RYHSXpedp6faN2akptrpg
MD5:	5C77EF9D095A9C8D4DA5417E0DC82167
SHA1:	F1377158B7C8DD14E641095CC30DEFB21E238764
SHA-256:	2CB446E992CAE953CA963212C5B01E92EAD41FDF2FD1A330ADF6E519D5004C9C
SHA-512:	43FC97AA031FF61DBEB897654CB74271DB64C2EE1C4D0EB7068B2F644A853BC17021D4A9F62760CFE1E8E679B28BA959C9D9DD68DC7216433231260465F391C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........ZX...X...X.....[....Y..Z....Y.._...X........Y..i....Y..Y....Y..Y....Y..Y...RichX...........PE..d....m.b.........." ...............0........................................`.......................................................U......pM..P....@..P.... .......... ...P.......................................................................................text............................... ..`.rdata..he.......f..................@..@.data........p...Z...T..............@....pdata....... ......................@..@.rsrc...P....@......................@..@.reloc..4....P......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asdf.sld

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.413977073182751
Encrypted:	false
SSDEEP:	3:f0eRtAFmkPcln:fVRtAxPU
MD5:	048F49C85CDF1AADDD35F5D917038A3E
SHA1:	4F58AD1471426ECDF29FED712E201699DCD11A97
SHA-256:	C06138DD09D44A59EFCC8C603310E7A26A0761E6FD5C5DEB1C52C06ECF0F402B
SHA-512:	72E6149CD929D2093594D9DEC8B5082450DDEE50A18EC1147B40AA4BE7F2C8E680E748DD612C20292E118531ED4EA74892DD616D4B1323B27D3F9FF64F567D0F
Malicious:	false
Preview:	slpk a0.{y.S...H.......V...wR...W!/r<`.?..#.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asdf.sld.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 171 bytes, 1 file, at 0x44 +AX "asdf.sld.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	15811
Entropy (8bit):	7.4572255711379585
Encrypted:	false
SSDEEP:	384:y4y7wa+pY0RFXRKOBxQUeyt/p23+r/jLVY:hyU1fDBzRp23+zja
MD5:	59402821A9760D1789FDD15DE3E0EEAC
SHA1:	8EBDA649BBC7E258DBA0515E09B6799276AAB20F
SHA-256:	E97B7598A62230BA2543169A107410775BABD83602F6AB13D384487427D7B7B1
SHA-512:	C1334EAFA8204D61650D958FB7876DDF785514FD51E5D82E97106EA213AEB9B38A0369A05AFF57B3EEA964639748DD6C8943F751C713B5D94565290D8C0752BE
Malicious:	false
Preview:	MSCF............D................................=..........a.......B..........Q.u`.asdf.sld.ahf..&K.B.B.2,C06138DD09D44A59EFCC8C603310E7A26A0761E6FD5C5DEB1C52C06ECF0F402B0.=....H........=.0.<....1.0...+......0...+.....7....q0o0J..+.....7....<.......$f.....`..(1&0$..+.....7...1...\|$#..{L..H..{.ka....0!0...+........K..RX..........M.....O0...0................/N.R.0....H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...110413100000Z..280128120000Z0R1.0...U....BE1.0...U....GlobalSign nv-sa1(0&..U....GlobalSign Timestamping CA - G20.."0...*.H.............0..........e..W..S.4.....G.j..[..'.4.........Anf....dZF/...w..\.".jg...t.O..R.[.G.....e>..0Erm9..6....O....1.a..b.@..................Yxw...RkP.)....e.`a"...2..Q....0...........l.z....b'_o.m8t.......L...}J&..V....S.t...h.`.. .....t..).b.G...S....;.p~.%........0..0...U...........0...U.......0.......0...U......F.>.........j....0G..U. .@0>0<..U. .0402..+........&https://w

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asdsr.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	107584
Entropy (8bit):	6.739043600231051
Encrypted:	false
SSDEEP:	3072:a9PUEmgBKkTF3LL8yegP3RTVIvZ92S5xyB8MdVbYPnkSanxOzhRsM:anUgP3RTVIvZ92S5xy4nhRsM
MD5:	C3880F488A1C3E4585276B3D988D3865
SHA1:	6BB44166001EF53D83601E63889C2978EC48CA47
SHA-256:	6F6AA9AAE8006DD2B9767E1AE311A171F5423EEDF7B6BA60B418532F7AD95E11
SHA-512:	E39B36D1B2448BA6777584F494369C11CE339F097B6D034D2E91315AF56C8A9F800ED04D439E756490D784D9D13F98DC6C8EF6A06797F4E7471669F0A44081B0
Malicious:	false
Preview:	.............................?8..................`WAW@DWV?8..................................b@[DSFW.`WU[]\.?8..................`WAW@DWV?8?8...y]@WS\.?8..Y]my`?8......?8........................?8.....................................................................?8..............................qv.......................................................................?8.............................................................................................?8..........................................................................?8..................................................................................?8.......................................................................................?8.......................................................................................?8..........................................................?8...................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\asdsr.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 172 bytes, 1 file, at 0x44 +AX "asdsr.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	8188
Entropy (8bit):	7.318627564911616
Encrypted:	false
SSDEEP:	96:/5B9Y+YZTY/9Zvc3FUNBdtH2QLqY2DsQtPuohMVHpYn2GWmoTWYu3JUfhdyEi7Z+:OLZscF8Bd1LLvCs1iYH+2zmqWBZH7uD3
MD5:	3432003637F74064E8C0AEB34B583D93
SHA1:	17CD3FEC9BDFF1F4635F9349ADA7A9FC4D40B3D7
SHA-256:	783BF091384FB7217F4D7163757E26771685A90BBE9A152F97961C186243F844
SHA-512:	88EAEE5AC4424729A23358BCC22E40398F84B09C3DDE16E78117FFF9C9D9DA7031C03AE7B4FE06BB0EC1209F9002A9AADDE073DB6D4E574073A581C71BD5ECD6
Malicious:	false
Preview:	MSCF............D...............................P...........b.......B.........T.{`.asdsr.dat.ahf.._3xB.B.2,6F6AA9AAE8006DD2B9767E1AE311A171F5423EEDF7B6BA60B418532F7AD95E110..I...H.........:0..6...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ..w+4..H..p..F.u.p..7......OUD..010...`.H.e....... ...\|V....-..040...p /%#...`.........0...0............._:....x...G\0....H........0l1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1+0)..U..."DigiCert High Assurance EV Root CA0...120418120000Z..270418120000Z0l1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1+0)..U..."DigiCert EV Code Signing CA (SHA2)0.."0....H.............0.........S......d.....5...,..,..:5.:...W..../.H<..n.".Qya.C/....I1.DX>.....O#~.le$.U>..#\|.B..zbE.}.ct.c%.....EO.}....u..........>.E.z..X.64.+.+1Xf.2....R...>.v.@Z..j=.K.v..\.6...0.L...*XA......... "v.^T8.b..p$...p.d..-....!.l...{.P...6.\..J...9y..=:.%........X0..T0...U.......0.......0

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\aspinfo.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	3.9811091355771175
Encrypted:	false
SSDEEP:	3:tXTLa2QwTfmVfLgSnTnRkdC1rW3UgyqhiEKmEdnMMPd3dhlhVUriaVmQUUn:pLRQwWMU/1rrgyqkEx6MMPdzlDGPU+
MD5:	EC34BE29301BA36F43F21ECCECCFE07F
SHA1:	12EA26CB9F1D974444BEB9D96FC806BB1DB364DA
SHA-256:	715285B4292DBFC6DE044A49CBE23B6218487AA627B5D2A9A2ECB474024A3233
SHA-512:	20FE2405D25C7193A5651DEF56C51202AFBD370EA6CE2EC6AEC6E61DF7833DFF7B44AD240B7C03D7E4B0E6319D2D81E47F96FC8C324446F63BC9058D558CCF98
Malicious:	false
Preview:	9905B3668E9BA61097F52338A6F05C0965C08A2AF012AE7BB6D553524902E0C647F2F2C34D6B37F98BF1D35342D2BCB01277C183048DBE474EA48167A8D70BC319BF0EC354E4270A8C80DEE8CA29D30C9D01E6DCD4C0154D3F9BA6E5DC6E011B

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\astx.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.942112766183263
Encrypted:	false
SSDEEP:	3:hWddwA6fLBJoHeA79LczVyRHqeRpkmcBJMKe:AEAy1JoHec9LTqOpIJq
MD5:	180B33AD34ACF1D366C541BD4B6A678D
SHA1:	3475F028E03199616959E65A1A88364752AE8B2C
SHA-256:	A54EF576B172285C83E497276BA7BEE93D6AA526892EAE23C89DA264FEE06817
SHA-512:	116EC531D0888F7EDD03F06B2E01281785E08374371846469F5724633245418B731B058DF87AC9339F27E03DC63A9B61660F79E98BE9FB97DAED5F2DE55929A3
Malicious:	false
Preview:	[Version]..Signature="$Windows NT$"..[Properties]..; Friendly name property..11="{text}AhnLab Safe Transaction..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\atstrust.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1518864
Entropy (8bit):	6.484462666823553
Encrypted:	false
SSDEEP:	24576:4eS1GGiFpq+eEd2bDB5DG27ZBe7ZADilFQt+fK7gIPW:4a9elDvqeZstADilAb7DPW
MD5:	BEE2E36D611CB14C30A5914DF8F7CF6D
SHA1:	BC9DCAD97C50490A99DCEA0FFE2FB02FED174C53
SHA-256:	1D75DB1AC46419A30ECE944F65295731119928F9DE1EA5A3C9D0858BEE750881
SHA-512:	DE8E0EE6D146277841B79A418977B37FFEBA1A6CA153BCDE2EAFD18772FD6C350490FBA4D9DCC8B93ACABE37ACBF761A0D81197C3706900127F0B6DEFAF7719F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.._$...$...$...-...&...-...&...-...&....i..-...$.......-.....-...%...:...%...-...%...Rich$...........................PE..d....3b.........." .........>...............................................p.......q..............................................0...i.......x............@..X............ ..\|8...................................................................................text...A........................... ..`.rdata..............................@..@.data...xN..........................@....pdata..X....@......................@..@.rsrc...............................@..@.reloc..8E... ...F..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\b_bg_bottom_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO36BV73cxy8aV73DJRa9l:g/Qlcm6E9aV7PaH
MD5:	0A8EDCE22FF490E137225C706A3E41F3
SHA1:	6E5DF9FEEE9D7735AD1EBF60EA10064760CA6F6D
SHA-256:	2F886663C91032D8871CB76616A4CC8B0B756E3C1D89261ABC76B9A52C0130F1
SHA-512:	6AD691DA44AAC10AC383D664D53586E3F380EF1986181E3FC434963CABD7D353D3D6219FB5BBE4276B0F66EB2F5452F0C626FCA54BD79B08DE0870B2B226DDCF
Malicious:	false
Preview:	BM........6...(...................b....................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\b_bg_bottom_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO3693UuAaaaOAThGaD93Al:g/Qlcm6yhRajNJw
MD5:	91E32D587544FC0AD138BD76FF8AED1F
SHA1:	2D298AADB0439C65D03525546AD1A9093F0DE8B3
SHA-256:	0D2E0B12341F27286497C2EE641B64D1C267CB194C4F1287A88390C96557C9A2
SHA-512:	74A55ECF3147E438F1779FDF71DE799F702642F2733C2F22D280B4B348DFD8AEF5BAF7EC39FA962D11A6BFECC771264AC0A744F5BC9FAACDED64B94C460B92E3
Malicious:	false
Preview:	BM........6...(...................b................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\b_bg_top_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO369VJRak73cxy8aVAAhQl:g/Qlcm67ak7c9aVAX
MD5:	19B62D084E7B7FFE5ED40F2C1FA30B61
SHA1:	E15FF3A6BB37752292148A084ADA079687559578
SHA-256:	268EFADFB7302EE7FE26358C5AA7CDAEC8479907EE2063411F2B98C6F8D921AC
SHA-512:	9BC407471F5F127CB237ABA2EA8FEFF9A9F626CDBC409D2A70B8BFE5DE5B78FBEDE69B58E25E1F95D3E435E1EA7C9963EE67759FC116E97D920468A373BDFE2B
Malicious:	false
Preview:	BM........6...(...................b....................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\b_bg_top_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 3 x 24, image size 98, resolution 2834 x 2834 px/m, cbSize 152, bits offset 54
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.558052378555314
Encrypted:	false
SSDEEP:	3:glllZlul0lnlO36XRD93SRaOATh/hUXln:g/Qlcm6BJi8jW1n
MD5:	DB687C87ECAB5F7B7BFC13A25994E718
SHA1:	60F7B0F092D543BC6D7D29A291BEBCD1A7249874
SHA-256:	2D9807A38A7F5D2D13CED17BB14C3046311E183BD843DB743DE478F74CF27223
SHA-512:	238503A4C74C63B29C5CAA75BC8C07BF2ADBBC86E39BA191125B5548BA768B6741F9309801B3629CD74A24B965AB0213FB30B03257F24F69448D267A6EABE290
Malicious:	false
Preview:	BM........6...(...................b................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.78218338746202
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGp:Gsl/Btat6C
MD5:	0C669304959B0E005088171373BE7D2B
SHA1:	EA1CF8E78126DE55BAF1E6EB37D563656FF76574
SHA-256:	C9AC041743E12EE00D0C5F371C406968E3765BD023EC60227DA34B9FA920807E
SHA-512:	5F02B7753688BE6903F08E5B8D877F11BE3C39929457CEDF867FF1834D28A7E0A64BE72F6E57E141417B6F5D5E2744C3E0F57AC94BE0C7B1BE650460740784D5
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	0.7779465119582321
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal369B33BBBBBBBBbXBBBBBBBBbXBBBBBBBBbXBBBBBBBBbXBBBBBBBL:Gsl/Btat6B
MD5:	1E2812D4B6D7FF3C739A1E58944A5A6B
SHA1:	173E9DBEFE63A302E422F011B1AB18B2D437C51C
SHA-256:	73A9D29DD03E3AA89A3B98F50DA4C5489C7DD784CA9B2A6760AEBB5DF9225B1F
SHA-512:	42A4299E3F0F655D01637BFE847B0C27BD315E9D0D1BD1E0F9060DC1A40105126434ED15B028C3C035954DFB10829F38809969554DCC0B4A4C109FF235CDB262
Malicious:	false
Preview:	BM........6...(.......%...........R.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_focus_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.074935388906103
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rDaGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXGWXJ:Gsl/Btat6ynnnnnnnnnnnnnnnZ
MD5:	228C9ED5F5F8FADFCC562E343A37C629
SHA1:	65C6B39BCA3D352F62CAFCBFCD3AC13F159360F6
SHA-256:	BABD7DDB01F396F4579E6D8A4F76C8455DA1AD1C0DCA400B10DC75F42BFD2F29
SHA-512:	8299438FAA4EE9851D85EB07D5BD44D3EC29D487FFDA7B2E2EF28A6D9E877DFB896880B1113D8AEFC566F60369097C96F5E923771D07BD93FB37FE729266939D
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[.....[.....[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[..[..[...[..[..[..[..[...[.....[.....[...[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_focus_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.9196884314547396
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36Dp1+YGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGep1+D:Gsl/Btat6Dp1+wp1+D
MD5:	F97D2BA217D1CD1206F5C1E305E491C7
SHA1:	3AB391DA4E065E813A10DBEB2B52BD15C1AE50A3
SHA-256:	572B5AB11F5BF412C30AA672B2E2D7C641BED207F4E511CEDC49AF7A27466A7E
SHA-512:	FFF2DBA0C5FAE84A2F06A9CE7A09870A3F34EEC23B1FB1C6BE139F89F80116B1B1CE5E25355E6110D2183EE2F3941600EA060EEC58A4F1D21124768FD6CAF0EC
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[......[.....[......[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[...[..[..[..[..[......[.....[......[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_focus_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.074935388906103
Encrypted:	false
SSDEEP:	3:Gsl/BlFlal36rDaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaGPbaJ:Gsl/Btat6TnnnnnnnnnnnnnnnO
MD5:	34D285EE702AD7337766D48B9B89B4A5
SHA1:	A45F41B430BC7339B8EA41918620BE56E4E7B056
SHA-256:	1432D8F447CAA86346A851447966685A969564A63CF0A7F76C5887D512F1C7B6
SHA-512:	4E2EB85957FF43892372CAF22A65FEAEC223FC1B5E4D897F644D54252BE3050E6C77F18550305A6C843ECA1611CCE25EE7A7F68F86550798009BA1CA47369768
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[.....[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[..[..[.....[...[..[..[..[..[...[.....[.....[...[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.1354375426684813
Encrypted:	false
SSDEEP:	6:Gsl/Btat6XN99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f99f9h:HDa0V
MD5:	AC907DDD7C77EF70FEADA699976328EB
SHA1:	AC0F084BB34A18E637096E2278936219CBAA2A28
SHA-256:	5E17B51F5D7E7746C861F1FB15D1CF8C32030114F0A37E7B9D1A9197F620233D
SHA-512:	7515BFE1421BEE89864361E193C6F82B7FC270EEAB26583FD72E1B5434C0FA76A6E0FE4A462CBCEF8AA9921C137B4A1003A8FB456DFAA5DD0F78D102F80FB083
Malicious:	false
Preview:	BM........6...(.......%...........R....................q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q...q..q..q..q..q....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.490758125797811
Encrypted:	false
SSDEEP:	12:HDa0bYTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTaTb:F0TaTaTaTaTaTaTaTaTaTaTaTaTaTaTT
MD5:	21D41041002BF6520553A0DFEEBBE9B6
SHA1:	8C6626DB82D28D6737C4E8A1EE3861EBB737E69A
SHA-256:	3562EDC5AAD22669A371DFAD95196C85918A2BDBBDEEEC81FDD094D5DE5A74EE
SHA-512:	18A0EC39F9D5A3DBB3873ACAB8292730BB1F90ECE31ED62870D4DECAEB7832C6BDAEC9F431DA0B172B54BEA4D8FB8E6973ED0938E864B424491A9BF6E04A8839
Malicious:	false
Preview:	BM........6...(.......%...........R......................................bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA....................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.32189457817207
Encrypted:	false
SSDEEP:	12:HDa0OGTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLTTLn:F9TTLTTLTTLTTLTTLTTLTTLTTLTTLTT/
MD5:	840FA729BFC218E9AFB3359CFB864ECA
SHA1:	AACC6E16439DD6B8C1F5E03CA9198848E488989C
SHA-256:	45B811120755F8A66B33D68FADC1ECF698D089665508EB9E611E30E092AFD2DA
SHA-512:	3F6E3920D2AF1678666473598D496C2CE2D9231A879F21176BF5A76BF3BCE4699038B683A9E2081188411B58FF64546174B726C7917A499D4B2C164866386FA0
Malicious:	false
Preview:	BM........6...(.......%...........R...................................bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA..bA.bA.bA.bA.bA....................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_b_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	2.490758125797811
Encrypted:	false
SSDEEP:	12:HDa0OGT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9GT9Gn:F9TQTQTQTQTQTQTQTQTQTQTQTQTQTQTg
MD5:	7038636964FBFD44D0ED8CACB4C66B9B
SHA1:	5B35CEF809618E6A7585B05257DFEDB87313A503
SHA-256:	6D1517B6876451C65FE8D47E5BF1D444261753DA190C22717340F06A85645428
SHA-512:	81EC32FDAB789E836BC1DE4901E0C54C814F0AB359FC267B7BE2902C277A74D3DB82C5952C258A0DD659C70E16590D381333F1ADAB42473609C1DB69D541E858
Malicious:	false
Preview:	BM........6...(.......%...........R...................................bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.....bA.bA.bA.bA.......................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_default_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.146114628422807
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6E9QQQQQQQnEQQIQQQQeuQQQQQQQQQQWAQQQQQQJP8uQQQQQQEnr/:AAf0tuiEkuklk7
MD5:	D6228A67D9F3723E6F665B5CB07DD4D7
SHA1:	20924AB5FE9D77DF4255079E9882D02B44002380
SHA-256:	E0731984C1B08864575B7041C1723378F89C3333B288D4CD70CAFB2A9E0AED8F
SHA-512:	5A20AAF6B6274D1EEDC55ECF2145E32E7FB05A4441982DDFCFA348E50BD1ADF7FDF1A41C52C8816AF6D2136EA77763551C618A41EF1365F19CFD9B7CA86A62DA
Malicious:	false
Preview:	BM........6...(.............................................r..r..r..................r...............r...............r...............r.............k.r...............r............._.r...............r...............r...............r...............r...............r...............r...............r...............r.............i.r.............G.r...............r...............r...............r.............E.r.............~.r...............r...............r............................h.....r..r..r.r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_default_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.3217741176743427
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6mIIIMYINIIIImIIcIIIgxP:AAf0tuiih
MD5:	F8294C11F0697389FEE965D45D0E95E0
SHA1:	7C006B0FB0529A26DCF298D57619EAFA073D607F
SHA-256:	9DE0BB6EEE4DD4E5893C6481925C8095D642307F7E14C5C577BCF40ADF6CF6D3
SHA-512:	9FDC89FE0C225E5FFB2DA1E48944DD0D9E21355B80DB0DC042A4BC96D805926EF299BD58A53760BAFFE6F89461BEAD1966C642128B7BB393D8B06D34C41995CC
Malicious:	false
Preview:	BM........6...(........................................r..r..r..r..r.................................................................................k..............................._...............................................................................................................................................i...............G...............................................................E...............~...............................................................h.r..r..r..r..r.r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_default_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.1585445143483835
Encrypted:	false
SSDEEP:	12:AAf0tuiShHHHmHZgHHFvHHHHHgxgHHHhqRvHHF7l/:uxPvmyf
MD5:	2E0C5DA75913F835E953DFFE5DE024AC
SHA1:	B840992BB01B3EFD6A13804ED5AF5DA4DCA6A64B
SHA-256:	21C9EF6966C2C854BABB55661075A9E12E9FA8C907224C1FCC222542A61C5792
SHA-512:	B06D3935E4F6813593EDF70F5DC83BF11200A638EA875AD1CC067C125441CA64528EDE13C3068CA7686FD1E411CB7E5580EE9580040AF8F2D06DE079100A7F7F
Malicious:	false
Preview:	BM........6...(........................................r..r..r..................................r...............r...............r...............r.k.............r...............r._.............r...............r...............r...............r...............r...............r...............r...............r...............r.i.............r.G.............r...............r...............r...............r.E.............r.~.............r...............r...............r................h.r..r..r.....r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	0.876713498644841
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36pfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDf1:BGl/Ilf0tu/6F
MD5:	9EEC002E066D080166C75241C1EECB3D
SHA1:	F6271391232FFEB9A224FD6003D29E88C67BCCB0
SHA-256:	86B925C99E7D87F7C43EB37869ED97588A13E8281162944CEB373C8B9293FA30
SHA-512:	EE640EB5F48F0153A31976C1416CEE1EDFF19B6965BC506244276D3865A6B527F04C4F114B706EAF9622D10757183DF5CC4FE9F07DD904554E0A7863C26751B2
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_disable_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.1139938619440177
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull363flrthpDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDf:BGl/Ilf0tu/6l
MD5:	968FB5030152ED4722DD54F4C877F379
SHA1:	47F03710AB8EBE2E2539153EFA099C888758CDA8
SHA-256:	8A01C3B8DED40415688133975FB8769E876346BCAECFA77F3340BC069B8A81F0
SHA-512:	B8C9323E3DC6D38D0398969BD412C22336B876B9E34D404679DD6493201D711C9683E4DB5B6872F124DDC5ECF3E6E43A878F0D495C463DFC952DC40814406F3C
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_disable_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	1.1139938619440177
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36pfDLfZDffXPhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfDhDfr:BGl/Ilf0tu/6F
MD5:	5C4D9F9D56C5BE80E97247E26D59008E
SHA1:	C01C30831E3B197C9C46104695AE97CC0D79E722
SHA-256:	F7F8F4A60B6C3BCE7333A8A24FB4F5CBF628265FE51449F66BA7E55598933575
SHA-512:	996D17C7CFBCF9BEEC95046EC2F6F7A922FE51463CADAA3D795847C64B9147B957284A3EE18829251C1E3BB0C2EF5BE98020552E1369679387EFA146463B558B
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focus_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.8281748739020824
Encrypted:	false
SSDEEP:	12:HDa0ifm2m2m2m2m2m2m2m2m2m2m2m2m2m2m2fn:Fifm2m2m2m2m2m2m2m2m2m2m2m2m2m2X
MD5:	A765F45CF5550B470B1C6CA60DD6BA79
SHA1:	7BB0A42AF9838723512DF775416E280E33CED9FB
SHA-256:	BDDDA96EE6491C30D9B7A115EEEA9C6EACD23129DF824475A07C19059B5BB158
SHA-512:	64773351932569254C80DEBB693B0F18F18A5F2B9720706C7E4E774A3CA538654698593E69B950A277170738E959B49A51112A97E1D1851C085B1719D660F782
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...[...............[.....[.....[...[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.........[...............[.....[.....[...[...............[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focus_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.1249435938072896
Encrypted:	false
SSDEEP:	6:Gsl/Btat6DpAIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIAI0D:HDa0DGfv
MD5:	9BFD19E781FB55E2510DB8E14D031874
SHA1:	F283E55E565C8A6845790072D49DB6A072CAC0E9
SHA-256:	DF9A02BA65CF55A93A541D77D926B21BA70676E09D74314EB6736D5B575F95A4
SHA-512:	F0314F6A48FDC53984B2E844FCDB3C11E73D12457FA21C3FD6EBCAA9DE408B28C12819539EAB739FA2E1460A4404922E5E8E4062C4C0C7FBDBB820FE303A4E6B
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[......................[.....[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[.....[......................[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focus_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 37 x 24, image size 594, resolution 2834 x 2834 px/m, cbSize 648, bits offset 54
Category:	dropped
Size (bytes):	648
Entropy (8bit):	1.8281748739020824
Encrypted:	false
SSDEEP:	12:HDa0DZRZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03uZ03u+:FVveOeOeOeOeOeOeOeOeOeOeOeOeOeOw
MD5:	C034729302951F97326375995F44E1F3
SHA1:	8562A0353BD277EEBA481E1DA5F8A7F8B117E887
SHA-256:	D36E78CA3016C16E3DC43849906E9564DCDFD154EA5DA00D8BD38BAA447F1C72
SHA-512:	19969B91ADC5A4040BF2050CE04C10AC06744ACDB70A14E8D4B9B572B230B4FC914AEE3BFEDAE0FDA8F073E1881C2D9ABEADC0322A38BC8735578D795BD496DF
Malicious:	false
Preview:	BM........6...(.......%...........R....................[..[..[..[..[...............[...[.....[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[.........[.....[...............[...[.....[.....[...............[...[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focused_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.276527418542755
Encrypted:	false
SSDEEP:	12:2+feikM6lrCfmCfmCfmCfmCfmCfmCfmCfmCfmCT2CT2UZx2:2HikjlWLLLLLLLLLTDT5x2
MD5:	3F454D2430A8F1113ECA4FA57549B1B9
SHA1:	B74093256B89FDC2D1DD7AA25F48BB60196F8972
SHA-256:	1BEE9A3930A5D2E49CB715CCDC23A69E15DB52073B173A0A4A9B7797540D3448
SHA-512:	8C92B2F1F47B8A226B67BA954299DD95B6CB13D9B8696122E15A4CD3B56493003D7DC71D5485E6834A0CA147DE78FD51E2932AD249CF5B333FC8954E00D1F51F
Malicious:	false
Preview:	BMh.......6...(...................2.........................r..r..r..r.......................r.....[.....[.......r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.............r...................r.....[.....[..............................r..r..r..r.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focused_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.4266194565886572
Encrypted:	false
SSDEEP:	12:2+feiLla8pppppppppppppppppplSalS6qb:2HiLldSKS6C
MD5:	86F5359594726377CCBA1A3619BF9EC0
SHA1:	856E22D5A422F1FCE7502F36BE4C89828D9F7545
SHA-256:	9702F274A0727CA55A5F5C1D8C8D4AF37ED9877F7A8A58D12DD54BB7870FB75B
SHA-512:	77D8588C7186B015B3EC8B3F8D5DE13EACF4FBD375B901E56EC577088AE538A5E570CD609624833591365325FDDAB83C866E956B318D2190FC05FF8476B85E85
Malicious:	false
Preview:	BMh.......6...(...................2....................r..r..r..r..r..r........................[.....[.....[...............................................................................................................................................................................................................................................................................................................................................................................................................................................................[.....[.....[...........................r..r..r..r..r..r.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_focused_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.286697325209135
Encrypted:	false
SSDEEP:	12:2+feiI8LMdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4Mdh4MQ/ad4MQ/ad4HzfF/:2HiI2MduMduMduMduMduMduMduMduMd6
MD5:	88BE733905207D774F2FDE2C5D7F2616
SHA1:	20039A715E52FB996A24407F0EA3FE5426825E07
SHA-256:	0E322BAF5D1478252A21A2ACF308D311CCD7C38977E3A73ADF65212C40BA6C07
SHA-512:	0842C53BACD507303E28D8BCF8C2B732AD886A593EE1B7086C7C73942744EEE03BF87DBDDDC7898E524BA1DB26D78B390AFC39246A9AD1A119D45CD24F932D85
Malicious:	false
Preview:	BMh.......6...(...................2....................r..r..r..r..............................[.....[.....r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.............[.....r...................r.......[.....[.....r.......................r..r..r..r.........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.180304508432754
Encrypted:	false
SSDEEP:	12:AAf0tuiuSSZilkMidilkMidilkMidilkMidiuMidilkMidiS7MidilkMidilkMiE:uxufRRR1RtRymRRRR3RRWRD/
MD5:	A82EBC9BC91035DF4E944061B03C3564
SHA1:	B0F346AEA3F69A962EB48887C15F03E92D3DC3FB
SHA-256:	E575B01625BCD8360D30CAEC6249E76C85B4BA502CBA1739580D4402A346E4FC
SHA-512:	08170053A1457AC5EE4B0F1E5C1100F20BDF5D29013DA87E84363F53C4F7C29929AF73AFA49473DCEA8289FD28FD57915D14431E1B4789E47881623F50B9E6F7
Malicious:	false
Preview:	BM........6...(...................................................................................................................................l...............................F...............................................................................................................................................i...............G...............................................................E...............~..............................................................h.............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.622750727369089
Encrypted:	false
SSDEEP:	12:AAf0tuirididil7ididil7ididil7ididil7ididiY4ididil7ididieZididilg:uxNp
MD5:	2DAA645EB6BF45EDB4564245B07456CD
SHA1:	5384B8BF5BBB0C1DCE97BEA43D313B2BB20FEA7B
SHA-256:	FB2B626C05C11EABD9DAAA61BBF6890FA44C8B1BEDFE0A3B58A458EF6D02A282
SHA-512:	2198F4D2C40BB150489AEF3EBF1F9B0ED2F7EEB7B5F5601B0897CEF255620D3D3CBE85D33FBF4DABDC3A8BFFC992439547BE47F87219AC731ED9E901A06ACEF2
Malicious:	false
Preview:	BM........6...(......................................................................................................................................l...............................7...............................................................................................................................................i...............G...............................................................E...............~...............................................................h...............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1922092703375164
Encrypted:	false
SSDEEP:	12:AAf0tuiJMiZIidiFridiFridiFridiFq4idiFridiF9didiFridiFridiF9RdidQ:uxJj0kjQ
MD5:	DBFA60EBF427ED32D34F477F288E184C
SHA1:	2EC5F17A934C6C37F494F44DB929D63F3ECBB39A
SHA-256:	C70207ED01307045353F5F096A6E16E8A8D7E0F85744AA66272D642E3D03AC65
SHA-512:	B53239EBAC06A040D6996D35D064C097216B16128EEA0DEC4D662F1D91A9CFCDBB5A6321BDDC7FC5AA57B59DAD8CF15B7681D71C9F4ED631ABB9E3244617C09F
Malicious:	false
Preview:	BM........6...(...................................................................................................................................l...............................D...............................................................................................................................................i...............G...............................................................E...............~..............................................................h.............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.2694963705894335
Encrypted:	false
SSDEEP:	12:AAf0tuiuSUNNNLtdrjZNDZNNNN3NNw5jZNX/:uxuZzi5H/
MD5:	C389AA45303F5AC6927D115D327A320C
SHA1:	5428394462E57E49D47DAE7DE18BF3395D309794
SHA-256:	802E5A9C85BECEB56A01CA20E806B6CD33C2FCC1D01DC97DE0AA98A367ED1293
SHA-512:	0EE4DD7C4D71278D54450D8B39EDFE09691DE857A1EDB13FCB7AAE595B3E42F0343AD7A05E6CEF22E7139E3357CA594B683DF894831D561CDA6EA68C34B076FA
Malicious:	false
Preview:	BM........6...(..................................................................................................................................l...............................6...............................................................................................................................................i...............G...............................................................E...............~.............................................................h.............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.6355892144875552
Encrypted:	false
SSDEEP:	3:BtlWl/IlFl0tull36tf3NZtQMt5T5T5T5TyxMt5TTNT5TVDT5T5T5T5TdxMt+T5q:BGl/Ilf0tu/6DZJZts1xv
MD5:	33584E1CE52E751980F93997612C3478
SHA1:	7C79847ADCC60D38D0E8888CAA25E29EB58F261B
SHA-256:	55AAA22455FF6E056BA95E4093C6E86B586CD108828BD52FEA8CF69E77C3E248
SHA-512:	6F54F4AD66EFD77114A4BEB4DD713FC80E2F6C323EC0D003FAA3FEA6DF0AF46FDC10A20DA1A72F63A01D4E73088317FF47D7D528178AB3D526AFD7A4E6CA5039
Malicious:	false
Preview:	BM........6...(......................................................................................................................................l...............................6...............................................................................................................................................i...............G...............................................................E...............~...............................................................h...............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_basic_w_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.2853693864624494
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6yK1mrsZwsZwsZwsZTsZfsZwsZis2sZwsZwsZwsZwsZ6sZwsZwsZm:AAf0tuiJmrsZwFFWqFQ2FFFFLFFkFFjQ
MD5:	9E76E83DAF58AE7D1AD96DB27D43160A
SHA1:	D12E5AED535CF76F0E1DE4F8DC450E735F4EA2AF
SHA-256:	074E20B5C5D0A2D5E6C3F7D8D4745EBCC2D66DB9081EF43DB339A1A09E65186C
SHA-512:	7CA2210AC51253E76FA566967F339DD0720ED85CBCA2D0E7E5F7945CDA4150526180F45D6120D481C3A62AE7F8B53AABE7609DF7AF814B086F4A45CAA1E146EF
Malicious:	false
Preview:	BM........6...(..................................................................................................................................k..............................._...............................................................................................................................................i...............G...............................................................E...............~.............................................................h.............r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_close_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.078279029642031
Encrypted:	false
SSDEEP:	12:lEKrsMididididididididididididididiFiMididididididididididididiJ:mYssoCJ9fi6
MD5:	6ABFDD8DBE54E091566EB3AD13F514B6
SHA1:	A91A309DFDE63F9B908BD97FCFF5A94138B20665
SHA-256:	9A26F5C64A83964703DF28DE6CF968AB87D3555CC329923D1816B0021F93BE2B
SHA-512:	EEA5B0390BB44402E1A0CBB5E2C23C7BDEA34749DF0F035FAE86F035CCEB82D3C338E8349F034CD1CE58A4FD13A8DF119CA22EFC787F57CAA3E32A45B8150E3F
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t..........r...................................r............Q.............r.............................r................................r.......................r......................................r.................r...................A.O......................r...........r........................J.........................r.....r.........................S.4............................r.............................,.........................r.....r..................................................r...........r........................R...................r.................r....................F................r.......................r................3.2.............r.............................r.............. *..........r...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_close_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	1.0750005735157324
Encrypted:	false
SSDEEP:	6:ll+Wtu6B6jGCuRa7PR4PRaAuRpjqq8aG7aDRaeLOp8t:lEKrdDSG8AuRjL0aD8ecs
MD5:	7E0EA93273F65AE76B6A5D124A56E4E5
SHA1:	E8E8A09668CDF78B4B69AE87537ABE65F214FFEB
SHA-256:	A4EC465156FE80385998E78FB223FBB4C439004978601F8B015AF1084FD59912
SHA-512:	1A63BAF9A975888E6C4BBC461152679BD9032D52E798B15C2D825324DEE2248B298D7D54C9EB2606A34A58603B57906AFF180E59A6A6309328054E8D9F8DB59A
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t.........333.................................333...........Q............333...........................333..............................333.....................333....................................333...............333..................A.O.....................333.........333.......................J........................333...333........................S.4...........................333............................,........................333...333................................................333.........333.......................R..................333...............333...................F...............333.....................333...............3.2............333...........................333............. *.........333.................................3

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_close_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.078279029642031
Encrypted:	false
SSDEEP:	12:lEKrUllBA/56RqJ9hRZU5cRZPh5JyRGV5NlB+Qq6:mYUllBy56RqJ9hRZOmZPh5JyRi5nB+P6
MD5:	7DFC3348F19C49B07B56FD79641C8775
SHA1:	DEBA9A034548B5FBA47B6FB0799265DBBFAB2A94
SHA-256:	991B37D235A67EBAC998AE644E3354F27A6A897F1EE6E0861BEBFE61DEF24E6D
SHA-512:	2DA164AE305EC66C5247C6AD3C811A3534E58EEA8A2901DA5372951351FD2415EC98E7699E9F7D5D6A8DF0B66111105717F87AF942FD52CC3B210AB7208E260C
Malicious:	false
Preview:	BM........6...(...................v...................................................................................................................................................................................................S.t..........r...................................r............Q.............r.............................r................................r.......................r......................................r.................r...................A.O......................r...........r........................J.........................r.....r.........................S.4............................r.............................,.........................r.....r..................................................r...........r........................R...................r.................r....................F................r.......................r................3.2.............r.............................r.............. *..........r...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_focused_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	3.3179872123314142
Encrypted:	false
SSDEEP:	12:2+feiL9eeL85L5+885a5+885a5+885a5+885a5+885a5+885a5+885a5+885a5+6:2HiQU8V888888888888888888888888R
MD5:	686EB610127E25FFFC62BE1CA97993EF
SHA1:	3B964F895DD10D171A8F1231133E7A2BCE8F5B5A
SHA-256:	87C85DEDAC9B0D3070445EF090FD188F1DD7A015CE1E8AFF2B71E7D576394F1E
SHA-512:	6FE480F278B12A3648EC6A05C7BEFCF377206AC6EB28E3375F6B37EE1CB9CB445B3367098EC1D8AAD46F5A7DD4B6CDFBDB41CFA496079813180D1133FABA6170
Malicious:	false
Preview:	BMh.......6...(...................2.......................>.......?.-..................................................................................................................................................................................................................................................................................................................................................?.-..............?........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_focused_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	2.678949889807071
Encrypted:	false
SSDEEP:	12:2+feiBHG999u888dk888i888i888i888i888i888i888i888i888i888i888i888:2HiBV888dk888i888i888i888i888i8B
MD5:	AA8BE9125E8F4FDF47F181F815E5729F
SHA1:	4E3A132F661FBC9D0356C08A65E6D2200369E6DF
SHA-256:	E97B11AC0DF159D71EB8022E10097BF9169D7002D1B55302C4B4D879789B3241
SHA-512:	A1163B840FBCD88C0C1BB5BA2F671540FEECCFA8CB225F5F1F59D9A8CE71250D79C618CCE842349586785E5F7265A611D48414C26FB657243A8D3FDC7C9AB45D
Malicious:	false
Preview:	BMh.......6...(...................2.......................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_focused_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 6 x 28 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	3.321663612504288
Encrypted:	false
SSDEEP:	12:2+feiBHG90M8MIA88MA88MA88MA88MA88MA88MA88MA88MA88MA88MA88M87G955:2HiBjM8MIA88MA88MA88MA88MA88MA8H
MD5:	631BB1BF7FB0EF53416128AE9043DB64
SHA1:	32C60B80FFFB2B1CA2E1351C01740E8F377F16F7
SHA-256:	0FB9ACD8A640CF9E6FAFB251985ADCE8EF5A13BEDDC3073660D4D3CCBE314243
SHA-512:	A51BAFCFBD1022CA02B2E14CB8A583392A4219EC9E4C7799E01EA665D074B98C18E6319FB17518243812F1E77C35A317E848B2B516AD912AF494E39B404C1C0B
Malicious:	false
Preview:	BMh.......6...(...................2........................>..............-.>..................................................................................................................................................................................................................................................................................................................................................-.?.......?.......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_normal_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1591264880599934
Encrypted:	false
SSDEEP:	12:AAf0tuiLPaeLo8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8o8eeLD:uxDaUo8o8o8o8o8o8o8o8o8o8o8o8o8N
MD5:	ADF7B3A1D082A37F0188C79630F4DB86
SHA1:	798B5C1E5AFB87D16E71D1A38650DB2B61C55001
SHA-256:	C389431ECADF0900053C9D605EFA6CFF7547DB370D4E678160E038E6915A7CE6
SHA-512:	E2ABC17FDBCD99FF2C0522EE4771FDFECE622C1DA66AD6A5F0157C8BB99905E165EE83141D75B37C0283094C87A2EC8A073AA07BCDF7B3C57D4471EDEFE7C1F7
Malicious:	false
Preview:	BM........6...(...........................................>.....?.-........................................................................................................................................................................................................................................................?.-...........?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_normal_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.5068758547798673
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG998x88u88u88u88u88u88u88u88u88u88u88u88u88u88u88u88u80:uxBxx88u88u88u88u88u88u88u88u881
MD5:	191A8C46C6D80A2577A3CF686CA61BEE
SHA1:	642E86F2BDFB04F520114C11231BABE7844E3293
SHA-256:	3C19807A7D819D9F911D93747619116E1A3D0E8514D865B14ECDBA18BDD6AA92
SHA-512:	694BD0D6D945C2E038969ADC1334B194B4C369749786F70A50E1C758F75FAEAE52094CB4A4028A046100C0559835AA56CC96508B1B45B534EAD847CF2320A6CE
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_normal_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.163619866049062
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG08Pw88888888888888888888888888888888888888888888888841:uxBr8Y8888888888888888888888888L
MD5:	814ECFFF15216053BCAD77B15C0DBF47
SHA1:	8D08664A38B6CEA4CDE338A514AB365146DD2ACE
SHA-256:	219A7818027654A14F5CE9D2C016BA540D184C42733CBA95E3C1F023C0923A4E
SHA-512:	7313D835E5EC647DC7B8E1FA07E74E61434C6B6846249AF8B9FB205FF6F2A61D450C45F6120AB092D3C44DC2D8099DA7705ACDFC3FCBD1E9F0E0C923655A9F18
Malicious:	false
Preview:	BM........6...(...........................................>...........-.>........................................................................................................................................................................................................................................................-.?.....?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.1511899801234855
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6suPGz76676676676676676676676676676676676676676676670:AAf0tuiLPCEmW
MD5:	D0ADB75C535C33441D58B30476F59153
SHA1:	25DFBBF7ABDB73C0BD44F54FEBCA3E61839EA4E6
SHA-256:	C3630F44043CCE1054FD6FD0F675F7A7F754081E49343650C2B99C67F6AB43A8
SHA-512:	4C49786D68E02DC85A50B60F605DA8C91FA4B856E62C611D5138EE8ADF7D4936C5EBD5DCEC71DB129A00503F22EE73E75CACA6766F01205F1787A2400E0D8473
Malicious:	false
Preview:	BM........6...(...........................................>.....?..........................................................................................................................................................................................................................................................?.............?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.5068758547798677
Encrypted:	false
SSDEEP:	6:BGl/Ilf0tu/6BHG990d66o66o66o66o66o66o66o66o66o66o66o66o66o66o66N:AAf0tuiBHG990i99W
MD5:	FEF55576BA6DF8D9E8DDD3F3A248AA6A
SHA1:	70D1C75928F1A7CCC5FA26D633C9DB760282F940
SHA-256:	87263D53FDF0305F2FDF9414EFF7511BE21C36869F1676ABD2020D1A46484290
SHA-512:	C6AD6759B6E7F5FA75430EB397700736E21CEE427C7ECD1F13DB702C5381EBB266E5DFCE5E810710ADF226DB227B06ED1585EE0A1C03C08FD75F6478EC00C88D
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.155683358112554
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG0cZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZvZz5D:uxBrwD
MD5:	103FFAD69F809CA954F63AEE5CACEFF0
SHA1:	03C606C0779423FF6D6C003B5234CBF6A7D5C1C1
SHA-256:	AFD4D14DE45DFBC9FA432A9C9632D15E19B52FF7A9A8AFDF1503E3E1A77F2E81
SHA-512:	D54C1A1F451FDFE0FF2919D88F597597E919C097E2DDDB60A7F95AB10B625BC847EADFDD9CDFADAB4BBE522BD9A60D3BBAEF8F260349A1E5E44C2DD8C32BE505
Malicious:	false
Preview:	BM........6...(...........................................>.............>..........................................................................................................................................................................................................................................................?.....?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.831623311359014
Encrypted:	false
SSDEEP:	12:AAf0tuiLP+ty36y36y36y36y36y36y36y36y36y36y36y36y36y36y36y36y36yj:uxD+ty36y36y36y36y36y36y36y36y3x
MD5:	B7EB369527DC360E4D2DFF873EE53834
SHA1:	FDD0BA19D7F8159F0BF73F1987B6FC1885114959
SHA-256:	757A1E027FEE5EB5237603F7ED3A65527B183C71F7B38F92F8D8C13F7EFE2847
SHA-512:	8BE5E9ABFE0080FF7D5C5083F47FA8C3D5ACD740E1302B731EA70048E37B396E531D11AE982679C283C3BE36D6AFD63B1CED57A96409DD49A24803D97F7B5B11
Malicious:	false
Preview:	BM........6...(...........................................>.....?..........................................................................................................................................................................................................................................................?.............?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.142277993912724
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG99066yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66yv66v:uxBp66yv66yv66yv66yv66yv66yv66y2
MD5:	49780B0D4D38F59750E1F9850C319D66
SHA1:	A8A2291325A8348378CDEF30139E0A7B9EB682E6
SHA-256:	1B8DE47AC5EB946316CD700128C8B9354DCD2161AFFF89917E80D3B21B0F0CFD
SHA-512:	73180985D587E3435D9D62E5E11880C4EA022BF6A395F5E4BBEBBDB9E71196FCFE37968BB46C494493E75E651BDD6B7770F8C556F0CA7E305682B3AB736A7E77
Malicious:	false
Preview:	BM........6...(...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_default_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 28 x 24, image size 450, resolution 2834 x 2834 px/m, cbSize 504, bits offset 54
Category:	dropped
Size (bytes):	504
Entropy (8bit):	2.8361166893480827
Encrypted:	false
SSDEEP:	12:AAf0tuiBHG0qHJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6IJ6c:uxBrqHJ6K6K6K6K6K6K6K6K6K6K6K6Kh
MD5:	729E722D8059285A7CAB6809EC0B4420
SHA1:	881C61AE2FC7246D5699940AA58890F8D707EF00
SHA-256:	8C9D8663881C49901C2393C2573D873E1596B79767AC5723EC990B547586E359
SHA-512:	8E58E8181D3D466CB45FD08A069450B3B89EEE18505A8AA718173F4930B425FD1467AB9A5011EF17626E8BC8A601E3976B9E01ED693D9FB058FBA02E7D494E2A
Malicious:	false
Preview:	BM........6...(...........................................>.............>..........................................................................................................................................................................................................................................................?.....?......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_help_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0556239707913395
Encrypted:	false
SSDEEP:	12:lEKrsMididididididididididididididiFiMidididididi5idididididiFE6:mYssslCcJ0si6
MD5:	B0E9CC4D2D37934CC67C6B5667A4E3B3
SHA1:	CECBE25F64DDC0F95AC0E74062E610C210B0392F
SHA-256:	6E5A77DA15ED13E4D93AD716E179E0A93BE5D1F5F960161723A76F7827C439FE
SHA-512:	7A077CC7EF1D6DD0CE53E890830924DAAA94272395EDA4B9A71221C270DC2F74DB8A30DDA4E752CCDB92044355DFD9C745D00D73B4C261B76B9D0054DAB50BCA
Malicious:	false
Preview:	BM........6...(...................v......................................................................................................................................................................r............................S.t............................r..............................T........................................................................................r...........................................................r............................A.O............................r..............................S...............................r.........................S.4..................................r.......................,.....................................r......................................r.......................r..................R................r.......................r.................F................r.......................r................3.2...................r.................r....................X*......................r..r..r..r..r...........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_help_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	1.0362883229418132
Encrypted:	false
SSDEEP:	6:ll+Wtu6B6joI18lDRSs80YR3jiS8a27afaRDLOp8t:lEKrvOIc0YRxLkafaRDcs
MD5:	41B88B28CB736532445F59219B525786
SHA1:	E7E5BDC9A4B3B0C44C3B3AA983BC4B649E3AE266
SHA-256:	D875A8F4333F0D60AF63A9E1D3308F40809448C0FFF84DE824E71583A5CB7659
SHA-512:	A06B8EF9C58CF28C521359629E68CA4FA751CB2F72A7F78AE6538483FAAE12359B5A36DE94C75850FAF4A41C594762F6CD2849AD422BE5C5380F96D3B4FD4AB6
Malicious:	false
Preview:	BM........6...(...................v.....................................................................................................................................................................UUU...........................S.t...........................UUU.............................T.......................................................................................UUU.........................................................UUU...........................A.O...........................UUU.............................S..............................UUU........................S.4.................................UUU......................,....................................UUU....................................UUU.....................UUU.................R...............UUU.....................UUU................F...............UUU.....................UUU...............3.2..................UUU...............UUU...................X*.....................UUUUUUUUUUUUUUU..........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_help_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0556239707913404
Encrypted:	false
SSDEEP:	6:ll+Wtu6UgaNWZtN4l5gg25UBs1B3R1Rk1RGVtVJKTxUHZQq6:lEKrUgaNQkJwUBUB3R1R2RGNJgAQq6
MD5:	52D839832657CF74D3B28E412B5E8931
SHA1:	02A4C88F8431256E209D2006A41CD58A1B8A54AF
SHA-256:	5D378EA3E3CE5AAD48FAEB161F456069100702E18565B42747421D258147F23A
SHA-512:	125F6BE3B33AC9F551228927DFCA36C5D87681EC1155E7F056E04DA95B19254C90C108FE4016FFD7568E841B54CB667ECAE4B9215BA454C63D1B418EBFE1FE8D
Malicious:	false
Preview:	BM........6...(...................v......................................................................................................................................................................r............................S.t............................r..............................T........................................................................................r...........................................................r............................A.O............................r..............................S...............................r.........................S.4..................................r.......................,.....................................r......................................r.......................r..................R................r.......................r.................F................r.......................r................3.2...................r.................r....................X*......................r..r..r..r..r...........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_minimize_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0141196290884955
Encrypted:	false
SSDEEP:	12:lEKr8MididididididididididididididiFiMididididididididididididie:mY8sb6C1JSBi6
MD5:	AF3BE9968D309E226DF97FFD7EF1159B
SHA1:	369810E340961CAB5E4804B8B9EBBB90C00054EE
SHA-256:	89EACDD7643AAD7A7C2DB3DB82C64E6642460493E690B2EA9CCEFD71925C2882
SHA-512:	D6DAA7908E2F56D31E584CD602D3A586F15ECE77FC0C0D1D272F2596AC4210394E09EDCC8B9F19A29AF6B437D126D88A9F785A93530FF1B5D8247202C753B233
Malicious:	false
Preview:	BM........6...(...................v............................................................................p......................................................................................................................S.t...........................................................V.......r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_minimize_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	0.9850017914518017
Encrypted:	false
SSDEEP:	6:ll+Wtu6ByLp6yHRgs8qqRhjiS8aW7ab8VLOp8t:lEKrwlTiqqRzLEa+cs
MD5:	841EEBDCDC27657BD8587FA08F14062F
SHA1:	8D35A1E3CBD43793E1F344A0F0D52A12A4C41F08
SHA-256:	4DE8099D3E975D04C664A283A0EA1B44CB0A89D5AF39326CFEF975F7062FAEE6
SHA-512:	55DFB35D7D863291A3BCE66E518996ACE30C21A8772AFEFD0021A0778A372300B4F9564CBF06EED31F7BDB33527C0FA733003E141F644EDE3818FC7D41F2F44D
Malicious:	false
Preview:	BM........6...(...................v............................................................................m.p....................................................................................................................S.t...........................................................V......UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_minimize_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0141196290884955
Encrypted:	false
SSDEEP:	6:ll+Wtu6Mlb1jUBZtMloxMc12SVtuTMZQq6:lEKrMlPkbGTqQq6
MD5:	2B6CC1E2F02AB71D925740B4F9E61C0D
SHA1:	DA8C21EA42A089072ABA5C7089CF148B7B251CA6
SHA-256:	65F83408EC0C31415ADE59C9E46A09E1C0423A50B15CC20AD4522B5BCED9C724
SHA-512:	91F67D0CCC47C074B300ED1A5B66235E19FCC5F6B613DAFB1F05B06FA5A851A1D9DA52699F5C6C4666948AF690371E4E2D50EA9F824DFE06B1064D7DB2BBD439
Malicious:	false
Preview:	BM........6...(...................v.............................................................................8.....................................................................................................................S.t...........................................................V.......r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...............................................................................................................................A.O...........................................................S.........................................................S.4..........................................................,.......................................................................................................................R..........................................................F.........................................................3.2.........................................................iZ*..............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_next_dafault.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	2.094902798504834
Encrypted:	false
SSDEEP:	6:4lclgWtSt6RtRJKRJKRh/aIKRcaxKRlCxKR7KRGrQFRmKR3jaNFRJKRJK5:4lU7S0RtOOLaTaagD9IwQFHpaNFOO5
MD5:	C3E712EA16D620CFC55939D256EBD989
SHA1:	48B7A845D19469BA6FF80050EF5B22F5F70C6974
SHA-256:	9B682D3D13CD981DD554DFE27A1A78C96F47A73C10D4780D869D9649C7F3CDC3
SHA-512:	25068C52C2E643A42DFBEE4673F15567A386FF789A09A3BF638D3023321D74A0F7D15789FC6D298840AEF3FBC9DBBBCCA42F615F084C4D086A0B88E90A1ED65E
Malicious:	false
Preview:	BM@.......6...(.......................................UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUU............UUU..................UUU.UUU............UUUUUU\|\|\|............UUU.UUU............UUUUUUUUU............UUU.UUU............UUUUUU{{{............UUU.UUU............UUU..................UUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_next_dim.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	1.5175968046789927
Encrypted:	false
SSDEEP:	6:4lclgWtSt6kTyvyvyUy87ylIyDyZEyr7y8yvyvyv/:4lU7S0RqqrRpuBSjqqH
MD5:	32A31E7DEA045F0E17F3DC6796CD218B
SHA1:	7ECBDF7D352102CC1846B8F5E0F57D156243E6AA
SHA-256:	C988D6AB51E291C77BB5DD1EED6F9056F4B641042B74E2B9B8F0480D23C7FF7D
SHA-512:	81F6ED8363F0F83E7A7BBE5887938E3F85198E7E38E7CE2D0112F488F1D9B97A962FC69B7B7690038CCA2E56B6DBB09F0FE0BC20A37E43543BC89E7B65692BE3
Malicious:	false
Preview:	BM@.......6...(.....................................................................................................................................................................................................................www.....................................wwwwww..................................wwwwwwwww...............................wwwwww..................................www.......................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_next_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.7161727633034305
Encrypted:	false
SSDEEP:	6:4lclgWtSt6L2QeFggiQeDec8gk76Qemq8gxqHVQe1wbg2yi:4lU7S0SqlHcHWuuIRwbVh
MD5:	19C4BCB07FD3E99301B9D41E91DA8DCD
SHA1:	639248EA3D0D38768309CC53615BEC164249DA66
SHA-256:	7A811C8315488B4A8162A12ED78F01094C9A6C3CE08349D5B1FA9685235D734A
SHA-512:	09CDD5A1CBE1E0CBB9AF96F49B9F30E5387CC75A0EEBFD2B6D1BA65DA33BA83EB1C28FAFAAF187C6C24FF5435AEE37506A6AEE4DE55434B582F8E80EDBC1F307
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..@....@....@....@....@....@.[...[..................................[...[..@.........n................@.[...[.............U...Q...............[...[..@.........U..U..{8..........@.[...[.............U..U..U...G.........[...[..@.........U..U..z6..........@.[...[.............U...O...............[...[..@.........k................@.[...[..................................[...[..@....@....@....@....@....@.[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_next_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.2218862614670023
Encrypted:	false
SSDEEP:	12:4lU7S0+7MididididididididiM7MididididididididiM7MidiDm+ididiM7MY:4lQEIIfIEv6LlZ2zIx
MD5:	0942C181CF63E2451B78D894B8B0AAB6
SHA1:	288195A8C68301F0E0541063E455819D364EA18A
SHA-256:	50260F36405FE5353E8D636081F12EC2B1A4E69D215865D644BFC0750D08EC6D
SHA-512:	BE6321FD6B8617949ADC05B6FF419B0E4975CA0BA10CE0BEFA9ED5F7D58E1CDBA97BE69BBC7133717B02661DE43731547B8129E3AD4E657A6C614F07268DBA33
Malicious:	false
Preview:	BM@.......6...(........................................r..r..r..r..r..r..r..r..r..r..r..r..r...r...................................r...r...................................r...r..............d...................r...r..............r..J................r...r..............r..r..3.............r...r..............r..r..r..A..........r...r..............r..r..2.............r...r..............r..H................r...r..............b...................r...r...................................r...r...................................r...r..r..r..r..r..r..r..r..r..r..r..r..r....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_next_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.360314059244064
Encrypted:	false
SSDEEP:	6:4lclgWtSt6/2eYioecck76XqcxqHViw122i:4lU7S0/2rio8kWzxIiw122i
MD5:	D9D9145099E15D68DB3A93E63F42AB0B
SHA1:	E226C3604D568B1ACB67629ECE2405F899955338
SHA-256:	4EDAF8703A2AD7E617B82298BD955D97D174FBD233C929D350DDB90E31D4C327
SHA-512:	391264F6096C13AC41D028742FC670AA1B8EE26564A24C6EC8E608ECD47FB528D315ED9231DADF309BDCA51DB08AD8B02A2787240E695414AA5476C2E61AF18B
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..................................[...[..................................[...[.............n..................[...[.............U...Q...............[...[.............U..U..{8............[...[.............U..U..U...G.........[...[.............U..U..z6............[...[.............U...O...............[...[.............k..................[...[..................................[...[..................................[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_pre_dafault.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	2.085997984437489
Encrypted:	false
SSDEEP:	6:4lclgWtSt6RtRJKRJKRCa8axKRDaIKRnKRrKReOKw1KRw/KRALFRJKRJK5:4lU7S0RtOOUagpck4hKwU3eLFOO5
MD5:	CD0BEF50D9FF5ABF0A59690B17478F8E
SHA1:	5920EA3C9788BBA5D052D89D2917095FA481C110
SHA-256:	5C555E86A21650026DCEA2BEE1AC316A1F3D873BE520BFF06856E89A36CBEBBB
SHA-512:	032E4A7DF19EF50A45D894CCA86739A846C213BD7B4F9C3D4E6E1AB19900F9CA31B0900E53E47CB851AE97FFB8807703B976664C0B7E1EFA8A00EEBEB181D815
Malicious:	false
Preview:	BM@.......6...(.......................................UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUU..................UUU............UUU.UUU............}}}UUUUUU............UUU.UUU............UUUUUUUUU............UUU.UUU............\|\|\|UUUUUU............UUU.UUU..................UUU............UUU.UUU.................................UUU.UUU.................................UUU.UUU.................................UUU.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_pre_dim.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	1.5175968046789927
Encrypted:	false
SSDEEP:	6:4lclgWtSt6kTyvyvyryjx8yUW71yryVyjvnywtyayvyvyv/:4lU7S0Rqqmdjl74mYLywtCqqH
MD5:	F36896B880336C006F5040FFADF50857
SHA1:	713F7D373040363B94BAEB21149303B9BA98D28B
SHA-256:	8FD35668E48D685A5A92A43691F1AB05BC6ADF1FC8144F75375F356288B61558
SHA-512:	1DFC59E907F5A93101641021B31AE8272BD48578A56A1DBC3EC8E9FCC52F6F0B65360E80E6E8F7CC50A978F0DCFB78EEF6DC3DA54E26CD88DCDB3557C2781589
Malicious:	false
Preview:	BM@.......6...(..........................................................................................................................................................................................................................www.................................wwwwww..............................wwwwwwwww.................................wwwwww....................................www.................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_pre_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.719644985525653
Encrypted:	false
SSDEEP:	6:4lclgWtSt6L2QerKmbghuVQeV7gsHwVQeSA7gw68VVQe9Hqg2yi:4lU7S0SfKMCuV573HwVX75VVNqVh
MD5:	FD6F7307BBFE70F597D9BC914DD94B98
SHA1:	BE5EE51889D4572FB23E03EBD1CBF86C7505D44B
SHA-256:	796BDEAC0A3B0CD6E0D0B62D35D8EA3D738D2F7499E42381D6ECA4CF25C92708
SHA-512:	79B2E69CA673BD372CC9E21E6FF124691AADD54A18DCF96E7809479D0191F4689EC79F3D582637B1D36EB02FAFF89B48F8AECBC8B624FAB6DC7A10CC9125168C
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..@....@....@....@....@....@.[...[..................................[...[..@...............o..........@.[...[................Q.U.............[...[..@.........\|9.U..U...........@.[...[..........G.U..U..U.............[...[..@.........{7.U..U...........@.[...[................O.U.............[...[..@...............k..........@.[...[..................................[...[..@....@....@....@....@....@.[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_pre_over.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.2503961889914077
Encrypted:	false
SSDEEP:	12:4lU7S0+7MididididididididiM7MididididididididiM7MidididridiM7MiY:4lQEIIoJo3SnSwn3tSnVnhl
MD5:	5C835038A958F017848BC55A82A7756D
SHA1:	11ECAEB5901A65D15B14712E76D76DD3FA870C79
SHA-256:	E7CB595146B9A8A45B4E941BFB5BA64C1F5A615F84201B3178F5640F9753DC84
SHA-512:	073D64A2AC4E3040841F466F9480DEDB8404503F41488E05563D2D68DEADBB0EBA7D3BA63E94E9CBD2B043E54070689069888FADE904A887A690C816A56B32C5
Malicious:	false
Preview:	BM@.......6...(........................................r..r..r..r..r..r..r..r..r..r..r..r..r...r...................................r...r...................................r...r....................e.............r...r.................J.r..............r...r..............4.r..r..............r...r...........A.r..r..r..............r...r..............2.r..r..............r...r.................H.r..............r...r....................b.............r...r...................................r...r...................................r...r..r..r..r..r..r..r..r..r..r..r..r..r.T..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_pre_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.3637862814662864
Encrypted:	false
SSDEEP:	6:4lclgWtSt6/2kKm1huV0VsHwVNAVw68VVgH622i:4lU7S0/2kKMhuV0VsHwV+VKVVm622i
MD5:	61E1CC0D3492A57C33976E53951BD2AB
SHA1:	5848BEB16BF9C243B38FC146A2AFD0CF8B58BE8B
SHA-256:	E8B3CCB3843B24821E9755B18D44ED0ABE5A0DCEDDE2F9E8BA721AD01B65FD12
SHA-512:	818F62A4D9BA4EF0D0E960F7D7DFBF2F0D30B8D5773FC76F638AF90C00AB2294D556CAD8E707ACCED8E191BB4CA9E832735EAE18E68F80C9E1FA62FA5ECE6F1B
Malicious:	false
Preview:	BM@.......6...(........................................[..[..[..[..[..[..[..[..[..[..[..[..[...[..................................[...[..................................[...[...................o............[...[................Q.U.............[...[.............\|9.U..U.............[...[..........G.U..U..U.............[...[.............{7.U..U.............[...[................O.U.............[...[...................k............[...[..................................[...[..................................[...[..[..[..[..[..[..[..[..[..[..[..[..[....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_disable_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.9372957110766484
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY63flrVfRXRfDfDcffDHfDfDUlD6HxfDfDaX6XNfDfDdDODfvfF:gz/mlqlfa6QTcl+UqaDfGDfGRDfw+/
MD5:	7BE9737638C4E9A27BB0E31418105B1D
SHA1:	28E3F91CFE4F8C46668096473EC34E7E7DB01768
SHA-256:	E3FB1EA02D595C4A57901E0D3BC95A476A5E1101C9E29A2E6721FC147CC15E71
SHA-512:	AEE8293ECF7F520B962DFA0160681FA9CBE21BFE47831B0E146C61AC99485C1000F3CF9B61EE682B0AAF65A6FB1137312045F841E9A88F4CF04734B66EBF6AEE
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_disable_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.796526113707809
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6pfDDDrDDtfDfD+DkvMDXJfDfDVDrfJfDfDZrB1XpDrfdfDfDY:gz/mlqlfa67vMTvrisX+D2XK/
MD5:	2F337CC87C5DF691C92AAFD8E2126E50
SHA1:	C3E4A932467B4BF53418E3CDA22325FFDE9D8443
SHA-256:	512549234AF795E57E879EE95A89EC61E901A22286DC839B203FEBBE2C470D3A
SHA-512:	6259D0278C10F9D88492D9C2755E1DEA9B6CF9E0399929FB4BCD9E6083EF1C4CEEC0BDFDB7FBA2A97BB23646079CB876E613F5B90A8134426F2D49705139B50B
Malicious:	false
Preview:	BMX.......6...(...................".................................................................b..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_disable_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	0.9372957110766484
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6pfDjf/lDXDvLXDcffDHfDfDUlD6HxfDfDaX6XNfDfDdDODfvV:gz/mlqlfa6QTcl+UqaDfGDfGRDfwu
MD5:	965B96AA9ADB0E07B101AE8775249553
SHA1:	9B6D01F6E558702A68AE4A118F00C2822CAE6F81
SHA-256:	21755B3BFDE596DB9D9F7823AF30E3C965D74FFDAAABC387EAE3B61DAEFC1F1A
SHA-512:	B55436A9148643A766535B2C7ACC1785BECE9B545789563AB4B7B8040793A07D50709D3529F84BF8A130D8E3917C7D39C38E5883C665CD4ACE640D9FC4E97621
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_normal_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.478915649491828
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6qOh4eeuCR6azM3JgGtUG1RQGUGfRY7zKrUBA5QYKoj:grmYXqOh4Jc3OPF9wI3Qj
MD5:	8EACCBC6E435F7AEB69B26D176A8A4F2
SHA1:	53BFCBBFA2501E87C8022E7E442CBE38CFC4C8F5
SHA-256:	46ACFE46B1780135202E692015512E3C4654CFC2E3C860850461856F4EF4C8B4
SHA-512:	DF8A204920EBD686192DC234AB40B1EB219F17D200B97DAF7040F426ADB9EEA54CC834E28DA329D552F47AAC50FCEF162A00F087F58C0983CB9996C2AC6DF5FF
Malicious:	false
Preview:	BMX.......6...(..................."...............................................................a..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<...............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_normal_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.1860063448699476
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6+aaMiRazMRMPGWjGfdK/GjGDC7IK4jWdAudQudr:grmYX+hRagRdUUv
MD5:	D215E9B4CA76DD8835311CC559468D9E
SHA1:	F23EEA8BE216EA11212FBD96772B7C8B3F471894
SHA-256:	C95E50767F60DBDC2B1E53DE4DB8A7909AB62F3B574DBFF48D952F3AE6ABCBBC
SHA-512:	E7F0A4A51C2664322F74279A1FC8DD3F5C0FEB83721ACF11BC6860416A10DCE1E5C1158928B203E38162AEF983DB582EDD4C525B80D484E8105743CABE73897E
Malicious:	false
Preview:	BMX.......6...(...................".................................................................a..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<...............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_normal_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	1.489896767274784
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY693iKRaaCuRa1VR8rzR4QVrf1x8rY+4f1eR4w1sR441P1gaau3:gz/mlqlfa6LRoVUhrmoUFW9dtQZLUtl
MD5:	4C6F07F920A2D69D5F27031E34D8E159
SHA1:	CBE1BF87E04165784E35E66A89EE135B38030A11
SHA-256:	10A0D77F8437F42D525C4020E297BFC9E77AB8CE48CF04D320CC02FD085CB570
SHA-512:	22093CBF38D1A90832D677105AD01A2ADC9C4CF4CDCF6F3B88CA6BB3FE728AEA58AC59E34E56EB5A684F91272D28A7BD008A7B7B64F9A4FF9284B21B23CC5725
Malicious:	false
Preview:	BMX.......6...(..................."................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_over_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.867680005219824
Encrypted:	false
SSDEEP:	12:grmYXWuZididididididididididilum7MidididididididididididirMididy:grmqWEM297HO6nTHxqkGEEy
MD5:	A6D481306B52D313F94057F13F16B3D0
SHA1:	E6F63259859A4955C0D34BE38FD734265183C538
SHA-256:	E27EFBD310548D910DC3F6DE53255B88B57094535AF27A2296B4F81EE9A981FE
SHA-512:	C525F007E89DE0D5C95820C436928473352F28DA7B572FA3ECFB514FCFBB02F1948C0BA2563976AFEBBCDF461C5B324EDEB4B2835792FCC6226F0C49332772CF
Malicious:	false
Preview:	BMX.......6...(..................."................................................................_.............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_over_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.5988776359796097
Encrypted:	false
SSDEEP:	12:grmYXIididididididididididididilvididididididididididididiaididG:grmq1Ut
MD5:	B5AC58DA24885D754ABF20C1804D9863
SHA1:	6AAF7324960AB9976E8255D24DD89CC36160BC35
SHA-256:	19429A4B17353CF9CBE0FF1A01756DD916F919C1E6D098E413650F34218FCC86
SHA-512:	DEFF83C6A6EEF44B98BDB27BCF982458C98CB76F54179C6F6DDF0C60405EBE1F8DAB08E84F7B40421C41F48F9B8178AD97FE43FDCECD2E53315EBD8C1245D80D
Malicious:	false
Preview:	BMX.......6...(..................."................................................................._..............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_over_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.879339978670193
Encrypted:	false
SSDEEP:	12:grmYXINididididididididididiSlidididididididididididiF2FidididiE:grmqIPGv2eIp
MD5:	E0B1A674099639FF6C2FD97D5617A754
SHA1:	C8179FE97C5A0D1214F1C464B5DD8B0C9E48AB6E
SHA-256:	22671E5A1C2A5232DF4D345DD561191724D2D943C1EF828FF33DE66C87BA506E
SHA-512:	6969D39C293ABD142F6987F3F5F24D0B179B5FB1937FF50E2FFBD0BF8495360598DE5CF78727ED5F3B8076E958DC9F8FD253D285382AE02D45DA8C83AF20B20D
Malicious:	false
Preview:	BMX.......6...(..................."................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_press_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.888247390617478
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6MPEe3QweRd7iSJdbFisi0vvCEFGy:grmYXoeRdLJdC0SsGy
MD5:	21AFE7C59EB3934E206EBF1D3597D9CB
SHA1:	04760C107262199EDF1BB8BF32654DC2D7C08D30
SHA-256:	D015D4FF8F083753365149EC5C44A2A3D71D578E9072038217505B824FF96817
SHA-512:	58FBED6BAAF73D8678D030DA84908540AB7C2AD50AF2743BB8A3730A5BA79D9F26C87A62C0C70FD4B19B837D03E1A124ACBB1A3E4E77183485A5CC94AF42EB31
Malicious:	false
Preview:	BMX.......6...(..................."................................................................s............................................................................................................................................E.i..............................................l...............................................D...............................................................................................SE.............................................X*............................................... ...............................................<..............................................................................................................................................FE..............................................P..............................................rod.............................................................................................a................................................e...................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_press_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.608060192611487
Encrypted:	false
SSDEEP:	6:gz/mlqlfa6FHTZjuTZEoTZdHTZ9k92TZf9Hwl:grmYXRoTWoXHw2Bpwl
MD5:	FB431E9A35C18579C7125A7AF6708F1F
SHA1:	7E48F1EC8737EE4094079D8A80F1B7FFD4B98EBB
SHA-256:	5727D23AB4526F1EC54D2F0815A69D90F38829ACBCF2C34783ABD51C52BF1671
SHA-512:	7422573BB211E5D07E4AE88068FBD3579109F34D139648783C6DA84B97D6D2EB5DA77F70C4DF046BFADA10B70C8881CC2C56E3A7C4D6209EC1A5BD3A84C611BB
Malicious:	false
Preview:	BMX.......6...(..................."..................................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_setting_press_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 22 x 24, image size 1058, resolution 2834 x 2834 px/m, cbSize 1112, bits offset 54
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	2.892270499376391
Encrypted:	false
SSDEEP:	3:gz/tUll4l9/lBY6tf3YTaMtd05viMtHlK3ftsLM9yMtHtQsZlyMtX6KtHNugKtHY:gz/mlqlfa6IH4HCJlVYK5KK/QsisOKlp
MD5:	2E26EAC4E3C8557E999494B76B2E85EC
SHA1:	8ACF2AA1518795BA5376ECE04EA12B5A53DEDA05
SHA-256:	EF8F2316005AB422888CB567BD8CEC8C42FDF21D06642DF56031EC455C359E36
SHA-512:	789B685F1DA9DDE318ECD0D153AAB08442A2AE1B5C0B0C0C1D6C0F47D20F7B8DDEA5F2056EF590CCBBEFE589E5EE8EC622533957DCBE2706A4D1CBD6D12D4C1F
Malicious:	false
Preview:	BMX.......6...(..................."...............................................................................................................................................................U.............................................*...............................................u.n.............................................k.8...............................................................................................S..............................................,J...............................................................................................0...............................................................................................R.............................................................................................0...............................................m.e.............................................................................................J.e..................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_info_f.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4007668065858567
Encrypted:	false
SSDEEP:	12:TuX26VI8IFVIFnrI1lNGdfbltQvIzNGlmI7XvIItT2uI1lnrIFCIFCIx:yGAI8I7IFIFGdAIxGsIjI4IjIcIcIx
MD5:	5AE7172988B9D98404EE22F2F7711A37
SHA1:	8CE13017EA6ED24E88C2DD20B94E1B47B64CCFA0
SHA-256:	423ED52A2D6ECC0749E28A7B8B38186542937F60093148E16C8A90D41752F94C
SHA-512:	8642488D2D1F1F6F5D8ACA0EF78AA8773C1A3FA581CB13D151531776B8BED0FE610ADAB14B10D8FA3301F35533AB4FC4D2A6D0CA126F97507EF295DF1F52966E
Malicious:	false
Preview:	BM........6...(...................n..................................................................................................fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...fff...................................................................................fff...............................................................fff...K...............................................................................fff...............................................................fff....................................\|\|\|iii\|\|\|.....................................fff...................hhhfffffffffffffffhhh.....................fff............................ffffff.............ffffff............................fff...............hhhfffffffff.......fffffffffhhh...............fff.........................ffffffffffff.......ffffffffffff.........................fff............\|\|\|ffffffffffff.......ffffffffffff\|\|\|............fff......................iiiffffffffffff.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_info_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4790348333166086
Encrypted:	false
SSDEEP:	12:TuX26iAA4zD2l1cgelBa18BHjw90GpEB57smlBa1iK1OD2l4UAAF:yGvAA4HI3YYgjU0GpI7sgYj1aI4UAAF
MD5:	F20747F650D1C1604F2A05E89178BF81
SHA1:	A3883CB0A53A8CD62B727F723D7F21D14EFFE51D
SHA-256:	EA0C9B29343FA9623C96D0DD21427366982405EC1019B430551BD32E13F06343
SHA-512:	DF1C998246E2DE2DA68624021E15CD7D9723F7708D4FC5CAE06F541B77EA5EA01AD21936C6BC0FF80A58FD0DF419AEF199B85B52A6D96BA3750B8D76A89FC894
Malicious:	false
Preview:	BM........6...(...................n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^.&.u..&.^.......................................................n.t..r..r..r..r..r..t..n...............................................n.r..r.............O.r..r..n...........................................t..r..r..r..........r..r..r..t.........................................^.r..r..r..r..........r..r..r..r..^......................................&.r..r..r..r..........r..r..r..r..&......................................u..r..r..r..r..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_info_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.2516710234164274
Encrypted:	false
SSDEEP:	24:yGAPPPPPXcEGYbq27K2+mY2rMEPYcXPPPPPe:BAPPPPPXcE7b77K2fdrMEgcXPPPPPe
MD5:	82B0EEAD9B27F4AE7F1EEFE5602DA161
SHA1:	9018D96F64B75B5138661094856324E5916A8FBE
SHA-256:	715594900F2F7811D30FF341DA4F1C9CFF14B45D517433FB15ED3CF49991285F
SHA-512:	2C9BE104A9B9727AC116DB430C0433587AFB661282C62D4E8E1F163397924C444185CF6DEA10BC7E4995DB7C8E95FF05D82B965DD50C14A75AAD417FD611C847
Malicious:	false
Preview:	BM........6...(...................n.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_info_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	2.4512075346811657
Encrypted:	false
SSDEEP:	24:yGAPPPPPYABsx8rWdwQSUvWV58UFkTBYAPPPPPe:BAPPPPPtBUU8wQXv2HWTBtPPPPPe
MD5:	42551379EB404DBCEA6D57E2365A8660
SHA1:	5561919CEE888C15E58A76E2F3B0302532EA16C3
SHA-256:	FDDBDDA93A9627021FC74AE61B853DE75072FACEE9356B06BCB5EFF3AAF84C0F
SHA-512:	8473D5E937B0588ED07CC6F494257F48D550430D9772845B1F2AA8684A9F1902A0153CC53FEE5B3FD126801B0DDE69BD0EF9FA247BCAA7E6837BFCD94BD4D5FE
Malicious:	false
Preview:	BM........6...(...................n..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^.]&.D..]&..^........................................................n.C..A..A..A..A..A..C...n................................................n.A..A.............oO.A..A...n...........................................C..A..A..A..........A..A..A..C..........................................^.A..A..A..A..........A..A..A..A...^......................................]&.A..A..A..A..........A..A..A..A..]&......................................D..A..A..A..A..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_left_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.123616472262714
Encrypted:	false
SSDEEP:	12:CedlXZMididididididididididilXidididididididididididilVFidididix:jfXZIgV
MD5:	C78306F200AB60EDA0D51710BA16AAF6
SHA1:	7E85845BD1425319A0C8543F5CB530F1800536B7
SHA-256:	F405690EA841E777FDCDEEFC5D5F43E374FE5991B2A5358424714A34F93658E7
SHA-512:	3105873009F957FD7F3C27E415249F7760DA9D703CD0A9522E4F663F2A9419E4745B33170CB6EE7E80B3B8AAA4B849E77D50D64BEDADB169C45CDE76D95534D2
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_left_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	0.6872327444755697
Encrypted:	false
SSDEEP:	3:ClltUllP/lRlY6mRQXXnXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/lRcXXXXXXX+:C/mlPs6AQtlE3HkuXXWNEjHOXGILQm/l
MD5:	40F826E6FD8CE60D305E04B3A963A3D7
SHA1:	117A70BE0F9F4D0FCAAA02F9A4C657EEAF2AAE19
SHA-256:	70AF7297480D74D86C527D263EF215B5ED135419B85EFED95714775FDB94AEA9
SHA-512:	7B24DEBDEAA64EE0E90D6EB0D269B72ED6BAEFA38DCA423C80B45195146265C560BAF18EA5C6BC4EE0D2A008772B5609188AB1A9AECD381ED4324B7AAD8C59DF
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_left_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.122396960067592
Encrypted:	false
SSDEEP:	12:CedlNCI2MpppfZPpppppk+Ppp8cypppppppCI0:jf4nyZfQyT
MD5:	5AA7CFD3E62496218D76A4C6DC2259B4
SHA1:	5C47D548AE2306E2494EA42FF6EA016D5DFC1662
SHA-256:	EF602B5F633DAFF858DC13980714FECA1D13145F7010B7BE0AFBE5B128BFA9C8
SHA-512:	B86AAC76EAD328398123E675DA031A77361CEB715B5DEBAD72419AEA600A7DB38079962E51F36CD8F251BD099E0A5BEA6007545C16303A44D1EB16C70D45A60B
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_mid_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.0267057339023324
Encrypted:	false
SSDEEP:	12:CedldididididididididididididilVFididididididididididididilVFidl:jfQgG
MD5:	F97913082272921F3A2B3D81E839E944
SHA1:	6A31B89E61246CAD46C3C5E9958E3B2C09FF9E10
SHA-256:	19B3FDF8E9D7E118F028265E968E5A8B279900B8A2869C5A9EF92A960E558086
SHA-512:	347848B90101227631C7140121506BE6E82683F2D60DED4D1EE52629ABFF8CF78D0D92F94BC1CC4DFFDF1B22DEAF4F20FD673D1B24AF61C9562E03383B878D90
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_mid_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	0.5915415183103097
Encrypted:	false
SSDEEP:	3:ClltUllP/lRlY6VXXHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/l3XXHXt:C/mlPs6QlE3HkuXXWNEjHOXGI4/l
MD5:	D6BFB4A609328BFEE4B44FD12E91F205
SHA1:	243F3FFA3F38BD0912F9B7B4A9455EBEE866456F
SHA-256:	8E5EF7E130574E12DB005D3EE2F40573ADEF65514AC6DDEE4DF6D5E658E829E3
SHA-512:	42CFBE1C7775D0E8DB77D6B0027170D84DEE8BD2910427E8DAE37948B939D983EE0AF9FA4C2A7F8A83CBC28A34DB6F4186D48063E57932B093F65A1A7433276E
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_mid_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 15 x 33 x 24, image size 1586, resolution 2834 x 2834 px/m, cbSize 1640, bits offset 54
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	2.0267057339023324
Encrypted:	false
SSDEEP:	12:CedlXp2MpppfZPpppppk+Ppp8cyppppppppm:jfMyZfQk
MD5:	AB7CE2A0FEACB8378C6BF45898AF29CF
SHA1:	6DFCB4622BC76C7196968EDC3AC2A621962C0E18
SHA-256:	BDC51AB0EB12FACE9EB67C3FF15F1AEC7E3289028F430C37F674BABE8C410692
SHA-512:	CE92E8D4028B1C4DF7F86A7A0E8A337417271EAA5D290D75A9C5392A87EA7D502795E72F1852770BABFDCADB6E7197843789141D51C018C2F629009C9A23057B
Malicious:	false
Preview:	BMh.......6...(.......!...........2.................................................................................................................................................................................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................)...................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_right_h.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	3.104878109579758
Encrypted:	false
SSDEEP:	12:sV3didididididididididididididididididiHbididididididididididid+:+WorjrN9+WVVo2/VQ5bJMd
MD5:	1001F157E3309F0E33E7F8F3677E514E
SHA1:	713AF48CFDADAE7B39D22630292D6D73D24CE650
SHA-256:	E73A52635071ABB400B5BAF30B28A2C287C855183B9F8D3102208B4AE826610D
SHA-512:	7E808F8D5591D755BB85220D002D7B50DB6E06A8AB2FD0E0D1D366AE03C1BB7A5F47EC15655464018F9FDD43826CA31D00AD3E9D8E5169886B3842BA9A955AD7
Malicious:	false
Preview:	BM........6...(.......!..................................................................................................A...................................................................w...................................................................G...................................................................A...................................................................A...................................................................+...................................................................G...................................................................A...................................................................A...................................................................J............V.#.t..#.V.......................................D.......e.s..r..r..r..r..r..s..e..................................A....e.r..r..u..........H.r..r..e...............................g...s..r..r..r........r..r..r..s..........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_right_n.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	1.6629111162336814
Encrypted:	false
SSDEEP:	6:M/Olc660j+93CvUAV8uc4Mf8WpfzMMfVfFMIvtGo2/L8Q9wV8RHHqvU2uJ2dsk/n:sV3FsUWVQ8W5LNFvtGp/L8QHH6UZfk/n
MD5:	8C1C9E4719C215DBC51CBCC17073CCBC
SHA1:	2185C803D8B2AF9829EC4DC7F5EBD7E0F350649A
SHA-256:	7EAF68A70E2907CE9690332EBAC629FA9F1F07356EE674607AB6C1D73A11E96F
SHA-512:	0C40CE77441A28A14B749FC30DC4BB9A135840523B2510854F9CFF37E882728078F1E4995A141C195CAD6B8AA6157F6A7EE1AEAE94E072F44CAC0F0E13D2DEE4
Malicious:	false
Preview:	BM........6...(.......!.................................................................................................................................................................................................................................................................................................................................................................................U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\btn_web_link_right_p.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 22 x 33 x 24, image size 2246, resolution 2834 x 2834 px/m, cbSize 2300, bits offset 54
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	3.1781604284685496
Encrypted:	false
SSDEEP:	12:sV3kY4WmmN+OMCtljYYDnljxc7MJUI+xQ5OJmmY4K0QMbi:+l4Wm65MCtl0Gz7JeQ5OJmb4Bbi
MD5:	7935A7BF085B751CDCB3DEA3EF18DA0B
SHA1:	055326051394CEA13E676DB39BD971D4926D0B14
SHA-256:	72E533DA7EE05594432BC36F8BFA0FF8D466614F791FAD7331EA0A45AD8FC498
SHA-512:	A2D2E2474E9CBF70CE3D072307B89638A2A547A061D5C4F770605DDE720B66B46705647461D2EF01CEEE33943F69D7AE6C81936EF7AB99D595F541F583C6785B
Malicious:	false
Preview:	BM........6...(.......!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................du........................................................................................................................................................................................................................N...t....N..............................................[.s..r..r..r..r..r..s..[................................d.....[.r..r..u..........H.r..r..[..............................e....s..r..r..r........r..r..r..s..........................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ca.der

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Certificate, Version=3, Serial=00d01329e89a358cfe, not-valid-before=2015-06-18 04:03:23 GMT, not-valid-after=2038-06-12 04:03:23 GMT
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.459978064135623
Encrypted:	false
SSDEEP:	12:DECA5mS57QS7NpEt11Lc7p7lQXQmaFGGhE0OhEDhpoS8P/h1ABaZD6JYhvU3x6:D5G7QS7Ug7p7lQ5aFGr0TDbuP/DAQZYY
MD5:	6684F39AE1EED64077BC9E2ED55CF318
SHA1:	E7EBD0B691D499DA5BC16A8C7ADC942CB7661C65
SHA-256:	FE46FD605FB59B26E2F8535D352F7C93F0E25431F5CD21231CB66F00DDD1EE9F
SHA-512:	D0B4F652197489411749C6EB45CC4987CC73868D5BFD6E5AAA7D13148E71EC1D5A4587F6AC0B0B27C52233B6353C4B65EA2E4B5C3FCA0031EDACFE157BC35D97
Malicious:	false
Preview:	0...0............).5..0....H........0.1.0...U....ASTxRoot10...150618040323Z..380612040323Z0.1.0...U....ASTxRoot10.."0....H.............0..........\`.t.D...}....H..8...V..1..SC.3...q.]....<T9:>..-.?$t....5..\|p...."U.kC.+...)..1y...R:..\|........C.n2........4......^.%.....q.2?....tK.%.-y..:B...H.Z...[I?&..5..>J.'...3..r.Sq.../.y....Z...Jp.s.. Y..'.{..F.i.0..Y..,p.Po0 AgW;6V..Y..tkO..a.........P0N0...U.......6.a.. .-.vow.6k_?0...U.#..0....6.a.. .-.vow.6k_?0...U....0....0....H.............LA......t......P....;n..s'.U.#m8,'.R8z...pi..K........b`"..^+...........bxP..b...H.0....2.t.....f..\........k].........,.....2.S..%..............(.Dd.M(.ZD#.Nx6...<IX..:jDvd..GP...B....`.D..$....du.....\|1...XQH........#..V.......(.1,......,...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ca2.der

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Certificate, Version=3, Serial=009c786262fd7479bd, not-valid-before=2015-06-18 04:03:24 GMT, not-valid-after=2038-06-12 04:03:24 GMT
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.511801750889632
Encrypted:	false
SSDEEP:	12:PsxFIxJFOl7As3WVL65oU1q66pcW0whPWs0sLgLaXr08qo/Lb1kfKAp6WLVlu:ETl7As3WVL65GuwhPaegLaXrR9YxpbLG
MD5:	D727B1D7417252E07DC436AA754C941B
SHA1:	E6E5C1EB1E19E4F89A0C37DDCDA50C8B6EDDDD8F
SHA-256:	8A81891C6200605F963355A7D7B379221D4A14F2BC55C969353C04214A7C5685
SHA-512:	490C16A465E1045574E6082CD88ABDEB9EF854F720DFB13DD4503126B50D7F373097AA68FC41331BED697BB4DE43034B6E855F822F84C33FFDF41F48C97B6845
Malicious:	false
Preview:	0...0...........xbb.ty.0....H........0.1.0...U....ASTxRoot20...150618040324Z..380612040324Z0.1.0...U....ASTxRoot20.."0....H.............0..........x.P.....t...q.(....9.^.....` ....y..I..o....jD.J....u=vK.~].o]T\.n...&..vE...k..^...^.Z.....).'.h2..9}.U3..d.Y.TQ........-..0.`l.S.M...;..tU......7.nBQ.u.F.m.}.......?M............Z.....z_.\|m.S<....]sT......G_.B........g.......c6.t. A.......P0N0...U............".Qnh).~.l/..0...U.#..0.........".Qnh).~.l/..0...U....0....0....H...................4q+.A4hfC...>...s.2!}...FB..St>.Oi.[5!...\|Dn.;...g~+.X.7.&...i.6.ws.-..Q(...?...Vn....Q".HJ?.;.B....(..S..\|P$.......{...p..=@...%.C.<..ww!z#..j...1C_...D..Dpr...o...s....n.....P.+......%*V..S.r.P.....&X.^.wV.?...D...a......h.u...JU....z.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certadm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.9322947668452635
Encrypted:	false
SSDEEP:	1536:MeZq3MXXTjmZ5IplbHKp/reRgMxcRircjVgrS9Ll2shT:MeZNvmnswKGMCZSrggsh
MD5:	AED39116FE12C5550975043DA1D1B244
SHA1:	ED8AA12A00E93C1A477F4EF69864948B4014A7FB
SHA-256:	BBBA87BF62E8BDC11602F2A95712E5FE3FB1EDBBCDEB28CBDCF191AEAB286B04
SHA-512:	0AB9EF25BBA0E231A140A5153C9F9149AB194A324F374E655E43EF90715E0417987D7F31F2493E229EC8B704BEAD31F0FBFF6EE811D42CB7AF8C58361979D132
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xl.....................c.......c._............c.^.....n.].....n.b.....c.\.....c.X.....Rich............PE..L....$.>...........!.........Z...................3o.................................................................................0..p)...................`..x...................................xS..@............................................text............................... ..`.data...............................@....rsrc...p)...0...*..................@..@.reloc..N....`.......2..............@..B.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.certcli.dll.ADVAPI32.dll.USER32.dll.ole32.dll.OLEAUT32.dll.CRYPT32.dll................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	6.464020030097691
Encrypted:	false
SSDEEP:	3072:est2WKOxRTftkVeSl8w5d3wgtRgc7k8w:GWKOzTlkVzl8w8yRDA8w
MD5:	0C6B43C9602F4D5AC9DCF907103447C4
SHA1:	7A77C7AE99D400243845CCE0E0931F029A73F79A
SHA-256:	5950722034C8505DAA9B359127FEB707F16C37D2F69E79D16EE6D9EC37690478
SHA-512:	B21B34A5886A3058CE26A6A5A6EAD3B1EBAE62354540492FB6508BE869E7D292B351C0913461B47C4CC0C6A73333AAD33CD9399BCB1F83C7DACFDB7F2EE1F7A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..........................{......{......{.........6..{./....{......Rich...........................PE..L....A.O..........................................@.......................................@.................................Tq.......................................................................p..@...............h............................text...d........................... ..`.rdata..............................@..@.data................z..............@....reloc..D............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\certutil_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569344
Entropy (8bit):	6.1181069611039955
Encrypted:	false
SSDEEP:	6144:AG/XQ+F4FFJaL5TBEf6ID0rq7XqHvXxUEuspBi9NlLlli8QMupzUMfNXyowyQv:rX0vaL506euHPOypA9NlGcuVNXa
MD5:	711DB2EF10B6C2AB2080698AEC6C6D08
SHA1:	5746C14FE1790A18B76CC9833F93BC72937ACA72
SHA-256:	75DDAB1826F220EB36A9EEA9CF8533C94C19BAC89D961380F3A418F6EEDB2B4E
SHA-512:	6568EA1BF41AFA461D2B529D42E0D873C9B1B109875C6010FD965AC8C3D9A0C98EA1EA747119815254BF42130B6CF699C8DC01EE6763F172AE7C57F656FAF7F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..x..l+..l+..l+..q+..l+..c+..l+..1+:.l+..m+5.l+..3+).l+...+3.l+..2+..l+..6+..l+Rich..l+........PE..L......>............................Wy..............................................ye........... ..........................(........`..@...................................................................P........................................text...l........................... ..`.data...$g.......P..................@....rsrc...@....`.......*..............@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>$....$.>1....$.>=....$.>J....$.>V....$.>`....$.>.....$.>m....$.>y....$.>.....>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certadm.dll.certcli.dll.COMCTL32.dll.comdlg32.dll.CRYPT32.dll.CRYPTNET.dll.CRYPTUI.dll.GDI32.dll.NETAPI32.dll.NTDSAPI.dll.ole32.dll.OLEAUT32.dll.RPCRT4.d

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\checkboxes.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 48 x 16 x 8, image size 768, cbSize 1846, bits offset 1078
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	3.4036315259400927
Encrypted:	false
SSDEEP:	24:UzOtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiXcijsQI0xVgMxFWx:qOta08t7E/gbN1pv6uPjsQIWVgeFWx
MD5:	0BFEBA3584311E9927A5E68435180C01
SHA1:	7BF61462441626B88BFD5936CCF9DE2E6DF6AA64
SHA-256:	7A1BBF8282930794CB23128CBB9FEC83A6DF2798BB7FA9D8984E70FC2B2354CB
SHA-512:	415A7CFFE7A6C94DFF4469722CF6A29E67B071E06E19735DA3BC8ED2CE519ECD6B4F5F0807AE23F2FA45DF0E00D1AF2CDE7693A399E5B317398BCB4E715435BE
Malicious:	false
Preview:	BM6.......6...(...0..................................................................................................""".))).UUU.MMM.BBB.999..\|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...___.www...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ckwcfg.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.820525555536394
Encrypted:	false
SSDEEP:	24:0XEqwr9nycfo9Y3dSudVjiYa7t8C86se6XZtCC:0XEqHcfWu3jiYap8Ose6XfCC
MD5:	37C266BCE4AC53259F6F41930E719DD3
SHA1:	6D6DE703F60BA09013A66254F4E9DEEFEDA74F26
SHA-256:	84362862A9E8E036D773D7F52EBF54E5E26B184A28AC2977A7B4A8FDA08FC14C
SHA-512:	F67A822C14C7163391837C2C23337348E274B5A97A667FECF10AE9FBBBFC7FC0D8F2F1A5CD60C6B64321B5BC7B9DD9D1D663B32212264924DB12C9E7C2FC52A0
Malicious:	false
Preview:	Ai..............Y.D}...0.].T\|{p..b;...L...0....&... l..s.._v.QH....=.A.C.........&..\|....9%t.y....6...E..A...cj..fNhI..eL.P..w8.P.T....6...-..C.-D..t...[..'!CS(....U..8T.!../.3...c..."C.X.........!....z..\|u..:F.[.I.0....6....2N....5.s....M..V.E.^`./:...........b,.9..a..N..H3.4d....\.S..vJ..b...e...u.A.dQ...".S.g..=EJ......E.h.... ....8...1.fh.N.4^.4.....Y'.".C_._~.>%j..+.......JP\....XS.._rF..."....G.z.....4..Y.K...].vCx.U1.Pi.s...v&P...7S!N...A..o...f..Z.j..+h3.5..(...O....g...!...ol.w...Y,L.<.9z.Rt.GIjn....... .[.e....:.b.,...G...w..RRi.\2b.+E..../..1.T.....-tA.~.......%........_.'..f6p=}O..!:.OrMC..d.P'.vO.a28hb>$.e....o8..'.U.[].gh..q/;GI.A.....f.5W..\|.-NnM......H.J.z.........-v..\|.)G.....^j.P0...qHP.j.fW...Y.b.RR ..n.A.iy..T...GD.O.g`'...&..]Va..$c.^.}.t..pk.~...f.....R.D..f......9.';.d0wql...g3....v.#.)tZ4q1....m...5<.Ip.]..?V..@.....B..Ck.m.h.xC.7&.1..._M?...4...C./...W.lE\|..z..pU.[..<'rK...?.x.Zkf..'J...!.R/.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ckwcfg.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 173 bytes, 1 file, at 0x44 +AX "ckwcfg.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10973
Entropy (8bit):	7.633731182014498
Encrypted:	false
SSDEEP:	192:Y1NIYiYF82M34qFIorR/WJfsHR9y2sE9jBF0Nyme4/UeBsqsz:Y7IYitvDx4i/8E9VF0NymNe7
MD5:	CDC7A449223FAF260A7B0B097EA3CCBE
SHA1:	58AC6CE0B0F96AE17D1416FB66F9FD798965D431
SHA-256:	057A96FD975F0D59915BAEA184586D3913EEF2E298449100096A232A08D57B63
SHA-512:	1F64CA3E452A1FC2D216B292BCFF66B86185A5088A8B83DA040477678C5E4302D403E39B59AF3D9B2C1606D721D8F15FE4FC504FCA4B0A8F5BA0B55FE3E2F3F8
Malicious:	false
Preview:	MSCF............D...............................0..........c.......B..........U..`.ckwcfg.dat.ahf.~&=qB.B.2,84362862A9E8E036D773D7F52EBF54E5E26B184A28AC2977A7B4A8FDA08FC14C0....H.........0.....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". %yn..M%Yu.W..8..]t.EZK.....u.\010...`.H.e....... q......(.6..2..+~(...D.U k..zb....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\custom_logo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 142 x 21 x 24, image size 8990, resolution 2834 x 2834 px/m, cbSize 9044, bits offset 54
Category:	dropped
Size (bytes):	9044
Entropy (8bit):	2.3235630161564798
Encrypted:	false
SSDEEP:	48:mR2kJzO8RW3bg+SjrXugfSyQfH6cMdimADByYeI85R/l+VBob:mX9PWC2wzQycMdimYkI85GVeb
MD5:	572C9E8C978E3D79225C17AD8DF23EDE
SHA1:	ABE53B2774C1667F05DBE1DB1798223FF7095523
SHA-256:	D827C59274E5E4334607D42665750C85DC1861441B795234C37B44A44026A224
SHA-512:	E4AC60998DEE603BC48A433AF41DB32BA251C73BA0BD38A79980209536DC7D3F8F817CE510730A6707A6A103C218DBEDD145E3D48DDC5B28EA3763B71F27BDFD
Malicious:	false
Preview:	BMT#......6...(....................#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\defcfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.993464592755953
Encrypted:	true
SSDEEP:	768:kNLeCRkObMkPt7eYnnzmbSZHiET4hEQU2ogo:E/bMgt7e4zHJTWRxo
MD5:	D9C56468BD35AF910DEA817CABB81D36
SHA1:	0FC641A180809B63CCEC27016E38C2B572920208
SHA-256:	D3B62B5869035748F8E53F7A65FBA2621F3EB4C6F721C415195C34690DE51307
SHA-512:	B328512B0F2F1871EF0712121D39158C5BE0A1F594A3D5458CA4E4875DF5408DEAF250DE5E65335E17DA1CB59BBD62F37EBF791B55748E1010951BF2420D9C17
Malicious:	true
Preview:	.J....!W.4..........@ ..&\|?.v.$...#...5.....Y...9{.:...[]..X...i;.7.q..[.........`$G....).1\|E&...K.K....o#D.m.~.p..t.a$^.y.1.2c.%.....+6..P}o..\|.~.+..B.....k.5mXz.+...CT..>..>....".....9:._..$..%.Q.:..{.........l....vH... ..u.......L...C...v..Rz..X(XW..yl.$....%. ...4....W^......4.nX....U...1_..dq....W5.*<Hv.v!..........U.E\|..W...8+Y.p.(Wn............`r...\|..4.bP=.TaA..[<....5N.I..T...6.....?...H..9.R.>...H3p..q0{...y...^k.........O..[e......Y}D..wk.l&".}>.....\|W."..=..d.......U.go....c...[..-...6.].^.C...^....9.D.}..<........gXm\n-.......wv.P......f?.7S.H..:8....=....3...>./.+.;NQ..b.5.........<.1u1?...(..%.1...s.....K=3..!.6nK....;..x.....x.&..h..Pf.....{..b$.R@^Eh.m.........L#W.[...W......./.K.>\|Y...?"...Kq....G.._.{..B...{UNF.f..(OZ.....B.i..,..C..}.EJ..6.....!..$..U:...x.......I5L.>..p;'....N.<K...VWpS..98..T?..Q..+..=....X.H......$.N..e.w\|...G..XD.....^...........U.<._x......}...`.RI.`...v....c......l.w...mA.........I....hy

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\drvinfo.ini.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 174 bytes, 1 file, at 0x44 +AX "drvinfo.ini.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10974
Entropy (8bit):	7.628058048904563
Encrypted:	false
SSDEEP:	192:aIYiYF82M34qFIoT+gD+NiWJfsHR9y2sE9jBF0Nyr7PM:aIYitvL+g6Ni4i/8E9VF0Nyr7PM
MD5:	320DE6406D07F4616E4CD997A295FFB2
SHA1:	FDF211A5B96BEBADCB83CE74C87E20D7A9B75E8B
SHA-256:	85E2E0C5DD208DE530B61D3F3FB5975F149A2AE8B4C9C5F20EF4DD8ADC8372A7
SHA-512:	3D8C24B75E76A61C20FCB59FC7AF5A02D0A0369E7119DDA957EEF31A2C318F134B2B4BC5FB8EBF4BBF43A53173E40B4DE239F3019317A6289E5E3D40C4E2C882
Malicious:	false
Preview:	MSCF............D...............................0..........d.......B..........U..`.drvinfo.ini.ahf.xWN.B.B.2,8DAE59F22A89D386BAAB97BDD2F09CC3AC7086CB8E9A4F5FB00BD52F2BDC04470....H.........0.....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". I.\|.r\..s#Q.....!-.).6...... +..010...`.H.e....... .J.&y.....@.j.Q(>.....B..3z.......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\drvinfo_astx.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Generic INItialization configuration [CKW]
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.001936411243482
Encrypted:	false
SSDEEP:	3:GB4ov3BRiowov2TmRwxvMSommNmSHTAlchCSGean:GHpR/duTmMkSomSlHTAKg
MD5:	2812C59D2913861499B7A5F298E1A8B0
SHA1:	A1B50D96372D7691F19BDBF9B5CFC5F1FEA00FBD
SHA-256:	8DAE59F22A89D386BAAB97BDD2F09CC3AC7086CB8E9A4F5FB00BD52F2BDC0447
SHA-512:	BF75333C5386E71AC3DD8C3AAF7B407499DCB5BF4CF8878C686CD76F3C465B309927F459E688FCF789B5BDA68B9F1D99270C9ABAF3A516C92494F5C8D374372D
Malicious:	false
Preview:	[Build]..BuildNumber = 10.3.0.30..State = 4..Version = 10.3.0.4....[CKW]..Commit = 97b84bfc351e4f02c009c428e7d3f082673b956d....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\extraopn_ply.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 90334 bytes, 1 file, at 0x44 +AX "extraopn_ply.html.new", flags 0x4, number 1, extra bytes 20 in head, 3 datablocks, 0 compression
Category:	dropped
Size (bytes):	101166
Entropy (8bit):	6.451693133905403
Encrypted:	false
SSDEEP:	1536:+hEpEP/5gYdzpWdPWRBbDq5MkrloatgfPM6lKaBH3SU1jNUL/cBkvOS3ta77k5y:TpNYxpuOFql3tjxaxd1j2L/0k5M7my
MD5:	E84262438473D7C2A4BB1EC802BA4BD9
SHA1:	DCB13F5DE8A37E8F2B30ED998A00242C0125D064
SHA-256:	0EF849EB15CCD8611FA32133A05B77F1FE601913804563E54A06F8C095E166A7
SHA-512:	CBC7700A7665EA98FB4DB259D8F7D32172BAD2FEAF4AE4BB89FD0742F6FE4E1DE0E169E187E4D007143C78279D91FD1308985E2B14678874769E70902F63C829
Malicious:	false
Preview:	MSCF.....`......D............................`..P*..........j.......\`........!U..`.extraopn_ply.html.new....B........aRQzVVcvCap0mPFFbfnehPiuDZm/BlC/eVoYYpBJ3md/3kN+fbNR5xc+dlBI6Y+Fzl65f3MRUZPTZdHVnk3OCz5JUR+LB+wHkxBWjOErwFmA/GZes999xicqpCmszypX/k3+bPECGR30blrlczMAQjIrNSuduUefyvMWk0jthw/RDe92JtbDG54EZVvfbipsoIgoRBYJJ3jC44tlDPXJpNXHjqSjraTF9YJKLxeo0ZkL/5snhnczDqgkk/QsQjJimQHcrzoEujRFZHlGd62bhQfKurQNpdT89/BiOK2VETnEHnBCxvy6dNPOwkjQ3ztPLuaVSgwmWYzTiLlmNX4D9XNkAavyXc5BskhPt19My6Jb00o0UHIOt1e9idIdOOtet1sCn5oE0u92KA2FDPjQ9cCESYgkwCtHLUv0gjMfofE+TMCkDcRYygAwMDqMDZSK6XARAVkswBOsVRuDepLtQtKKQS0kLU10pYG6xV0exluT28BE9csIq0juXDFF5BsVt6hdS23uTokimmOV3W9rcpLvFJU/ZKecsQi4YJotSsg9t6rXu7n8yraU5lf/8+HJ04moqELwXbx7knmrXG+OdMv3m/WiP0o1AVmzQ16hW3AKyLRS/eaZtV6RW+zAJ4XU2L3H8XIup79ZAhKwK2Ux+7FAg7lTz8U7TC9KY7OeREqTxhBE0QLui83gUnjESA754zRjs1PjmkcahsMMfmKjzHG1pRjhyqxT6WLOQX4p+dfFX6uo1khTeZ64fbuGvXYJ55gaH5+YyayvR81KIa1bU/QxhtY5BzydvISrs9SPEsqc3dE1BoE3W6J2N+dwN63ug8ap2153AL3AbMQGub+6yWnEyclQuKkZ2m7FDHBAUC14LH6yYF

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.697487951906348
Encrypted:	false
SSDEEP:	6144:ScTE2XtnPcWNo4eT4hs8LP71DRIUqqDL67PXGHrIrH:lTE2XtNrLP71Dyxqn6jI
MD5:	269BEB631B580C6D54DB45B5573B1DE5
SHA1:	64050C1159C2BCFC0E75DA407EF0098AD2DE17C8
SHA-256:	FFC7558A61A4E6546CF095BDEABEA19F05247A0DAA02DCA20EA3605E7FC62C77
SHA-512:	649CD40F3E02C2F2711F56AA21F39CCBDA9108143D4766A9728C9AD98F329D5F64F77090DF769C55B66AB48FB9AA4A380944EBE54F2C450F96CF76E5A6ADD31E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[x.5+.5+.5+..+.5+..+.5+..+.5+..+.5+.4+..5+..+.5+..+.5+..+.5+..+.5+Rich.5+................PE..L....A.O...........!.....\...J.......f.......p............................................@..........................U..O...,M..x...............................,...................................hL..@............p..x............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....F...`.......F..............@....rsrc................H..............@..@.reloc..x............L..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\geo.asd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	7.994355090548138
Encrypted:	true
SSDEEP:	768:8y7mHOHw2Ep2YSV5y0USkMestCHr5+WhGDr9bWtdBK1L:8yyYVYx0R/te5+nDrFWzkh
MD5:	D3CA79B1819D835C4C0EB65CD39804DF
SHA1:	9BCB10CB6BA5535C1BDFC3720366E6CE3D3E2A1B
SHA-256:	FE2CA2FFE285326B0B7059C245919312FFA524072D2CEF52B62C051D0B9A8DB3
SHA-512:	36A38FF6670CDB71170D558BA6B7FF8074F3CD0CBC8A56D0CE57880F62B9C53DA0BEC20CEF815C722F76062A2C112377C28B678673FF03E4A54BF6F0E070F443
Malicious:	true
Preview:	j....0V^...&.e$:.....@ ....Ix..>0?..9f.O\|+d.......`....I...'F...R.....L.G<e._* m.K8.o.v22.J......'o....a...s.wWT....p._....^U..p!.m..........7.K.pE.A.....B.....5g!@J...Q..<2.[[j...v..S.:.B.M......w..<.......U....G.H.D...........e.....q..n...4..D..a..v..6^L.S......A.B.7?.-.....u.].8...?...47...;.;,....<.-..E..p\|....JEg$.......bN.~.TC.n.Y.......i;E>....<q...Y.V.S(........k........u...H.Q.....)..4..Eu.e4X.......0.o.H..u..*K.s`D.l,.t........Q....l..X:r...g..fx.:..u.'Z.@.L4^Sk...Y~t'...gz.TV$...gqX.....[.k.....6J...@...3..y.\1Y..%..7.......r^&~^....iA.T...1..m....6V.^&...V.r`....nu..Dnw}...w.lh\)gW..20....Jnq..b.h..e....x...........e..$1g.....,..%......'N..,D..z.lQ...YD.....-.....(.{. .,.~..2o..F$...sA;...~.R...../g.Z....B.xL....8.Nm_.M..1..2,M..>Y+v8...2mY.....)T..;U/.`7..x.rt....<...[.S2{]....2T....7.V................('.f.@3B..x.....P...bjK..."p.#.k....@@.89..o.+..9....3z...1.?..k.d..#...nD@.Eqr.G'fx..u........b.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\gof.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	25440
Entropy (8bit):	7.993411583727329
Encrypted:	true
SSDEEP:	768:Wdf+i8iRpBKOPfT5f4Qp0VHcCZnbSyPFpEOYD/yG+kq:W1+iR1f1fpacCZW6FpEOYeGw
MD5:	D08863D5E8069D42ABB577E5525C5D1D
SHA1:	72787582F5B712E81D067BD3D0EEC7E5C79A2DD0
SHA-256:	09608CDBC5D4B6E1F9F0BA409254441024855824C1FFC8789E276A9F3DF95DA2
SHA-512:	EC487249B6D9DDB94AC30ED7C707BE397E40E96297F90F54DAD541E16674EBB0B70958C5DFE353D4FBDCFA93986D2A967DB880482B675778F3E5AD135FAE011B
Malicious:	true
Preview:	......g".XU+`.<e.=E..k....4r...I.z@.I.k.....4.\|..<..$-/..w...........l..>.......VNv..+l.%..N..A;...d.P.....k..-...AK..]..i.mX.B ...9...#I'c.......k.j.+.JH...,!3R,g.W'7..s..Y.V..Y.G..T.........;N....5....&c-].y.s.ue...Ti..p..K.+.....v..@./...8....+..a..}....pu..x]B.Y......i.............A...%.-..".>...L......;n..w.E.....R,I.k..O....T..;[.Sb.l.2..vz ..M=.4.L..t.^...z..E.....@...k.n.".jn.x]....ST..d.........2pl.V1$C.A.BQ.v}v.u....2u.r..q.)r[V......f1..K...P........H....s....z..',..P&..,...H.....7......L.E......]...(..J.?......!ti.}?..w..#.>V!:..z.....1..K....4.i........W....S...lz%7vE...3.......[.A.dY...I...6bZ.......K.B....?.VX..Sy....-...R.g.).Z9bU.gd_.X.(..3..G.n.+......`.GS.K.8l....I..t.x.\|mY..Z.9..Dzx\J.....K}..j..u...%..YQy1...bx?s...R...vNz...-.........\...V..+..^dy.H.~.m7Vo^Zn}.y....Y......Q.F.J.a.w.4....._.HMP....".1....BmP.C09..R.ex.v.&.).ikA....(:.4.............'.$=OQ.4i...K..;.w..........n...;3....#.r..[...Cn.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\help_btn_focus.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.0188970795941468
Encrypted:	false
SSDEEP:	12:lEKrVKkQE3lTPiLauGCxLayITjOhP3gWn:mYVK7E3ljiLZPL5ITSh1
MD5:	2CA10AFA11F3E00918951B8B77A8B29E
SHA1:	536F0CDB2CA9AFADCFEFB189946AE16E9A5C02A6
SHA-256:	80B7D2F4DD4D173B0DE3C89F256D453D7CD0FE4EF68A9D3873C18B1D3C7D127C
SHA-512:	951FA9830FA6DEE6AEE87E4673F3FCBB004BF2A4D25776B3FEC155E747E1BF63F10256069B1E0716599932DFF41B3B159A0D61F5F66DABCB4B0953A76E18F622
Malicious:	false
Preview:	BM........6...(...................v..................................................................................333...333...333...333...333...333...333...333...333..................................................................333..........................................333................................333.................................333.....................333...................333....................................................................333.....................333.....................333.................................333.................................333.....................www\\\..................333.......................................\\\...........................333...........................\\\...............333......................................AAA...........................333..................\\\333333www.............333....................................................................333.....................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\help_btn_hover.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	4.459613288102141
Encrypted:	false
SSDEEP:	12:lEKr80Iz+iRpjmRa/gOy7DrsRzYwGM7P6LeHeKb67I2GUrwUEiRwexgTyqaaL/lV:mYdjiDHYOMXes+juYylw8rOTjR58lc/
MD5:	985622AFD8BEEE8A30430EAE029084D9
SHA1:	7169C3A143CA087418231B13CECB09E3933AF0B3
SHA-256:	A36D6D62F141D354C5E712D6F7888EFC9F60C16EAA66E6C22E0B3F5BC7C47C2C
SHA-512:	7E7C6C1C9EB09C7F7D9F7663FEDCC22B49088F25E30B8A30CD61EDB554913B849EB751DFC10A263462EF2E5CF2FE45BF34ECE824DDE9A5DC4A0B809CDB9806CB
Malicious:	false
Preview:	BM........6...(...................v........................................................................................................y..............................................................................;vj...............................................................................r...........................9.........................r................................................................................................................r...........................e...........................r................................{......................Q.0...................{...................................a.0.......................................................0.q.........................................a.........{..q..........................................0.r..r..Q............................................................................. .........................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\help_btn_normal.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	3.1310887508565135
Encrypted:	false
SSDEEP:	12:lEKrta3KkQQ3ZTYMRaNGKhRay2sVOtz3g8FaKn:mYtiK7Q3Z8MRarR52skt55
MD5:	E4968ABD99D1E2D60A9273BFC2A6ED2A
SHA1:	F8437202EF4E216A672A3D31E52489D176FBB96E
SHA-256:	8900BF402C58807A6E6F1622FAFFEBF05CFD2E93AE06E44D4F1ADA4EEC0B7F0C
SHA-512:	55303F4ACA890473A2926E503D6DA9A0D9024414F94677C7DEBD2522BACEA6BA380A4AC857AE1112E7A1C0742C612481568E9DE4B19BFF49D278420795D3269B
Malicious:	false
Preview:	BM........6...(...................v.............................................................................. .......................................................................................................................................................................................................333.........................................................333..................................................................................................................333.......................................................333.........................................................www\\\............................................................\\\.........................................................\\\......................................................AAA................................................\\\333333www............................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\help_btn_pressed.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1142, resolution 2834 x 2834 px/m, cbSize 1196, bits offset 54
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	4.411017190668682
Encrypted:	false
SSDEEP:	12:lEKrZPkn8/ZXw90Me2wgUXwel78rrOI/HYYZ5rQD8ze2wgMoel+t1ifTu7p:mYZPJBgCfVLg6lI/HYYZKVj4jp
MD5:	98A14AAC3586CAD76E0B6F37C6FA9A61
SHA1:	6B89568BACBACF10653621ABF576E01E79F211EC
SHA-256:	C3BC38019099D32FFA094CA7FF716C36FFE1AFBA4D972293F4BB509830686855
SHA-512:	1F6891431692A4BF0D19125AFE2E8670B6A41A15BB8AB627E62268D01D0BDD5367B1E1E3116AE536F048C7133128AFCFC386C82914B9524250F8C4FD6713E583
Malicious:	false
Preview:	BM........6...(...................v............................................................................9b/......................o.f.o........................................s................s..............................s..........................s........................s...............r..z.............t...................s.................r..z...............q......................................................................................r...............................s....................r......................s..........i......................D.)..................i..........s.........................R.)...............s.....................................)._.....................................R........z.._.........................s..............).r..r..D...........q...................s..................................s........................u..........................u.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_cr_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.871186763385942
Encrypted:	false
SSDEEP:	24:yGtlGYvKB/+VXRd1NV68fI/N08xNh96Ikd8uEesmBoEekTc7Pnl31BtV:B6PBWVXr18NhsIkNZBoEhuPXbV
MD5:	6D58D2DC750C651A90131C77DDEBE932
SHA1:	F0D04B5B8BF4297F14B4EE86C234198884C7188C
SHA-256:	0398A3659EC6FCC6E110A776587DB7160200BED44C15EDE20C414E01F0545EE0
SHA-512:	DD159DB334B1D699F0109BEDE101AF9E619796A036B0865267D547C49D7B9F5168533A87DDFFB269859E7246721A5AB502DDA27CE1DB3D065F19DE618BB9F963
Malicious:	false
Preview:	BM........6...(...................n.......................................................................................................................................................................... ..........................W.Q<.,0.)......#..B..~..........................g.....................2.....0.5=.HI..5.w...............~....................................V.U...;.DH.UF.UF.VG.SL.9..................>..............................Q.P..&G.TG.WF.WF.WF.XF.[N.AA.\..................7........................z.z..%H.VF.WF.WG.XH.YB.T7.K1.G?. #....................a.....................#.+B.RF.WG.XH.YH.Y1.B=.Zj.y.m.@.=....................................f.j*.8H.XF.XH.YG.X..Ak.......}....[...................?...............6.BA.RF.XG.XI.Z/.@r.....z-.^..[..]......K................................(.8G.XG.XG.X>.NJ.h....{..r........o..\|.................................(.9G.XG.XG.Y/.>...{.y............w...h[.................x...........'.:G.XG.YK.L%.V.....U.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_cr_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.192154208054499
Encrypted:	false
SSDEEP:	24:yGGaVMUOnkNivxZgeUQtQc4TsGDFmtsv063CuGG4incBJAWABTBndIX:BSkG4QtQVrDFmtsv0PrGZcIWEU
MD5:	9202BD204077773A9A03521232FFDCB5
SHA1:	32C8AD8E8EF7BFE44671F677B75DE079A63F4542
SHA-256:	92C608FBE7CC340F589B348576122B91D47506A772F8F5FCF05A0B1E9B154002
SHA-512:	54A7210E83805EC43441D6CA117243E4D1C7758401BB223DAA77A0D6A277958128AC231ECA12DC6F4CAFAAA57360D3F250580EDE6BAEA36E32EF2614B714B900
Malicious:	false
Preview:	BM........6...(...................n..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................?....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_ff_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.913965669437315
Encrypted:	false
SSDEEP:	48:BUdjFuXO2D5tgJiqvLu7d4FsGLVmklINq:BIEXtD5tgJ5vYd7GLVmkl4q
MD5:	59AB9B0CC79344B8EF847055ABF8A33E
SHA1:	A5F8AFB081FB52765227DFA99F7A2C0B77157574
SHA-256:	DA8B0866C04DF4BC77C5E7A1F20197CFE97A036C1743A2A3415FCCB7FC0DC723
SHA-512:	59DBCFA288A7D36E4BBAD5DFBC4D8A9E4CE48F1987AB404F33EAF68D20C29721CB068CFEEB22D26A959D3080E629B447EA7E57BB69B6F4F3D2C937DD0D482FB8
Malicious:	false
Preview:	BM........6...(...................n.................................................................................................................................z.............................................................GQ..............%..1..K..j.\.......................................................2..I..V..Z..\..]..W..1..5...................................CH...q.......M..\.._.._..`.._..`..m.....`..n............................8A...i....=..T..Z..^..`..f..l..f..R..^..l.....~..}......................z....w....D..Y..^..g..z..{..b..V..a..x........{..}..R..g...........................4..]..d..o....0f.X>Nu .;.......4.Q...........w...vlq.......?......Zj.......V..h..m..t..H.+.DM......)..!.a..y..P95..........d.%N...............-.....L..c..a..^..H..)..T..a..K.Q2L.A..G.n .\..!x...........w..................7.._..^..>..C..\..\|.<\|.-w..y....a..J.o-.n..EZd...!......\|..............!..D..^..Q.....2.#p.vL.`.._..kY.....E.K.p3.z/.h.9..2.. .....d............./..E..V..].......h85.\..o..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_ff_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1902, resolution 2834 x 2834 px/m, cbSize 1956, bits offset 54
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	5.519754196022519
Encrypted:	false
SSDEEP:	24:yGdG5egXurW8qy2706KBBZPzye3NWyJGL2yyi8xhoz6z8V:BE5eSurW1C53NdrbJXozRV
MD5:	CB6E30F86372C7F1940D393A0591F74A
SHA1:	1E44A8BB204BEDC89545A91BB42F0792689EC288
SHA-256:	C94CFF7804F0FAF334F1DCDB5079FCBAC6AE99A12DABA06F84B329E7C0237D3C
SHA-512:	BA666AB3092C9F86E0EB147B11C0AAAAB5C173ABCF42AAE78CAD284669D591BFE9FE026C98F65DFAFBE0555F2C8022FD652ED7D7B25632F2C0239E852DD04569
Malicious:	false
Preview:	BM........6...(...................n...............................................................................................................................................................................................................................................................................................................................2...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_ie_default.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 26 x 25 x 24, image size 2002, resolution 2834 x 2834 px/m, cbSize 2056, bits offset 54
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.31914215766045
Encrypted:	false
SSDEEP:	48:wYQtLV3gaalDTWSwxKQfj2Sey2JeuREK3s/yPsUxVZX:DC0l/WrEQyjP9ZX
MD5:	C4B6AEF7DC48CA154C645553D46CA1B9
SHA1:	D7A443157E6D82732B9B14CA44F34A2954F61A48
SHA-256:	F1686C269F47E24B853296C5B60649F7BA6912E1B8A888C25691AA1AFCAB5651
SHA-512:	5581DB6507B11FF861D10971D4F84BFF07B9DB6387056015AD4EA3D875AABA9F4228C025D625A5BF13A1C895A2B29FCBA215DB8D0704B516CED81AB977480B0C
Malicious:	false
Preview:	BM........6...(..................................................................................................................... ......3..\.........................q.f.t............................... ......c..................s.2.#...,...+.'.%.A....................... ..........................I..e..j..m..m..j..d..W..:....8.................. ......................(.._..s....................r..f..U.!.y................ ...................5..a..r........{...............h..[.".w............. .............>..'.._..p.....t..........................k..X....O......... ...I..;........X..k.....v...........................w..i..X.B.o......... ..............(..f..x.....q................................................... .......#..'....j..].......}................................................... ......m.....m....h..............................{..t.i.^.F.c...... ........."...................................................w.._

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_browser_ie_disable.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 26 x 25 x 24, image size 2002, resolution 2834 x 2834 px/m, cbSize 2056, bits offset 54
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.183495275377127
Encrypted:	false
SSDEEP:	24:wYybzGDDuyS1IJX3OSFrd+E8BPQc5bCLD14yEalWhUUjSxbM+t5SU:wYIz11IJXT1uQcFCZkCRh
MD5:	D5E2AC1A1FF513F1A535AF7E1F9A6732
SHA1:	40CBD65DD1DB73B9F4E3E272B6A49A21DA70F409
SHA-256:	97A5BF39F915AB9D5F7B17644EE8338D2D8EEE94FB49A424C1B71A6D9647782E
SHA-512:	4A2BE35F4C7708C38CAE32039DE450C89AE18F6D3A5EAF45532D21D348528ED8B2571D27D0862939D564A9BCC6CFCD35817ABDA2AF6A8BDF2D606127A4ED8D88
Malicious:	false
Preview:	BM........6...(....................................................................................................................................................................................................s.............................................................................i..............................................................................t............................................................................. ............................................................................. .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ico_shel_check.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	3.0908868353926398
Encrypted:	false
SSDEEP:	24:K+2U8888888888888888888888888888888888888888888888888888s888888C:R7888888888888888888888888888882
MD5:	3E64FBDBBA71BCF30FFA52997E48DC70
SHA1:	62C8EAE2032F4D14029999047D91D97FE656A37E
SHA-256:	C6039CB9EEE68A5194997B667564DF434A57677CEB4FEF83FD8B459082F97AAD
SHA-512:	46E381C385E073303DA3857610A573B42D3A68538473B207D84F14D729B642E05EA7EC5249F08D6E6C6A082F49EE2E91388860F223EDC92287C5F75ED5543CFE
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................b............................;........}........................U..............}....................}....................b...........................U..U...........U.......................;......U...........U............;..............U...........U..........................U...........;..........................b.....}......................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_firewall.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.473185537263806
Encrypted:	false
SSDEEP:	192:eH+v8d88kh888Z8888L88888N888888j8888888Y888888888Q88888888G88888:eepGVPe
MD5:	0708018C81B6D2F22AC48F7D50B5B486
SHA1:	375D42619F82A01C8E550D153FA15D40B92A0F7E
SHA-256:	99F11865F16EDE20E7EBB383BFD6BD62C76A4249BF25B5B93D07CDBB82C83523
SHA-512:	C79FDC28CD123DBBF0032B226546023CA4C8055BEBDE93B14C25832FA111236722F09AD8C366411FCE852BB0C8E4FC1F8CA1A577C7D91BE6B34C012090CAAF6A
Malicious:	false
Preview:	BM........6...(...-...2..............................................................................................................................................................................................................................................................................................................................................................................5................................................................................................................................H...3....H......................................................................................................................0.0..>.....0.0..............................................................................................................j....>.1............J....j......................................................................................................O....E...................n....O..............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_log_viewer.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.1199255507557804
Encrypted:	false
SSDEEP:	192:en888888888888888888888uU8z88W888G8888N88888o88888888888888/O88Z:e1
MD5:	327B16CD52559922077D29D80117CA8A
SHA1:	DC3B272A33E50E1C0AACE7FEE042903EEADC8B1B
SHA-256:	F4D394C2E79912A9D6E7D9FC22359C75380368DCCF92B6725B7B698ABFBF7CD0
SHA-512:	D8766D49FBB2448BBD4EC0DDFC6F455ED244208C78A4FE1262AD2755A15015DD182A53E4B4386F35AF61DA720D9C390ECB1C2CF4ED7C775601690F95541AA90A
Malicious:	false
Preview:	BM........6...(...-...2..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.............................................................................................................5....=...............................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_message_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.9862845792107353
Encrypted:	false
SSDEEP:	96:sZr88A888888V8888888888a8888888888888f/8888888888888888a8888888H:sZr88A888888V8888888888a8888888L
MD5:	69B2861F911877DE07AD4D937E70B1AE
SHA1:	76E01A783322AC1441690246324849C18E6579EB
SHA-256:	C3A5583031305690E622AA87F5BBBB5E75DBE28482AA761122B21BDB08D547AB
SHA-512:	20E34D46CDFD2ADE0AE932B9CFAD5189394FF785F32114DBAF909F8F84D539ABA0CE72953FF8FC67AB4976ECF9FFCFEB7F630DE77345D2291554BF5902F8FBE4
Malicious:	false
Preview:	BM........6...(...$...)...........N.......................................................................E....E.............................................................................................@............@..................................................................................U....................U.......................................................................p............................p............................................................3...............................3...................................................@........................................@........................................U................................................U.............................p........................................................p..................3...............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_message_error.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.426621694845486
Encrypted:	false
SSDEEP:	24:KxR0fU66EHH666666rq66666666665P666666666666omfU6666666666666666x:KxafpbmfxPt/wgPGXtUqWpbS
MD5:	54B3C51C0BF333B29BE333B4FA096F43
SHA1:	C1891B7A9CBFF1804F557D9F96A5D3D17256D8BB
SHA-256:	CF5C838D5040F3B9743971D49964A08619A6A41E36DAB3FB222E580625A421E0
SHA-512:	D61F84AE7521586F77A7DD8EA9ABF1B6F9BBE12BBA92FEC93DF22FA9E330AC3D4672F79F2F1725BC3F16D79D98F3B99635D83018F24C891095155DB2C3534B51
Malicious:	false
Preview:	BM........6...(...$...)...........N...................................................................z...c..P..c.z............................................................................................._..P..P..P..P..P.._................................................................................../p..P..P..P..P..P..P..P..P..P./p......................................................................Q...P..P..P..P..P..P..P..P..P..P..P..P..P.Q...........................................................v...T..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..T.v..................................................._..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P.._......................................../p..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P./p............................Q...P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P.Q.................v...T..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_message_info.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	3.015665328654711
Encrypted:	false
SSDEEP:	96:sZr88A888888V8888888888a8888888888888f/8888888888888888a88888887:sZr88A888888V8888888888a8888888X
MD5:	F3BE0D0A228B3D18A222B9FFD6B7E552
SHA1:	AB5712FECD9FD0D082A3BFEF8648CDB50501F437
SHA-256:	9144CC19DED889CE43F80903BBAA593A8505E782A6D8D33EE0857C838FEF9E85
SHA-512:	0C3C9ED61C41C9E51362DC86514E493A05A1E7A76123EF7F31142A498562268FAF6211F8BEA542E3FCF2CA7A8DC44D8B9240C2FADA78FD909916F508548A4657
Malicious:	false
Preview:	BM........6...(...$...)...........N.......................................................................E....E.............................................................................................@............@..................................................................................U....................U.......................................................................p............................p............................................................3...............................3...................................................@........................................@........................................U................................................U.............................p........................................................p..................3...............................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_message_warning.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 36 x 41 x 24, image size 4430, resolution 2834 x 2834 px/m, cbSize 4484, bits offset 54
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.856318470621809
Encrypted:	false
SSDEEP:	24:KxdCAcHkbHGehy+9FWJc10FvuaOa0UJMo1ywOoYh:KxdCAEMHGkj9FWJckvLtFJL1yloYh
MD5:	FDB1D9C618B8E7A6432F41BB09535312
SHA1:	99BC4E9759859CB838D6B6250438753CA2DEECBB
SHA-256:	FCD8E53276DD286A8F9AB5F503A709EFA1159F939827DB11E3FF534B8EA2163E
SHA-512:	30AAF1C2CB28BBB390C612BEE37B2501D7A60F29FB93AEE98C0AAD2F488DEDF0FE3F429981A0E5166F8B1A138443A8CF2FFF22B9FEE4E92C9FF754BBE65DF8BC
Malicious:	false
Preview:	BM........6...(...$...)...........N...................................................................z...........z................................................................................................................................................................................................../............................./.......................................................................Q.........................................Q...........................................................v.....................................................v......................................................................................................................................................../......................................................................./.............................Q...................................................................................Q.................v...........................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_on.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54
Category:	dropped
Size (bytes):	576
Entropy (8bit):	3.3037271229406757
Encrypted:	false
SSDEEP:	12:4lU7S0C2NE8mV8mLNCQbzk88YK+lMJ9G8Dr4qaK:4lQITLVW+iJQ8DsqaK
MD5:	8FFDF37D683F209FD12346DC532A1015
SHA1:	66D30E1AAD005D1C54263FB2BCF01C878AD76C28
SHA-256:	7C06B94797C12DD4031FE299DB09DACD8E82A8190E8E4C333F7C1F824BF32C7B
SHA-512:	A0CD14C25568ADDF6C6CF5360B95169D7612FBC9710F78C4A5B06A1523BC3A3B0629DAC30D1ED51912AFD6D4FA8B7F0C3D52562FFDFA01A4030F4B1E45152034
Malicious:	false
Preview:	BM@.......6...(.............................................................................................m..G.................................g......g...........................g.....0........................._............=..................g.../..........J....l...............9.0...............0........................................0....................................^....?....................................A....E....................................6....D....................................I..A..........................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_product_tray.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 74 x 83 x 32, image size 24570, resolution 2834 x 2834 px/m, cbSize 24624, bits offset 54
Category:	dropped
Size (bytes):	24624
Entropy (8bit):	2.947000309927683
Encrypted:	false
SSDEEP:	96:FrZGRgEaL9WbsR9X1mxI4ztCWEI1zbDtReZkGopfop+5mu+ZQrgTLJ:9AjaxWbS9XAWQ1zveZHope+SMg3J
MD5:	D5B12EA13E2A819D17782AFAB568E1B5
SHA1:	49DF401CB9CDC2659FF7137F5E73CDC58B93B371
SHA-256:	E2E774909F599A0F45FBD0AADB53893663A873A2EC13C9822137280175C7D8D3
SHA-512:	6A4B80B9C6C7E064B29418A5AC940E983AECD83E5AE2AD6EE420412AC934FBB550B989E40E947268B1ED44FBD82345E7E0FD5BC6ACD820841C67ADF33A2C4475
Malicious:	false
Preview:	BM0`......6...(...J...S..... ......_............................................................................................................................................................y...E.........E...y...........................................................................................................................................................................................................................................................................i...........................i.............................................................................................................................................................................................................................................................1................................1......................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_quarantine.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.148425336469748
Encrypted:	false
SSDEEP:	192:e38888888888888888888888888888888888Y888F888F888F888F888w888+88/:es
MD5:	C1CD8163D7579661763FCE65FFF43664
SHA1:	4D890F9D02F080494B6AA60A8BFEFA422EDC618D
SHA-256:	B35499B253D7874AE14C5D8D7DEAA98AAD1E2E84FA0D504F91A2AA8B6681217D
SHA-512:	EB2B4DCB7F2F0C4889B779F31A8227118C58FDCB1B7B199638A656261571063613EC0732557537FA79FE73367A0F050942112354726EEBD7CE95839A600247F9
Malicious:	false
Preview:	BM........6...(...-...2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................................................................0......

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_scan.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	1.5627219431921444
Encrypted:	false
SSDEEP:	24:+78XG31TgbTqooC9nqxlMDRCIOMId+XjrVuZv098aYCn7KtV8E6:+78XG31TgbuowU91K+TrV+ad+L87
MD5:	7B5B25C289CBA0977699F62C59C235FE
SHA1:	16B26F5B7E58D9124EEC0A08ACDAA500AC4344FD
SHA-256:	B5AC182504AB575A49004030AA45CCD9DA938E9E26C91578C81F3365CB2F8411
SHA-512:	881CDA5035552E9209C22E2982F60A20E748B12836525DF694A4EBCF617D3D94643B05F10C02CCD80E829B031E2E22A701317CDCFFA1631F06FC2F7B1F31D77E
Malicious:	false
Preview:	BM........6...(...-...2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_scan_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.9824496363536044
Encrypted:	false
SSDEEP:	192:ez8aL888885888888888E888888888888l888888888888888D8888888888888M:ehpj
MD5:	BE9FF8D29525461F7719867D7C5C2BCC
SHA1:	AF50892BF0659EBD0A54E69E8B30F77717CB1471
SHA-256:	96F3CB26ACBE58E36FF67A83DB56B7249866CB1AEE90536672ACE24BFE20007C
SHA-512:	E3181D9A209229B92B6CADC9A744CCAAAF06F1D7706ED29C4771DB02D7958572D443B5ED1989DA4B745D50197B2AB8C47F0C15F6371EF5ABB9174AA356DFB097
Malicious:	false
Preview:	BM........6...(...-...2...............................................................................................................................................................................................................................;..........;.........................................................../.....................................................O..................O......................................................T...............................................l..........................l...........................................................................................2.............................2..................................................................................@......................................@.......................................................................V..............................................V............................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_scan_detect.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.0959539657113977
Encrypted:	false
SSDEEP:	24:+733O66KJ666666DUC6666666666zH666666666666sSuA6666666666666666T4:+73xICuF56nEfvnGHJwfw6u+PwR6
MD5:	D236AC433CCCF68BBEE08158087F1091
SHA1:	A24AAD0CDDCB0E902FF40435F4C4AEFF756361BB
SHA-256:	D4C419ED31473F5105BA8576C01E80BD4770FDE1B1A1AC7E3146255ECC8A16C4
SHA-512:	CC805BE6C6FD54ED193A55B5C45905C6F063EE6E10CCF03CF4201B83D8A067BC27886B1FE47930800901FD4B9D213C5AB28CEED2ABFB8CE4A39DB344D75AEEAC
Malicious:	false
Preview:	BM........6...(...-...2...................................................................................................................................................................................................................................j...`..P..`.j.........................................................................................................................X..P..P..P..P..P..X.............................................................................................................. f..P..P..P..P..P..P..P..P..P. f..................................................................................................=z..P..P..P..P..P..P..P..P..P..P..P..P..P.=z......................................................................................d...Q..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Q.d...............................................................................Z..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Z................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_setting.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 45 x 50 x 24, image size 6802, resolution 2834 x 2834 px/m, cbSize 6856, bits offset 54
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	2.3589536312962265
Encrypted:	false
SSDEEP:	96:eDbqBy+s6iwB+AlIX3Xn8W86Y4/QKepUqQ:eXvGIX3Xn06wNpUN
MD5:	3AF977ACF7D3CD5A10719E7A03D97E26
SHA1:	74551E81BF663A6BDD3F7B477138236617CBDA8B
SHA-256:	E542DDCAFE43D1F0266645710831220985114AD07CCF15606A9B8D1F3CD13ADF
SHA-512:	EA75F476C5327B0F08D2E4294B1F7131196E0A58B7C553F74CA63680D8FE138081278AAFB6055A423098F544E414AC409A58663510C08F2AFA7346D08C41A2D2
Malicious:	false
Preview:	BM........6...(...-...2.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|.4./.3..h..........................H..9...4..\|..............................................................................[....;...........................................<....]..........................................................................z..............V..G...................5..{..............e..?............................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_stx_info.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 44 x 49 x 24, image size 6470, resolution 2834 x 2834 px/m, cbSize 6524, bits offset 54
Category:	dropped
Size (bytes):	6524
Entropy (8bit):	3.423184181999544
Encrypted:	false
SSDEEP:	192:sm8288888z888888888T8888888888889888888888888888s888888888888888:s0v0
MD5:	A6E501A32146E7855077957719607EE0
SHA1:	14D474B2A962030EF9255B800164B38A11B4A31B
SHA-256:	EB07EDC748A8041AC49676EC51B33AE97FF17CA7E8C68DE5C2517451FDB17F93
SHA-512:	ACD924934D2838597D1AEC1F70EB9387117B758DE937F584E8A54F6ED311462F2A8AF3C291FE56CB2442A3361CD5A28882AA5A4059364996C2E3D3FB7D77DAF1
Malicious:	false
Preview:	BM\|.......6...(...,...1...........F.................................................................................................................................................................................................................=..........=.............................................................................................................R..................R..................................................................................................p..........................p.......................................................................................4.............................4..............................................................................B......................................B...................................................................[..............................................[....................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_tray_alert.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 27 x 24, image size 2054, resolution 2834 x 2834 px/m, cbSize 2108, bits offset 54
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	2.567045300078107
Encrypted:	false
SSDEEP:	24:x2EHaw/RnH666Lx666666+tG66666666Unx666666666666f66666v666666E66n:7HPyYZnm0LxHArkzlSS
MD5:	754BB7865438E4309A74D34873549D80
SHA1:	0F8C734567E7D3375FB0D7309DF838D2202DF8D9
SHA-256:	ECFFC5E8390B79BE8B3B048B8FD22DEB01C72AF7AFC6347313998FD929BCC229
SHA-512:	8E630BB1708288263266E1E94D4DA76E466F080AFE2ED755BA39EDDCA52472362D6019D61B0C4DE4EAEF41AD2A7999F33F8B511DB2BA3A0A42ABDF3B9498D3F5
Malicious:	false
Preview:	BM<.......6...(........................................................................m..P.m..............................................................5t..P..P..P..P..P.5t............................_.....................R...P..P..P..P..P..P..P..P..P.R.......................................n...S..P..P..P..P..P..P..P..P..P..P..P..S.n...............................Z..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..Z....................!g..P..P..P..P..P..P..P..P.X.....W...P..P..P..P..P..P..P..P.!g.......S....P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P....U.\..P..P..P..P..P..P..P..P..P..P.G.....F...P..P..P..P..P..P..P..P..P..P..\...P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P..P...P..P..P..P..P..P..P..P..P..P..P.P.....J...P..P..P..P..P..P..P..P..P..P..P.1.P..P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P..P...P..P..P..P..P..P..P..P..P..P..P...........P..P..P..P..P..P..P..P..P..P..P.P.P..P..P..P..P..P..P..P..P..P..P..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\icon_tray_complete.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 25 x 27 x 32, image size 2702, resolution 2834 x 2834 px/m, cbSize 2756, bits offset 54
Category:	dropped
Size (bytes):	2756
Entropy (8bit):	3.363973142154021
Encrypted:	false
SSDEEP:	24:32i4+WS5OI4jyx6v6WoRl6sRyS1F18yd+G:P1W0OXGgloRl6sRyS177YG
MD5:	6FA89D31C61E0B4DF2EA623B96C1EE71
SHA1:	2548A98C4A2FDAD3978EBCFA77A0059D6CF04639
SHA-256:	251443477C2D8FC8BAC0BCE3E535DB71DB60FEC94E409380854B699405A38136
SHA-512:	6AF6627918D228CE2254032D3A3BE0ECC7E8CC7BB43218C25F2CE44C976FE0FDD621F92900836B3CA2281E44E5A417D027CC4C722B542BB6D52BB45C036F04B5
Malicious:	false
Preview:	BM........6...(............. ......................................................................P......P..................................................................................Y..................Y...................................................................q..............................q.....................................................2...................................2.........................................:................................................:.........................I............................................................I......................................................................................<...........................Q..........0....................................<...........................W.................3.........................................................[...............

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\img_listctrl_header.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 12 x 24, image size 48, resolution 3780 x 3780 px/m, cbSize 102, bits offset 54
Category:	dropped
Size (bytes):	102
Entropy (8bit):	2.8539791128607273
Encrypted:	false
SSDEEP:	3:uAlhl0lHXLjOSSAGD00dn:BlzcIV00dn
MD5:	99A0A3B1134D6F1ED215AF08AB6D710C
SHA1:	75A53759806F0E66D531F031B0C7098ACCD647C8
SHA-256:	5190352B2E7EB8807A55D9247703C0AF96F11A97B3F5D70803826C5EDBF870FF
SHA-512:	130D76E845EBF429262A950B917C4AAA67DEBEE90A496B43CB0B6C72C60EE814D0A84CEBD91A70766654CCD87F19443F6BF1B4FDABDDEDADDB3DEAF73F828054
Malicious:	false
Preview:	BMf.......6...(...................0...................ZZZ.........................................ZZZ.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\img_popup_titlebar.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 22 x 24, image size 354, resolution 2834 x 2834 px/m, cbSize 408, bits offset 54
Category:	dropped
Size (bytes):	408
Entropy (8bit):	3.3017416286152836
Encrypted:	false
SSDEEP:	6:gl/ilfUto6HhDUHLdTEESllReQb8bIIIIIIII/:g2UtxBDMSDb8T
MD5:	D921D94B20F4A55855927CBCFE05BBE4
SHA1:	8E536AF43ED7F3CF3BB7DBE1DD65404E324693BD
SHA-256:	887DD7B7D0A41030C36A8EF304699C021F4819FD102DC3F2CABF54E01088B354
SHA-512:	AD66E5E0403C1832C02742BF44ECC8BFBD958E628AF8D9F5B2EE60028A3CA2A18358B0994202C011E323981D8A0B8DAB3AD52DC83CACFA3CED53521054194516
Malicious:	false
Preview:	BM........6...(...................b.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ipcntry.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	SQLite 3.x database, last written using SQLite version 3014002, file counter 2, database pages 1127, cookie 0x1, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	4616192
Entropy (8bit):	6.24811983862515
Encrypted:	false
SSDEEP:	24576:0jfLR9PgLqyBIDr1nxgVniDPsbX6KTFSafxWOoJCFJ0qrmO9LMvwg3V9pVxk35R4:2z2Bcrw9iATgafxl/9LMXl9jxyyyv4
MD5:	A1356A635643AE79B6104BCDFF0EF93B
SHA1:	A02F5EF1F81089FF5933FFDC1E5F3C0CE7914E3A
SHA-256:	F826F9A857A0105544F1516E7F838BE9E1CC721412A047B5F8043A3D58A42464
SHA-512:	3934C7F776C956C8A7E0D29F695CF9E79EC27A24EA1F29B1651061FD4BF8691AB53E99A1B0DD4E239016571667818201A0339733862B8CD255B499A66587B4F1
Malicious:	false
Preview:	SQLite format 3......@ .......g.................................................................-.r....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\klb64mkd.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	147
Entropy (8bit):	6.702261355184907
Encrypted:	false
SSDEEP:	3:bn63Mr6zYB1lzM/9DdJDDFzIAr7Np/BiMpIJx2BJ0Wm6KQNp5vahAD6:b68rYYJM/9ZtFzNrjxyxgJ0H6F7m
MD5:	E7D39852C968C498D7B0880D64B5D5C3
SHA1:	D7A65018CCAFE92465281C82BABFB202C48EAAA8
SHA-256:	9282B7F5291BDAA832A2FFFF23FBDB1462942E14071710718C47811046E70EE1
SHA-512:	34FFC4EC487FE269858A05FA3755053B7A409927822803D6C7C313CE8E941456C21A3E43499E3BCC57ADAB466CF43AA6759689F3A363FD260273817B213BD606
Malicious:	false
Preview:	KLIB_MODSIGN_V1$$$$s.j.X......M)..}.!..o\...'..^.;.&..zG.......X...*z9k.E..Q(uY...-w...VL.5.].<S.B.\|.2X.5...7..$....5.n.....o...&......dv..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\klb64mkd.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176784
Entropy (8bit):	5.720763208103024
Encrypted:	false
SSDEEP:	3072:MdBr2jLGfs2THRHWyYTRGyCGZkmYbDTnPO08A:Md1iGk0HRHrzyCQkmYbHPOC
MD5:	AA5AD93780DA8F74BFF806743CB1C351
SHA1:	99BF97C164F7FCB25B5F10B985CEF3B75328DFD3
SHA-256:	D5A787F5D139FA9FF8F3C748BF1085DB41077EF7549775CDAB4F239C4BC10224
SHA-512:	4BDCB83797F103D6BA890BD217565A950F4D1378D818A1C338DA950EAEED4694ADB241A9DAE11127A5E5B1DFA7C302DC952E10D50287FCCEFD3622203FCA8907
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E2..$\W.$\W.$\W.$]W.$\W..'W.$\W..!W.$\W..&W.$\W..1W.$\W$+.W.$\W..$W.$\WRich.$\W........................PE..d....U.T..........".................@................................................\..........................................................<...............p....r...@...........................................................................................text...r........................... ..h.rdata..\5.......6..................@..H.data....c...0...D..................@....pdata..p............Z..............@..H.edata...............d..............@..@INIT.................f.............. ....rsrc................j..............@..B.reloc...............n..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libacm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	211672
Entropy (8bit):	6.58144395919684
Encrypted:	false
SSDEEP:	6144:nKUI34zbdLXDus20QCGW9vFmDkVOP31Nrrr/5C42+2bfP/PGe8:1Uyd7ysmq+fr/h
MD5:	E79439AAD3716F569CE9030F73C59BDF
SHA1:	E6C414636AD1979CA5E94BB1691C7B9854285BF6
SHA-256:	20CC81891C94F827AB3845F2C9FC6083FFD53B587DFAFF425CC16379C3DAF2A6
SHA-512:	E751FFE4686B91ED5FEC446A3D740FD989D0271DE123EBB2927DC779CD8FD978FB5C7F5445088856A907817AA372FBBA3FFC56465DAEC0A04BDA9AEFB47253CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b............{U.....{S.....{E.....{B.................{O.....{T.....QR.....{W....Rich...........PE..d...z..\.........." .....p..........ty.......................................@............@.....................................................x.... ..L...............P>...0...... ................................................................................text...Ao.......p.................. ..`.rdata...Q.......R...t..............@..@.data...X...........................@....pdata..............................@..@.rsrc...L.... ......................@..@.reloc..$....0......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libcrypto-1_1-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3215640
Entropy (8bit):	6.774316456941846
Encrypted:	false
SSDEEP:	49152:8VwASOZ0IU6ibGtlqozOh5P0TW/0z6a69XayVBpXiwfrdnCMvg8dP6Ip8RZ1CPwy:6b+DqX6TdxvDEIp8L1CPwDv3uFSH6
MD5:	9D6D2FC033754ECCAC6FA8760C33D06E
SHA1:	A416F37ABEAAFD6F1AF1317192DA8B4E24E8914E
SHA-256:	F39982B94C69D76BF6F63E73ADDE53C858891FBC0EA0CC0D743EA8AD11D77E76
SHA-512:	FAD8CB012954596AC965DF456B33048E61C6F9709CED6E1529077C7631E105BC3801F4405604AA1A4B15BEBDFCD9293F1619E4BD5635AB1669BB9C59F3875DFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3..]..]..]..Y..]..^..]..X.c.]..X..]..Y...]..^..]..\..]..\.\.]..]..].t.Y..].t.]..].t...].t._..].Rich.].........PE..d...Oj:b.........." ......"...................................................1.......1...`......................................... .,.T...t~..x.....1...... /.......0...... 1..V..p..T............................................"..............................text...."......."................. ..`.rdata........".......".............@..@.data...\............\|..............@....pdata....... /.....................@..@.rsrc.........1.......0.............@..@.reloc...V... 1..X....0.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libnspr4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199680
Entropy (8bit):	6.678065290017203
Encrypted:	false
SSDEEP:	3072:/zcwXcVnDhH5YI6KkEK7207EmrRelzafK+AnF4xH6dVHwpXpE92jDBSRYO6s0eEw:TUDF5YTyBJuF6DHwpXpfSRYO6Z
MD5:	6E84AF2875700285309DD29294365C6A
SHA1:	FC3CB3B2A704250FC36010E2AB495CDC5E7378A9
SHA-256:	1C158E680749E642E55F721F60A71314E26E03E785CD92E560BF650B83C4C3C8
SHA-512:	0ADD9479B2FD631BAFC617C787BCA331E915EDC6A29DD72269B6A24490EC1C85E677698E07944F5FF3BD8D849D3D20ACE61A194A044C697FEFCF992C6F05E747
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Wp.6...6...6..-x...6...@...6...@...6...@...6...N...6...6..m6...@...6...@...6...@...6...@...6..Rich.6..........PE..L...lA.O...........!.....^...........h.......p...............................p............@..............................+..<...x....0.......................@..."..................................X...@............p..`............................text....].......^.................. ..`.rdata...s...p...t...b..............@..@.data...P(..........................@....tls......... ......................@....rsrc........0......................@..@.reloc...&...@...(..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplc4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.794541181301596
Encrypted:	false
SSDEEP:	192:y39iNAtUyE7ioVwAFzuh+pOWo1v26wJMnnnLIQBIc3X7PVlD6QHS6CV+:mRUyZoVwAFzusie6wcZxrPVlpHS6c+
MD5:	1FAE68B740F18290B98B2F9E23313CC2
SHA1:	FA3545DC8DB38B3B27F1009E1D61DC2949DF3878
SHA-256:	751C2156DC00525668DD990D99F7F61C257951C3FAD01C0EE6359FCDFF69F933
SHA-512:	5386AAD83C76C625E2D64439B2B25BDA8D0F8B1EB9344B58306883B66675D1F1E98E3189C1BC29CD4B2C98A9D4A594761488AAE04D3748BBA5775A51425B11EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......vx..2...2...2...;aS.0...]o^.3...]ok.0...]o\.7...2.......]oj.(...]o[.3...]oZ.3...]o].3...Rich2...................PE..L...oA.O...........!.................'.......0...............................p............@......................... 8.......3..P....P.......................`.......................................3..@............0...............................text...T........................... ..`.rdata.......0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libplds4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.576295270591411
Encrypted:	false
SSDEEP:	192:y8/u6mEWZYr/YDmJrFirLPAxHU413X7PVlD63YlFfP:1/uHE6Yr/Y+h0AlU4prPVlZlFfP
MD5:	9AE76DB13972553A5DE5BDD07B1B654D
SHA1:	0C4508EB6F13B9B178237CCC4DA759BFF10AF658
SHA-256:	38A906373419501966DAF6EC19CA2F8DB7B29609128AE5CB424D2AA511652C29
SHA-512:	DB6FD98A2B27DD7622F10491BBA08793D26AB59016D6862168AAD278644F737DDDBD312A690DED5091D5E999DC3C3518FD95B200124BE8349829E5CE6685CF4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................g......j......_......h............^......o......n......i....Rich............................PE..L...mA.O...........!.................".......0...............................p............@.........................P6......l2..P....P.......................`.......................................1..@............0...............................text............................... ..`.rdata..R....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..(....`.......,..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\libssl-1_1-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	927520
Entropy (8bit):	6.342728401452184
Encrypted:	false
SSDEEP:	12288:iK92/3kUBdbIZktE2YYuBnRWQuCGo7ziPjgH0Es/gSUSD/9WfhxtzS+U2lvzvC:uCZktEz3PiUJsYS1ZWZxtzRU2lvzvC
MD5:	9C6E20BF5293AF7CBE033D906F447254
SHA1:	650B62874812B1CB36E1D60D3C1C425591A70568
SHA-256:	E97F511416FCEDEFBDA4110F4C1C510EC477D2D11A6C2FE6B75BA10DF3F0BFCC
SHA-512:	453902658FCA44D2E492A773E8F40707400D71B8213E497EBABF13011FAF8BE2D1FFDF69F3DFE7C65BF356098AE96AFF51EA47138C94F09762458E1C57738824
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0dF.^7F.^7F.^7#.Z6L.^7#.]6C.^7#.[6..^7#._6D.^7..[6X.^7..Z6H.^7..]6O.^7._6E.^7F._7A.^7.Z6j.^7.^6G.^7.7G.^7.\6G.^7RichF.^7........PE..d...nj:b.........." ................@o.......................................P............`.........................................0...8@..h...<.... .................. ....0...... ...T............................................0..H............................text...p........................... ..`.rdata.......0......................@..@.data...._...0...D..................@....pdata...............Z..............@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\license.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74417
Entropy (8bit):	4.988394074560754
Encrypted:	false
SSDEEP:	1536:lt4j5XX2cCmTOKyjTKV3OFYwT3JkMOFYwT3JAPWH99LZSZKizbZQzSju8i2H5IMV:H4j52eTOpjW3OnJ1OnJAs99tSZNztQz+
MD5:	D35CB60B236526758A014ADB783F93C6
SHA1:	28C94004CA7C5E26BA41BF3F1DC8DED5B7782121
SHA-256:	EEBDE7732A2DD1C4CC6402AC289718F12CE6BB2FD6F879F7604239D373BE2343
SHA-512:	6771E99EF52FF346BEF792609E47A846D32C7D1A8572424D244E042F6ABE2B8071E3A08DF2EB68B8F0418DC42694D3C793CF36108D09A673E67335A1EA90CB6C
Malicious:	false
Preview:	AhnLab Open Source Software Notice....Product Name : AhnLab Safe Transaction....Those products identified by the Product Type and Model Range above from AhnLab, Inc. ("AhnLab") contain the open..source software detailed below. Please refer to the indicated open source licenses (as are included following this notice) for..the terms and conditions of their use...The source code for the above may be obtained free of charge from AhnLab at http://opensource.ahnlab.com. AhnLab will also provide..open source code to you on CD-ROM for a charge covering the cost of performing such distribution (such as the cost of..media, shipping, and handling) upon email request to opensource@ahnlab.com...Please be informed that AhnLab products may contain open source software listed in the tables below.......AhnLab OpenSource Site : https://opensource.ahnlab.com..-----------------------------------------------------------------------------------------------------------------------------------....jsrsasign 7.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mdp.scd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1023346
Entropy (8bit):	7.36193105888848
Encrypted:	false
SSDEEP:	12288:ZN1zDmTseudV1y2MltTF4qcetHZD+lzoFgKTjDlq8odbvJonsd9JbBvILL4mHJ/6:ZH/IMf1jQtZ4qce7DxAnbBcpngr
MD5:	59138020613C6F1CD031541A57BE9888
SHA1:	D2A63DD0D9B5370EFE6E32795366187174A880B7
SHA-256:	ECDE4917B6D7462E820C1063330A86A3A7B9FD11CD7132A50656B3B1F26917BD
SHA-512:	A2C9904CF8950405B4401DCB9FE7BC2113CD99C79FFAC97D32EA730357F05C7A272E081F60D6B8C2780F33C9D26EB576BA5EB319FBA95D52EF54EC4BD356588C
Malicious:	false
Preview:	AhnLab MeD Technology MDP Rule Data File...........s.Uy~...............5......JKCJSWOTHSUS.s.....................H..ROGNa[SXMWYW.w....C.OSKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKKJ@WOTHSUS.t.:...'.........9..bibo2woJ:sus9u$s...........%..+...............BA.:.JnF.?3L....rB&;BKSGL@.MK.k..;43:B.?D8CFB.c..=B:..NFK?IKI.j...KCJSRNTDSUSJp..............W.CU..DOGN^[SXMWYW.w...C.WSKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKFJ@WOTHSUS.t...............9..bibo.wot;sus9.$6.............%...............7..AB:AJNF..JOGNS[SXMWYW.w...(@.USKPF.LO.o..KLFKTXPUITUT.t..C@8?HLDI@HLH.h..JKCJSWETJSUS.s..LMELUiOVJUSU.u..JKHJ@WOTHSUS.t...............9..j3jRw_tMsGsj..7.............%.....;.........4.."B%A.N1K.J)J.jD..C.B.O.L.K.KJk...;.:.G,D.C#C]c..`B:..NFK?lN....qJ.C.S8O:HSU..:.P.......D....}..Un.`.s.q.A.s....Mj.l...G._.w....Rmz.y/.Y.k.O...4F..}.:.......O.?.O............AS..\|.........S.A.J"C$S'O!H'Uk.].s............sZ_.6%/e?Q;f4"A.....HEAHQ.JRF

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcore.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3104080
Entropy (8bit):	5.673789288047187
Encrypted:	false
SSDEEP:	49152:nQXJus5VaIhvTN2tlQ/uwYaRQBsyHlFXWGNEwixZh8zfPXa:euaVaIhvTN2tva
MD5:	C365BAED8F41D9538627DC419F393E21
SHA1:	BA5343EF851047F184D02039D413D4AA4AA24EEE
SHA-256:	BA3099CE2A2429AEF245F743B3CC6FEA853F8C554F5A8F3A1E4DD63A6E46A719
SHA-512:	30DA0FD3E424193477FCA4AF1DBF4A99840660A5E2A1F30782B6B38E399845F879440A5D12AE1BDEF708A78FE61E038254A70116E4A913AD0EC024CE9C0A8B1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........KB..,..,..,.t_R..,..Q..,..W..,..-.+,..A.x,..B..,..V..,..P..,..T..,.Rich.*,.........................PE..d.....qb.........." .....2...........9........................................0.....D./..............................................B!.......!.T.......h.....-......:/.P#....0.h....\...............................................P..0............................text....0.......2.................. ..`.rdata..f....P.......6..............@..@.data...@q...P!..\...,!.............@....pdata........-.......,.............@..@.detourc."...`..."....-.............@..@.detourd.............0-.............@....rsrc...h............2-.............@..@.reloc...%....0..&..../.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medcored.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1113992
Entropy (8bit):	5.6353653873374245
Encrypted:	false
SSDEEP:	12288:F585sWni+esP7Wk5h1L5Mm9sDDXRID/GbnWTZOBrZX//9JD0FG6WTymh1:F586WnidsaCjLqKsZnWMfnrD0FXWOmh1
MD5:	E8BF43B8F034DF1BCF95068235181999
SHA1:	F30DCCE3E226554E0BD416EED73729032B65B73D
SHA-256:	2167ED8DF99D35C5C37C69D4E5988C87A5BF9D389F5B9445E653D10119C5E1E7
SHA-512:	71A5BED347B5D63FD5849769B0E28BF40027F7BB3AB41282B24E651720E7A7FC0DBD126CAA2F3A21943993F2607B7FE774D2633909DC92D9BCEBEB8CA227F606
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.j.,.j.,.j.Z/..!.j..t.-.j..t../.j.,.k...j..t..).j..t..(.j..t..".j..t..<.j..t..-.j..t..-.j.Rich,.j.................PE..d.....qb..........".........................................................................................................................d...<................6.......K...........$............................................... ...............................text............................... ..h.rdata...)... ...*..................@..H.data...h:...P...(...4..............@....pdata...6.......8...\..............@..HINIT....j........................... ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medext.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1320272
Entropy (8bit):	5.730601534772912
Encrypted:	false
SSDEEP:	12288:iXKzauLzhoGFTR4Lo/B9NbakB6nEdarwqv/c5PcOeyqsamdmbfk56Sq:P3LCGFeo/B9NbRS6ard/YcOeyRPdciq
MD5:	63497A48DFCBFBF7A9CE2C71E3B5287B
SHA1:	F2E21ADE738BFEA85DC1B10A61BE40E7FE508D5D
SHA-256:	F6A3A1CD632F59CC8B64A1A2B6A299A6DA3CD3DFA4170FDA8B8C938B6175FC1F
SHA-512:	1F343D1CFBAD090BC0617710ADB0BC11F9230C4A73F4F1807051F65C3BAAA0D2870EE806C432C6213895A7F5F2A1A6474C88EC0B2E9A63E4BAB8046DF05CF4CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2..2..2...G..2.....2..2..w2.....2.....2.....2.....2.....2.....2..Rich.2..................PE..d.....qb.........." .....f...........o.......................................`......d4......................................................<...x....0..........\|.......P#...@..........................................................H............................text....e.......f.................. ..`.rdata..oI.......J...j..............@..@.data...............................@....pdata..\|............`..............@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvpdrv.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	916872
Entropy (8bit):	5.330590123069806
Encrypted:	false
SSDEEP:	12288:wWjs0lKZEnw2dGcxMKJbvYrCCw+1KAAJCvY9mJOPTeKGaXFit:9sBZcweGaMKxYNw+oFcOPTeKGiAt
MD5:	D298834CFA3C3578C199D0CB70078578
SHA1:	D40339B5C5D15A4149267291C8F8F47869E1E566
SHA-256:	67005AFF4AF890CB1DD57111BCF49D101A5F5337A6A45D7FF2845E7F1AC565B2
SHA-512:	CC4266993E490B0DC6CB4A6F84AEA4CE8D4282A551B21230131F0E68E32D9BEBAB53CA58738DC200F250997DCD76A3BBD11DB3BB6BBF77338C2BB174386124BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:.V:.V:.VLq.V0.V.,V;.V..V9.V:.V..V..V?.V..V>.V..V5.V..V~.V..V;.V..V;.VRich:.V........................PE..d.....qb..........".........................................................................................................................d...<............P..8C.......K......0...P...................................................H............................text...8........................... ..h.rdata..............................@..H.data....<.......@..................@....pdata..8C...P...D...6..............@..HINIT....p............z.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkd.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30088
Entropy (8bit):	6.6610493106344535
Encrypted:	false
SSDEEP:	384:XsxgFdjvyZZOie/k6h3KaJpQtR9zus2+UUnZsHLO8d6GsJck4i/8E9VF9Q1:XkgFdjvyZZOieb3K6QP9zueE3kreEk
MD5:	753DDB93CB353C4B667C44260F80C89E
SHA1:	D4B24F485777307FDDF0DA4248021C83027154A0
SHA-256:	3BEF5A6479FAF5A8DDEE51F1ADD028FC4650BBA9B26288FE49B4448444D8EF97
SHA-512:	91A671AD9C2AD3F3B9BBA5C6903CF1D8F04AFBA66BD3A8C651BE01FCBF49E3948D0D808EC0AD07386FF62CAA9F8E0AF1E12E85F367F38C0338A04A1B6B405AEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..4...4...4...4...4......4......4......4..m;...4......4..Rich.4..................PE..d...3.qb.........."..........$.......P..............................................L......................................................lP..(....`.......@..........K...p....... ............................................... ...............................text............................... ..h.rdata..\.... ......................@..H.data........0......................@....pdata.......@....... ..............@..HINIT.........P.......".............. ....rsrc........`.......$..............@..B.reloc..V....p.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphku.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1681744
Entropy (8bit):	6.82846077353633
Encrypted:	false
SSDEEP:	24576:AX6gIs3/IevRBQa8p3oWxUp1kPaHeGeizSs93j1esf1uJFR4Xy+N3amR2ADmZ+4G:be7CZpxM1saHeiz9sJT4TKmRD
MD5:	AEDFAF7F50EA15EEAE8ECDB1EAAD922B
SHA1:	74B8263BD10BBF2DDE3335DEC4D5319056B6B849
SHA-256:	1E13664B5B43298F8045C19E350CA34F8653BCA08A87202EBEFAE18F670B7686
SHA-512:	095F13F5EBF18B642062C8B4930DFFA1198803A89359B32529209047DE1DC90CD969E713B853C6C25BCFF9535A6D927F696EB5F0EEBA16C7167548978BEEFCF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u..u..u.9....u...t..u..Z...u..t.!.u..Z...u..Z...u..Z....u..Z...u..Z...u..Z...u.Rich..u.................PE..d...A.qb.........." ................@>.......................................@......................................................P6..A...t#.......0..........D(......P#..............................................................x............................text............................... ..`.rdata...F.......H..................@..@.data...@....@......................@....pdata...'...@...(..................@..@.detourc."...p..."..................@..@.detourd............................@....UPX0....V.......X..................`..h.reloc...............n..............@..@.rsrc........0......................@..@................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\medvphkuw6.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1038672
Entropy (8bit):	6.916221327981851
Encrypted:	false
SSDEEP:	24576:Nh/J9GdXHSQzdMitDhQzTvqyT3PAJZqZ9fnNgHB4s745:f83SUMchQfyM3eaRNCBs5
MD5:	B51CA53F18CAF267A6913A7377A64F14
SHA1:	9FC53AE7E0FA52A035AF5AC0D12B26CFF08EACBF
SHA-256:	1A4DE61B015AEBBD7BE9E96D0E47A83DAD2296FB19991D9B0F433A7B7166AA07
SHA-512:	4A2FE610AFC7A9BBF48698DE1DDC720A26D5998F4EA298B6A0F64D864818E6E10CC5DCC696689098F86A922BC61BABED9523F887CBF13A56D88C349D32C89D65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............rvZ.rvZ.rvZ.nzZ.rvZGnxZ.rvZS,w[.rvZ.}+Z.rvZ.rwZorvZ.T}Z.rvZ.T\|Z.rvZ.tpZ.rvZ;RrZ.rvZRich.rvZ........................PE..L.....qb...........!...............#;.......................................P...................................... ...A...p........@..................P#.......4...................................................................................text............................... ..`.rdata..a#.......$..................@..@.data...........p..................@....detourc...........................@....detourd.............<..............@....UPX0....:.......<...>..............`..`.reloc...4.......6...z..............@..@.rsrc........@......................@..@........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mfc90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5102400
Entropy (8bit):	6.535339741970271
Encrypted:	false
SSDEEP:	98304:RyPTkdgKaQ0cAneLY6ODI0CTwpFLOAkGkzdnEVEFoKGj:8PTkpaQ9A6OFLOyEFoKGj
MD5:	E9017D8024BD96E95791DB3957C4230A
SHA1:	BEDE8B3D956308D29BFF23D252451D14D37942F2
SHA-256:	ACAC07A57604EF73B013F127CA39876B4F33027102819214389F9B2652E0BD9D
SHA-512:	CF99D660B619AE037C952E1F574B8D38F031E70E56046863689510F183687F48C36D2DAEBBB31B25ECE4FC7D99DC3A1A32C1973F793EC4915C9D10701353ABFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..........q......q.............~.....................q.......................I........................Rich...........................PE..d....gYJ.........." .....Z)...$.....\|.&........x..............................N.....w`N...@...........................................7.'...`q7.......<. l....9.......M.@.....M..F....)..............................................p).X...pK7......................text....X)......Z)................. ..`.rdata.......p)......^).............@..@.data...(@....8......h8.............@....pdata........9.......9.............@..@.rsrc... l....<..n....;.............@..@.reloc...u....M..v...NL.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	571920
Entropy (8bit):	6.671628577535569
Encrypted:	false
SSDEEP:	6144:Q75WD5X9srthVNv5Rb97JXJ+/6KXsDLsari6+hnKZcSjaERsMi5Y+kG/IPNqqDL1:80JMVjJXJ+/BmpfaE25zkpPwqn6miYrl
MD5:	C183D08777D542CFE28098867E0F2DDE
SHA1:	320FA6267BE6129F1E021F611E2FFA037B2B1DAC
SHA-256:	55C5F612E528C078CDCA7C1C31B335FB6EA6C47DC00059D5C2D81ACF0D56A646
SHA-512:	98B167AB38A0A5EFD193E73EA744197441573854D8B81669F4BEF893548119360EF1EF12961F598F04FA7CA79D77731313F577A087E581913F517718841E5968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......&..b...b...b...Ec..`...\|.p.g...k.g.`.....b.`...k.a.k...k.w.l...k.~.Y...Ec..x...;..a...b...)...T...c...T...f...k.p.X...k.f.c...\|.`.c...k.e.c...Richb...........PE..L.....;c...........!.....,...`......N........@............................... .......M...............................,..f.......@.......@ .....................db.. F...............................................@..h............................text...........,.................. ..`.rdata.......@.......0..............@..@.data....D...0......................@....rsrc...@ ......."..................@..@.reloc...d.......f...*..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd2564.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	476184
Entropy (8bit):	6.283492144559428
Encrypted:	false
SSDEEP:	12288:Sw4CZC80E00oTm3iQAtRW0/ODqn60YGkRS7:GCZC80E00oqLWRW0/A+60YGkRQ
MD5:	3B167AE252826FF85249B7CF5F104033
SHA1:	D889ED12176F76C81B15C9BA0AD3650E49793E57
SHA-256:	BB72645F36DB837107F226F3A835987EFFC5A863D283E5DAC1E7F07FDE430A78
SHA-512:	E7E97F9EB4453CE6018FC0A88303B8168092E75A2E937CBF5D6B5C691FE35659218A02C544143D58201DBF154F7EA81E870844A9C2E390F2CE032DD6BEDB8951
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......".d.f`..f`..f`..A...d`..x2..c`..o...d`.../..d`..o...d`..o...k`..A.q.}`..f`..,a....d.g`....g.b`..o...\`..o...\`..o...g`..x2..g`..o...g`..Richf`..................PE..d......c.........." .........(......l...............................................%...................................................h...p........P..@ ... .../.......*...........................................................................................text...>........................... ..`.rdata..H...........................@..@.data...H<..........................@....pdata.../... ...0..................@..@.rsrc...@ ...P..."..................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427536
Entropy (8bit):	6.671052014150009
Encrypted:	false
SSDEEP:	12288:nsS6ZvuTiw44+/rC6K+jcWdbvqn6D5V4znT:nsfFI+jcov+6DzqT
MD5:	3007E804DE23491A96C3A681F56B569C
SHA1:	42F29A4B3805F7C9D59E37B050B28F59721EF395
SHA-256:	4584522D37CCC1EEDE115BFC6A34A0BF6EFE6D5AF3B0EC2444ED86E31F48BBE8
SHA-512:	79EF37C8D50637D867D19E4DA991CAD77AD74A7EE7059A8E1117922E171F3596EA7E3FDF6F1894D442F93BA7C89006842BF62BF1AE5106457B691C31472533F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Hy..Hy..Hy..o...Iy..V+c.Ly...6q.Iy..A.r.@y..A.d.Gy..A.t.Ly..A.m.sy..o...Qy..Hy..Ax..A.c.Vy..A.u.Iy..V+s.Iy..A.v.Iy..RichHy..........................PE..L.....;c...........!.....(...0......J........@......................................4c...............................,..R.......,....@..D............\...*...P...I...D..............................0...@............@..\............................text...Z'.......(.................. ..`.rdata.......@.......,..............@..@.data........0......................@....rsrc...D....@......................@..@.reloc..LK...P...L..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25def64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	537616
Entropy (8bit):	6.368155160902403
Encrypted:	false
SSDEEP:	12288:0iKzfU667slsP4sssssssfWgs0d6kNGccqn6erH2D8:0iKzfU66igs0hN1c+6e68
MD5:	952976C7CA9AEFD280D1FBDCD2D57FB1
SHA1:	94EE25A2C165318F5B5CA17B15C2E187265BD224
SHA-256:	62B803C81C3BE625D28EA74A679AA09A1F36EA3575F52AF43596A3CDB26F4520
SHA-512:	220EDDDE70B9DFD13CB1A25A72B3CACBAA0FB3B9F7BE82F917ECFE9D522EBD55967810BDA7413A0B8B6EC253DC1C9BB4938A7A469A2E17AD8550872CCDB89229
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[...\|.e.Z...E.a._....s.Z...R.p.Y...R.f.V...R.v._...\|...B...[...S...R.o.a...R.a.E...R.w.Z...E.q.Z...R.t.Z...Rich[...................PE..d.....;c.........." ........................................................`.....................................................p...T...0...,....@..D........K..........P..(....I...............................................@...............................text...l).......*.................. ..`.rdata......@......................@..@.data...............................@....pdata...K.......L..................@..@.rsrc...D....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343056
Entropy (8bit):	6.646382184012647
Encrypted:	false
SSDEEP:	6144:Lk4wsI5/1WuC3Xz+/o4q1FiWqqDL6/e5UO12WPTp/h:LtrILWuIXz+/XTqn6/K/h
MD5:	3D13F50ECF41A48FA63530266080D951
SHA1:	545ACC5EC58D4C218AEAC56A8582E9836E968B7C
SHA-256:	B8144FA92B9DC000D7FC86450CBE9F74B629F75612D4F3C7C5744BD7D66C1FAE
SHA-512:	060084943340DB957D711DEF3106F2AE4719427B4860F98A163B639929019DA4B596BA3B7D80191A5D8436839B387F07762CF2BE3AB1A2A47A642AACF0998B17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..A$..A$..A-.1A&..A..4A%..A-.7A#..A-.!A+..A.\.A+..A$..A...A-.(A...A-.&A0..A-.0A%..A:.6A%..A-.3A%..ARich$..A................PE..L.....;c...........!.....,...................@...............................P..........................................................,.......................7..`C..................................@............@...............................text...........,.................. ..`.rdata..L....@.......0..............@..@.data...\|...........................@....rsrc...,...........................@..@.reloc...9.......:..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd25sdk64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	295952
Entropy (8bit):	6.292791397896024
Encrypted:	false
SSDEEP:	6144:vddgmt+uNBY4v4N+VxJJCKqqDL6TT6ZpOpezPTTp1X:vddgujogtA/qn6TEp1X
MD5:	810CD8841CE2C670F564F4D94977C9F2
SHA1:	61B5592FB4D77CBD306E2CF0ADF756FEEC2EBC55
SHA-256:	5EFC3B6ED3C93E4B8FAEF0A5C5500150ACBC914FB588E9B9BAB6127F2E974DBF
SHA-512:	322760286CD53ADD4ECB6165DEDAB0A50C26F10B6212CE65218971D6D5E342C40B2019A8793C51093A89E771EBCA6E9DE1572EA70A7A24B3AA0998522058643A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k:../[.P/[.P/[.P&#%P-[.P.. P.[.P&##P-[.P&#5P#[.P...P [.P/[.P.[.P&#<P.[.P&#2P;[.P&#$P.[.P1."P.[.P&#'P.[.PRich/[.P........................PE..d.....;c.........." ................Ly..............................................................................................`X......XK..x.......,....p..,....Z...*......4....................................................................................text............................... ..`.rdata..............................@..@.data........`.......N..............@....pdata..,....p.......2..............@..@.rsrc...,............J..............@..@.reloc..n............T..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mkd3kfnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235952
Entropy (8bit):	6.443902757897077
Encrypted:	false
SSDEEP:	3072:VlCkIpe5GlTJUCdowx3tf1RCSQZ88rNiR/XFunPuOAk6SfENamKBRV:MpNLDtf1kf68JmXQPuOP6uj
MD5:	8ABD5664A08ACFC33E4200B8F7A4B289
SHA1:	3E2598194066DC9C3700B3B7E7AE92E5DD6C112A
SHA-256:	71187C37B27B4B99954C44A963D141F111561F37888B64BF9559A4D5AFACB001
SHA-512:	1F0B43CE332405B7453C0D5490E805A6EB1B51472CC4408B5A0079CADA0AB24AC8559DCFC6DB231458F061D4D57F094DFE58389EF91410A5C2D7796A22F36E41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;.l.Za?.Za?.Za?.Z`?.Za?.>`>.Za?.>b>.Za?.>e>.Za?.>d>.Za?(3b>.Za?(3e>.Za?(3.?.Za?(3c>.Za?Rich.Za?........PE..d......b.........."............................@.....................................\|....`A....................................................(............`.......J...O......<....&..8............................&..................H............................text...J........................... ..h.rdata..,...........................@..H.data........@......................@....pdata.......`.......&..............@..HINIT.................:.............. ..b.rsrc................D..............@..B.reloc..<............H..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msg.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1666496
Entropy (8bit):	7.999895263234597
Encrypted:	true
SSDEEP:	49152:CtGnBjvyXRVdxgrPLvORcEKrxhh9ILt1kBDoNclZG:CQBjGIrMcHlh/IPkNoNUG
MD5:	A2084E2E1971E61EC04B1D6F19AB833E
SHA1:	093DEFCF3432EB51449C355DFE00836DC201C8DD
SHA-256:	8FA1CAD5599A318702DE04861AA8952A4691CD067737588F459EA37836E28ED5
SHA-512:	16AE5E8AFE92F5465241BBCBD2EAE2BE5F41271F277066EBB7DE885B98253A645BDB71FAEC08DA0BCAADA3A8E30BC319D8E693B315C42A79DFA24E8D647D51BE
Malicious:	true
Preview:	Ai...$...m........r]U......b)....S>.4.{.....8...=..p...$9)...m.J..M....K,w3....i....kh.o+..e\|S..'.H=.y.5_....V..V..~_.F....I<...Y....t4Z..i...j....9@6.v.H..q%...Z..9..(... 1...8;......y8;m.5.x8H...HO.5.wm.=.-x...f....R.....tU...>_-..(d..+.?~.%. T(.A(().MD....g.zu.8.yEK.HW.R...>.8..\|@}P.JgK....1<...R......@pW....&N.B..V......ej.b.wy"2.9l.5.T..../.......B.J....jQ....q..)...Rx..O.qc.\|.d.5...O...t...]..a.y+....d.<r...o..vVt..N#......./..4>......i.>......p....b..E'4...[...U...cE..W.=..b...5Q..CTd.e.^.\|R.5K6.'../..s.?.$.... ..St...&.....Y?#`....\...w...'.uPh34P....2&.B..\|..'{...d.4..............H\|...w#.I.A.H.^.....e...qD....h..............[....P.......W.jn.%.....y..u.3.....k.%o....z.m._.!..n..3v.3<.........D..s.%\...."rN....q..{."R....aWj...y.2iq.M=.^.~....a.$.."..@N.......w.......]Sp.@s..I....N..?p....2{E..n..Q...f.......G....J.....Z.#.A...(......y...Q....}....Bo..X.\|;....7......u....$........!....0.....\|.r.P..}....d.Z..)D..q.......Y...L

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcm90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.009895182248049
Encrypted:	false
SSDEEP:	3072:IiN/Dv33XymC2FL/uqll+m2a1tQ2VQOkd61IvwSRm3+rYOpcWRq:IOD3xLca1t7VQPd61ORmOrYOp7
MD5:	E6E1B7ADEED68FC899703F79EF980401
SHA1:	D6BBAA17BFCBFA6D6DAA7255B1C68EB4D44D1C81
SHA-256:	C18ADC99C097230222063AA264D69841183B949EBA5CD51C73B73D4011EB61D3
SHA-512:	2DD151CFD8174250FE0217EB4E22914AFD14EA9A9FF35F4424D230191917066C79CCB8057D24C476E8722A3EB119CEA4F6D40C4494CE15206327BC156588305D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S.n.S.n.S.n.Z...P.n....R.n.Z...R.n.7...Q.n.t<..W.n.S.o...n.Z..._.n.Z...6.n.Z...R.n.Z...R.n.Z...R.n.RichS.n.........................PE..d...MNYJ.........." ..........................Hx..........................................@.........................................`.......\...d...............D....................0............................................... ..@............0..H............text............................... ..`.nep................................ ..`.rdata....... ......................@..@.data...8...........................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	853312
Entropy (8bit):	6.345193364377354
Encrypted:	false
SSDEEP:	24576:ag5ni6keQ77yaNSroZMESNwDEKZm+hWodEEF8Z:asn39W0
MD5:	DFEF29DD8EB0542C31469DE7C5886053
SHA1:	41326EDC6B6DA6DF2184292D19E94D7978F8629F
SHA-256:	7EE97643CFEDA8A79B7CAFA5EF3A010B2F85EF868356D30D7EE09AF8E85FF38A
SHA-512:	6A714CE91DE7FCB063610908B68FF4FE6781219DB2BB1EA3E370FBF52CFF4639CFDA845BAE57A8DB0750E6027CFB591F943F4793C0430E6EFFC221EAA077B0B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..c+{.0+{.0+{.0...0){.0".~0({.0+{.0.{.0.4{0{.0".x0{.0".i0.{.0".n0.{.0"..0{.0".y0{.0".\|0*{.0Rich+{.0................PE..d...CNYJ.........." .....N...................Rx.............................0.......T....@..........................................C.......6..<................q......@.... .......f...............................................`..@............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data...P9...P...&...B..............@....pdata...q.......r...h..............@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcp90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcp90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.630453563750433
Encrypted:	false
SSDEEP:	192:6IYiYF82M34qFIIauV+noPOJB3hy2sE9jBF0NyPIjwlKpE:6IYitv6jPxh8E9VF0NyP+YKu
MD5:	7477778473856EF6AB1A747658FFA704
SHA1:	CEF501CE9BB0948B91EF33D999C5221D432D8F24
SHA-256:	06D2088C3C3D4D31ADED1B7E98398869F36D12235072B3308184A65177104FCC
SHA-512:	A8BDE84DB21C5CF033807B7E9E20B2934C058C02DDFA707D42849BD9CBAAEA3E485934B8ED45063A58145B2022623533938FA9C54F571440F0E96CD09CC04B25
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcp90.dll.ahf..V[...3,671F007C30C1C0D2D847465AD3FF72A2649825F90.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... l..,$/.I."5...wSph2q.a....4.F\|I....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	761152
Entropy (8bit):	6.9097717021149965
Encrypted:	false
SSDEEP:	12288:TYhr4bCLI2kwAWEXqKDkoKsiYxem5GQmLuEs0NIL2fLiFHSt6mRy3jVRwB:TUIyAWKDkoKsiuem5DmLuExNILQOFQ6e
MD5:	53E17C3EEDCB0479971FBBE99FA9C0A0
SHA1:	87E3E49CF24EA5762E8E4EEFDEA750D4E365907D
SHA-256:	990EE8BCC6DC60FCE2F5D91187322EE13939B6212B6C617DD95AC4117A7F2BF3
SHA-512:	B8DF5005596340E07C742D33CCDB6E1D0E1F8053DB1C9360B32CE84C9DBD7FB22AE8643328990311BD9639DF47FEB5BFB1579E8FCB56E9965981A8234533224A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V\.X72.X72.X72...I.[72.X73..72.?x...62.?x...72.?x...72.?x..Y72.?x..Y72.?x..Y72.RichX72.........PE..L...W..I.........."!.................j.............x................................pf....@.........................0f......@V..(....p..................@.......\|J..0................................/..@............................................text............................... ..`.data....^.......8..................@....rsrc........p.......0..............@..@.reloc..0Q.......R...4..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	624448
Entropy (8bit):	6.583477769791977
Encrypted:	false
SSDEEP:	12288:BIyThtSXwAnAJGaAx8eCte8P8qhzNZppK5E2WeAI99aWmqy7QMz:BIyThEXfn+G9zCtb0mpc5E2WeAI9mqyf
MD5:	E4C2344E31D3C577FB2723C961069858
SHA1:	572F0281081BBB7A87E491D32B4A29E2447CD75E
SHA-256:	4546EB9106E86E471CAF0870ACDD4D1FE34C2AD293F596FD55B82215B922AE14
SHA-512:	7F35D0F0BF6DCFB44A1CD7E07F95536010690722FD28D587450F158F87BE0913F210B06EFCEB87D63BDAF4DAD4ECC09A4CF7397F64C5284A36579A133CFD5BA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................'..........r....B.-....T......E.n....S......U......P.....Rich............PE..d...=NYJ.........." .....p...&.......&........bx.....................................\|....@..........................................q..Cx..._..(............`...D...p..@............................................................... ............................text....n.......p.................. ..`.rdata..Si.......j...t..............@..@.data....d.......<..................@....pdata...D...`...F..................@..@.rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\msvcr90.dll.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "msvcr90.dll.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.636438381503087
Encrypted:	false
SSDEEP:	192:nIYiYF82M34qFI2PO9BT8+noPOJB3hy2sE9jBF0NyAelnivhka1:nIYitv7W9BThPxh8E9VF0NyAGn+hka1
MD5:	5A5824134E91A727AB73ABF5F50DC440
SHA1:	D125B71DF4EA4C4861D104DECF2A2ACDDCF123E5
SHA-256:	35E8F87634978ECF6EBEB7C4D380936E757A1B1843464AFE4D093C84C8A41580
SHA-512:	490D645983D9087F295E74E68B0FBFB1258500FAF39E0739B18116601E0326E824657B581E0DD88B05172D57EAB53F58DAF98FEBA1A5E2DA4E614785E1C33D45
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU.`.msvcr90.dll.ahf.jQ ...3,553D6AAE83B2593DB866C7F9EF34A96187F6906C0.G...H........80.4...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ......%..Vw....7kh.%pQg;E..R.......0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\mupdate2.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.56995557944874
Encrypted:	false
SSDEEP:	12:accOzWKm5cFon2GpQtR5k/x1YmgQ+ptNtLxQMudq:ZWd5cunhatg7YI0tHl4dq
MD5:	3065EC9B71C89C655CAFFB88B3EA143D
SHA1:	F3071EFE6D53644EE63C06AC22B2A91F5DF16E19
SHA-256:	246F61291D7666022A029CE5BD1C328B0C20BCC3C1F2E56E432BC8737C7EDE53
SHA-512:	5BB616EDF28675CED6FD40E671DC2D5F12118FF215BE27F1F838DFCBAE165BDA319F963932CBBCEB6233BCE88FDBF9DD55BBF9172F138CC5EE628179E6BD0126
Malicious:	false
Preview:	.%~^.c#w{.=.-.v..2......8....._x.....z."\K.1/o....%...P6.....D./.`.K.@..^Cv...8F.K.......y.....e.{.a...!........u...,._\.H.$.L...(..d..A..7j..2...#.tb..{.h...-.A.9%....~.g..h..f.H.F...XN.:Y.8c.9..yZ.....c..1.P.[PC.]...)..2..T.'....\|.....G.....X...e'.s-?@.2_......T.....(OC.WS.;.....-....7..{EIN...>t.'W........~W..G...~.\|1......i...b..2..Y....k.w..8..n..I..A..58.w...s.=.Y.c...Qf....O......8.dM.E.....&A#.6.k...Y\|.Ao.5F...O...D...q.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\netizen_ply_default.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 7101 bytes, 1 file, at 0x44 +AX "netizen_ply_default.html.new", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	22757
Entropy (8bit):	7.394463474354784
Encrypted:	false
SSDEEP:	384:AE42fdL8L81cwmdCggNsijDRfKa1FaZ4y7wa+pYQTbkZRKOBxQUdtt1sp23+r/j9:742l4IgdbKZ/FaOyU1Vbk3XDsp23+zj9
MD5:	0DFBA33282D828A1B5EE96B1A8B98B1B
SHA1:	B6046CBD196A878B7D45DEA3DD5FBE04254A6F2E
SHA-256:	CD1B42FBD3EBAF46665CBA3BEC0594B235AF81EE89ED3E4E5D3EE8561082C30E
SHA-512:	4450D992AAEC6131FE887487FDD4AA7BAEB63207900DCCED305757E8E55DD5858D4DB8FC1E93311BD3A411CC04CC8CA61BBBD17D8A4CA9249A8775082C566ECE
Malicious:	false
Preview:	MSCF............D...............................(=..........q.......D..........Q.U`.netizen_ply_default.html.new....D.D.....gqssyJ+f/F9qu8sxVUW57n77GnppHqVmjqnOjnjIisc4PSVloeqUAqduPSx5Af0c5JBBL6AK16QJSwEgEn0lBtMdgV6HIjvyQzleefTpYKacY0VBjet6kbc01ZnjlTAjpJBB231PWANtzR9jqlqMl36GoN7laNoxBpyZ9aGISfjzY1yl4vOnsJiU4rgCgTfk7qmZiDhaPrXe6DT4l9ZeO6T0NVbcIthSt+l3Hth0F3ZB5mT4GPtwQgvYFtBQGZmL8owiSgPgQSbpJ3daHOwSaRzf0L0VwfNwCrbCYlrmVVa+4B0j4oJcYatAmTGwnzrZ9m/1UR3ntfNyMilSTy2VqXnuu7R002mIf5cSUNFEDK7LJW22B/ZIYfYzI187zGTnmqbI19L4loAaWocWcL30bR6nJ9p8LZ12SfNwdRXN6wRwmTuR1tu3z2WoT5qP/EDQxsO8jWrADpwqiqsRMCGFm3G/SMW3f/LQwT0GKbxB3Ivy6T2TIl7hrCahBnXsW+16uMT4MwGO4XMAOTAccHdtGt/w3b4/B46m3FlKTqPIIb30PP1Iq8SJkDFJCY31BBPg4numUa+wA3PgaxqoeVEFczX45Sv/KmYMqQZ4EG1/jmmIvz3U48AoCqLf8Rg9vD4F3+uI39pQnMILcMLhUeJMvHR4NLex+gVydU4r5YKw9rmHGf52QTSc1KMrmeB6YKU+MEZuWZybN99h1ApApg2ddFLVhKoub0hl9t5MnKu33eN2gDp/epdXbCeHnFyHMiNO64oIbL4rMOHTsZy9kEy7/eATwhgiM5v3N1NPmPpf4QRfuZz7S8lzo2PmzXMyU4JiOZyVmWDVM9kz3VTIOjvdbFckbTFIafQoenHFRhluYX3

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	6.523188898405281
Encrypted:	false
SSDEEP:	24576:uN/cDx/LcwkjTGAq8f54Y6ifuGJk3c8IXRvg/W68IALE/ZcaFL4FzS17BAw:6ci+m9LEazS1
MD5:	A1C4628D184B6AB25550B1CE74F44792
SHA1:	C2C447FD2FDA68C0EC44B3529A2550D2E2A8C3BC
SHA-256:	3F997D3F1674DE9FD119F275638861BC229352F12C70536D8C83A70FCC370847
SHA-512:	07737AC24C91645D9B4D376327B84CB0B470CECBAD60920D7EE0E9B11EF4EEB8EE68FB38BF74B5D1F8817D104CECC65E461950242D940E8FF9CA64CE9D3FFBB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..............T.......Y......l.......[..............m.T.....\.......].......Z.....Rich............PE..L....A.O...........!.....2..........V;.......P...............................p............@..........................z..zb...Z..................................TS..................................0Z..@............P...............................text...^0.......2.................. ..`.rdata.......P.......6..............@..@.data...............................@....rsrc...............................@..@.reloc...\.......^..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssckbi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	6.863300763286356
Encrypted:	false
SSDEEP:	6144:eeP90QTcdMTWfpUwFygo5zUM38ME/Hs3nXHkUX:eA/TcWTWfpf0gmzY03nXHkUX
MD5:	D1243817A1B22B855DE0852CF5B53BF5
SHA1:	C64F4851A2FCFE8D1E4A5B5743498870B676755E
SHA-256:	93E99CFBA00348BE3A102DC9F41ACD39BBA91D7F4E0149A9EA6C53FCC50ADAEE
SHA-512:	59ABD87F8DA58F0F4D8D3919A84B2E4FA853AA0E76DBFEA3BC011E21267909ED7C3BB42A714F030773767329A8D3DA0810E789AB5A061BC0E4452159849C4CC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......??fs{^. {^. {^. r&. y^. .(. z^. .(. y^. .(. r^. {^. C^. .(. R^. .(. z^. .(. z^. .(. z^. Rich{^. ................PE..L....A.O...........!......................................................................@..........................6..P...L1..x...............................t,...................................0..@............................................text............................... ..`.rdata..07.......8..................@..@.data....T...@...R... ..............@....rsrc................r..............@..@.reloc.../.......0...v..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.45689405407938
Encrypted:	false
SSDEEP:	3072:ES2ipxnUGhrFxZHkZvmYHG+iI2iV6nu+ZfX6AKVqzzF+:ES2ipxUSwv/m+1rAKVqz5
MD5:	051652BA7CA426846E936BC5AA3F39F3
SHA1:	0012007876DDE3A2D764249AD86BC428300FE91E
SHA-256:	8ECA993570FA55E8FE8F417143EEA8128A58472E23074CBD2E6AF4D3BB0F0D9A
SHA-512:	005B22BD5A4CCA9930C5ECA95AF01FC034BB496F4E599CAC3F20B0B9CE0957B4DB685B8E47977E5B289DC5CF1C8A81F4DD7434D0347E41D008E2C8F7F12006F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D[...[...[...R...Y.......S...4...Z...4...Y...4...P...[......4./.z...4...Z...4...Z...4...Z...Rich[...........................PE..L....A.O...........!.....n...:.......w....................................................@............................................................................................................@...............D............................text....l.......n.................. ..`.rdata...............r..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nssutil3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.44977499578729
Encrypted:	false
SSDEEP:	1536:W3Hq5zbjpPQ4Y0epuuwCbDz5xAFKL8kycL7:gHQxPQfGuz5uFKL8kyu7
MD5:	C26E940B474728E728CAFE5912BA418A
SHA1:	7256E378A419F8D87DE71835E6AD12FAADAAAF73
SHA-256:	1AF1AC51A92B36DE8D85D1F572369815404912908C3A489A6CD7CA2350C2A93D
SHA-512:	BD8673FACD416C8F2EB9A45C4DEEF50E53D0BC41E6B3941FC20CDA8E2D88267205526DADB44BD89869BD333BF7D6F8DB589C95997E1F3322F7A66A09D562B1DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................`....C.k.....m.....X.....o...........Y.....h.....i.....n....Rich...........PE..L....A.O...........!................p.....................................................@..........................O.......F..x...................................................................0F..@...............l............................text...~........................... ..`.rdata..............................@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nzcmncfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.904375764569563
Encrypted:	false
SSDEEP:	48:kFjgEgFdFy47RaOyNRVpl4nklxRTBia/ep/tn7ZYLsX:k6Eyy4wVXTfGRt7/
MD5:	5CC424F65E490FE65BB4613B7AA6EBFA
SHA1:	FEFF5751D5B9E4E9C04EBC2F9BB2E7B0C7779B23
SHA-256:	4F0654EA77519E62E61112B37485EE41623838B2B7DAFCE171D1178C68E2ABA4
SHA-512:	8062326B953A7416D4E2DCB69AC644DDE020E1E407855E5CFB31BBBE5E061F2382A52B670B28595C23C5B06C80B4981CA8BA8B339A1E1B66900342FBC495476B
Malicious:	false
Preview:	M.....td..O?.$+.....@ ...]....{!.{,...6 I.\....QS.(.B..2.j/6..i.F."..JYT.J.wcR..}.j!.,}[Q..8'.}{Pg.).....:..uy..Y(n....J..Q.a...S...3....J7..........R..k85p6.n...H.....g..W.,..#Z.._.q...\|...V"..d.........bv......x.:.-%.g.L".b....>>32.;.....:.]....`J.'..#.0.<3...~i..e&...C..M?7~.....N...[g..H...B......f"N'\|X..... ....\|[.;.Be.......=.(...3m....q.DDR.`....7B..+.4i;.........`.U.....\.5U..H..S..=.r....2.....0%...].Yj.).U..P;......avjU...d..n.....M.8....R..a.....j8 a($.5HS.X........&..w.:.u..S..NsFg.m....--....z...,...v.c.j..(1f.`..:X.6:....E.x.Mm....[.3ZK..).<$..A....4..^(U..m...w.*.p.......O. ....j%..6....._.4......y/0...G1T..=N.......=.+&S....c......I..2..~.bF.z.^::..i....8.[...!{.ej..Z0.....Q1.M.z.r..F....\C..Q..;...O.8...j...h.R..I..<..bS.w..i.b..Ud.....H8...Z...(.....#...,.@.......i..so.P{o.^.....d.U.......E..x...'.Hj..=...(...z`...5p...o...=\0.@.........[.......\...e..GA....H.;.uZ...t..0..."o.{...:.]K?F.S..k..E.A..-.Z.MM.U^>..t.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\nzdefcfg.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	7.967854076429251
Encrypted:	false
SSDEEP:	96:joely5G1ZepCvAaLRSMet/54T6J/yOVI6j3NBiDY8ovn6ZIl/jZqPrCjyYGd:Eed1wjaLwxt/OGJfVI6ZBj8ovngIlLZQ
MD5:	2B09D3FD0FB7C2710E79D3E95F35D776
SHA1:	67D36887CC8E1B7E6AD4F36B774811872765D40B
SHA-256:	DBE3AD374D83B5B5C3C6235F5E567D37A36DDDDAB00474293DE3AAD236E8EA0D
SHA-512:	2360DA35F3FA8D8EFA502FDF5B2F713700E109E7191E1CDA30AAFA43CA3FCD5E23E205D359AC4E16ABCA2D044AAE7DDFD778F2EEF9A4C79B504868AA34F7CFDF
Malicious:	false
Preview:	.;=..mYv.u..s..z.....@ .^P.1.I#....^n..\|_uua1c=...^...C.!.C.a...d.A.....?.!.O.....7.....R.DZ.B-...?i.q.^.$.6"\.N.e])..$.0....9. ..f.)..}...G......j........xO..Nzw......s.m.?j.I... .p..j<.e"...R"..(7:.......r../..H...).g.....}......._~ ..'..6..j...H.]... ..s2I/2"fs.................P..a=...X..D.......R..T..?65._).d.[l...?cA......4.b}..zc.j.~K..#....A....]@.\|.......xT...z.>.G...M+..2Q.F.f:...l_...C..E_.9.....m...).o.p.K..%......6......... .w.....I.....hY..,f.......&.L.QD..........?.\#..^@.8<.....uZ..n.+...3..........Y....(N....`...H.....A...@Z.#.{....~.)..q?,...1....%.b<.$_E.......u.d..]..D..]z.\|...........K.6R(.....?......g...N..p.....$te..G.o .:I.......z....WG.....x..-../.X......s..a.6.1.cmObQ.R(b..rg;...zQH @..).c_...D..ORO./_.[c..........V.T....I~$.2A._.G......ZoU.....C..V....f....T.Y.o'...,n....W...+.....)..(r.G.....3qf.....cn.@....\...7..(....;...B...Ts.i.....O.2g.......'&i....N..s\....bl...s.U..r.vQb...)...b..A....f._.w..`j...&.L.kW.....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ply_ver.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 137 bytes, 1 file, at 0x44 +AX "ply_ver.html.new", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10969
Entropy (8bit):	7.630007816314116
Encrypted:	false
SSDEEP:	192:8IYiYF82M34qFI2Pc+MKGMz+noPOjlGy2sE9jBF0NyPPVo1TSn:8IYitv7E+CXG8E9VF0NyPPVo1un
MD5:	03A78704029E1E80BE633F0AC89C7973
SHA1:	FE137FB036F946FCBED2DD12B78276B769E9F694
SHA-256:	FAE899E20F5AB6F766F51E7093063B63974B66FC323B0C0D6BFE8202895AD060
SHA-512:	73DF19FF4682556A7D721227AB4DEED7976A7C916A508919635D3D286BCC9DF035E0B958EA40B97D5DB550D5EBE73AC4020AEF1EC29555C93C42C616072E1BAC
Malicious:	false
Preview:	MSCF............D...............................P..........e.................4U..`.ply_ver.html.new.............dLBd6ido/t4Q1i+QnGlOow==0.G...H........80.4...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .;.G.I=...p@...[.0V......,"..010...`.H.e....... 4.U~_C~.........s.V..@....9.ReGp....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6f(_.s.&%....\...L.b.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158744
Entropy (8bit):	6.251439316264388
Encrypted:	false
SSDEEP:	3072:Obzd9NfQRQKZd634mGOfMqqDL2/z0Ay0rP/OlehgN42tV0Ml:md9kdNVqqDL6nOlehgN5Dp
MD5:	631BB12D4CEA2E01D072452E6BA69A26
SHA1:	7B03C8428D4CCAA902B1A0EE231E942874BC79B9
SHA-256:	C7A74CEDC9E04D79D2DE68EDBCAD9A96726C375179DC24D9E1AC0307CFDCBB02
SHA-512:	1900A618E89720A411CE13440557D5184CD68DC00E4EA8032088FD848522B6DABE184225CE99776DB07749AEA061A1C4CB4CB173FA54705100957945824FD032
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Io.(.y.(.y.(.y..zy.(.yMg.y.(.y.P.y.(.y.P.y.(.y.P.y.(.y.P.y.(.y.(.y.).y.P.y.(.y.P.y.(.y.z.y.(.y.P.y.(.yRich.(.y................PE..d...w..c.........." .....<...........%...............................................L....@..........................................!..J............p.......P..h....B..............X...............................................P...............................text....:.......<.................. ..`.rdata..J....P.......@..............@..@.data........0......................@....pdata..h....P......................@..@.rsrc........p.......2..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\powapi32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127000
Entropy (8bit):	6.637451680799637
Encrypted:	false
SSDEEP:	3072:OxFkfiu6gJJj/wqkx+t9uuMqqDL2/VvzOKhhi/tP8lIkjxb:CN89w+QqqDL6lOKhhilElLb
MD5:	C383051A03F98927B6317CB9A4C17EAC
SHA1:	524D1941CEE98A11DD080E0176B9628D4680A69B
SHA-256:	56A1302A9C8CC143386E4F8BD886938F2014E9851CDF3F8FCE8F411AFABDE7F7
SHA-512:	8C37C593CDBD105782C360ED8E6C7E53A99281E37B1947092D12E48AA56C9032032D46AD9C94B6A08AC0BEBF2B6F65E9B863852DA8C5D3D33ED59E8B1A8D875D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.3Fw.].w.].w.].P.&.a.]....v.].~...t.].~...g.].~...\|.].~...p.].w.\...].~...`.].~...v.].i...v.].~...v.].Richw.].........PE..L...!..c...........!......................................................................@............................L................................*..........p...................................@...............D............................text............................... ..`.rdata..<...........................@..@.data...`...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\product.dat.ahc

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 150 bytes, 1 file, at 0x44 +AX "product.dat.ahf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0 compression
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	7.626235361793961
Encrypted:	false
SSDEEP:	192:v/IYiYF82M34qFIIY0GV+noPOJB3hy2sE9jBF0Nya6lxwR:3IYitv40PPxh8E9VF0NyaqxwR
MD5:	2974E661965343BE2631CBA747AC2622
SHA1:	414842297E6C1804E272A7EC7E938698A93630FC
SHA-256:	BAC9573933158C513ACCC5198D66D12F400408D803B3D69467D8E097901C6AAF
SHA-512:	E62C1960746EDE5BDE62D56520C1824F6F34223584718161D3E4F6A6E1117D6F4DCB152811C5E2C0A76FBF75B4CEC3552EB7AEFC54D5BACCB72DD995C35E5DED
Malicious:	false
Preview:	MSCF............D...............................P..........d................DU..`.product.dat.ahf..'P~..3,2CAF1D09A54F4EA21FE06258A81FE3DC8D8872560.F...H........70.3...1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". Zfw4.{e.\M...aHPK.x....:......C010...`.H.e....... ...V..^..@.~....>.Y.G..>.b..#....0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\scan_ico_safe.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1730, resolution 2834 x 2834 px/m, cbSize 1784, bits offset 54
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	2.6656149053485154
Encrypted:	false
SSDEEP:	6:/86T/4m/VU+WB4DMPvWB4viLDWB4vWB4uJT4WB4SP4WB40Jve6PVu9tE/:/1TZ/kPvGvvv654uP4x6PVCtE
MD5:	593C9D49415B36127FD3D12B2D9A30CF
SHA1:	DA9DAF645C1E719C84B241648BEF67EF32434616
SHA-256:	81AAFFB9F30CB34D7DBCA9CD60523C4860F6D9CB49E191E275C7A6CC9724F1C6
SHA-512:	C3BF356CAD9005074D0298835CB9E24776E450A308E05354151D6353242306C288C0DF36254C3C9AEDB2E19FBC4D62676FDC26AA671BDADE47BCCDB2B734D0F1
Malicious:	false
Preview:	BM........6...(.........................................Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..d-.o..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z<.y......<.y..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..ZZ...............d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z......................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..d.............................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z..Z<.y.................di...............d..Z..Z..Z..Z..Z..Z..Z..Z..Z..ZZ..................Z..Z..Z................d..Z..Z..Z..Z..Z..Z..Z..Z..Z..d.........i...Z..Z..Z..Z..Z.................d..Z..Z..Z..Z..Z..Z..Z..Z.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\scan_ico_warning.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1730, resolution 2834 x 2834 px/m, cbSize 1784, bits offset 54
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	1.6978398005855406
Encrypted:	false
SSDEEP:	3:GvDllOlhlY6y0WxLW8f0SaaaaNtj0vW2Wejoz8RPeP8RPeO7aUl04aUl04aUl04D:/868fLmW2WejloEoOexxxNjs
MD5:	BBF8ABB3D8668E321485C5726EFF0AAB
SHA1:	ED0D96085A0DD20B7C749061BC3A2C0D1239647E
SHA-256:	E33E9A9E5C8EE616F4FE3C9899A7EFB26239711CBC2D69BA218FF9E89721CF55
SHA-512:	9A5AC6947A3455A6D50C90978B40B2FB577F52AC496F822D47E3805514C640EBEA03F6E37B4F0238A54D5D2086210B8C965C49BCF6369AA30BC689F4DE349425
Malicious:	false
Preview:	BM........6...(.............................................................................................................................................................................................................................................................................................................................................................................................................................................ss.......ss.......................................................................................................................................ss.ss........................................................................................................................................DD.......DD.............................................................DD.......DD.............................................................TT.......TT................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\smime3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.240650542976671
Encrypted:	false
SSDEEP:	1536:xtTRGG7+CF7k9QTPHkis9rGDE9tJ7kdsolb5XpIKz1TpNs6IRcgAGEFDGSs1f8b6:xGG6CF7k9QbHkCE9tJ7kdsW5Xh5s6IRV
MD5:	A5C670EDF4411BF7F132F4280026137B
SHA1:	C0E3CBDDE7D3CEBF41A193EECA96A11CE2B6DA58
SHA-256:	ABA2732C7A016730E94E645DD04E8FAFCC173FC2E5E2AAC01A1C0C66EAD1983E
SHA-512:	ACFCDE89A968D81363AE1CD599A6A362B047AE207722FEA8541577AC609BC5FEFB2231ED946E13F0B4B3BCD56B947C13837C1B9E360D521EC7D580BEFCBB0F46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6.k.6.k.6.k.?...4.k.Y...7.k.Y...4.k.Y...;.k.6.j..k.Y.....k.Y..7.k.Y..7.k.Y...7.k.Rich6.k.........................PE..L....A.O...........!.........j...............0............................................@.........................Pj..v...\N.......................................................................M..@............0...............................text............................... ..`.rdata...S...0...T..................@..@.data...h............l..............@....rsrc................n..............@..@.reloc...............r..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172544
Entropy (8bit):	6.496240878001019
Encrypted:	false
SSDEEP:	3072:KfHTwBGo4uYvGG3byHhQNP4IP/zsu9zvKwMNJ+Z/9tRpK:KsGTudG3GHhMz3SNY9R
MD5:	2AB31C9401870ADB4E9D88B5A6837ABF
SHA1:	4F0FDD699E63F614D79ED6E47EF61938117D3B7A
SHA-256:	22ECECE561510F77B100CFF8109E5ED492C34707B7B14E0774AAA9CA813DE4AD
SHA-512:	BC58C4DA15E902351F1F161E9D8C1EE4D10ACEB5EDA7DEF4B4454CADF4CD9F437118BA9D63F25F4F0A5694E9D34A4DEF33D40AD51EFB1CDEBB6F02A81C481871
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.e./.6./.6./.6.W.6./.6;a.6./.6.Y.6./.6.Y36./.6.Y.6./.6./.61/.6.Y26./.6.Y.6./.6.Y.6./.6.Y.6./.6Rich./.6................PE..L....A.O...........!........x.......3.......@............................................@.................................<...................................\|...................................x...@............@...............................text....(......................... ..`.rdata...O...@...P..................@..@.data................~..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.751461394308889
Encrypted:	false
SSDEEP:	6144:Cf41DoFqNI3Cm39XWYJkW07RlqHYOE1o2exosU8iZEJKvncrghAvLWDKnADA3/AF:DD76rrQ7ngYLo2MliPSghmLYk3/n
MD5:	B58848A28A1EFB85677E344DB1FD67E6
SHA1:	DAD48E2B2B3B936EFC15AC2C5F9099B7A1749976
SHA-256:	00DB98AB4D50E9B26ECD193BFAD6569E1DD395DB14246F8C233FEBBA93965F7A
SHA-512:	762B3BD7F1F1A5C3ACCDE8C36406B9BEADD4270C570EB95A05935C1F7731513938AE5E99950C648B1EACDD2A85F002319B78B7E4EA9577C72335A2FA54796B13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,J..h+.Yh+.Yh+.YaS0Yj+.Y.]?Yk+.Yh+.Y&+.Y.]=Yd+.Y.].Yj+.Y.].Yf+.Y.]8Yi+.Y.]>Yi+.YRichh+.Y........................PE..L....A.O...........!......................................................................@..........................J.......C..<...............................@&..................................@B..@...............@............................text............................... ..`.rdata..............................@..@.data........`.......D..............@....reloc..Z(.......*...N..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\ssl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	190976
Entropy (8bit):	6.662915165682162
Encrypted:	false
SSDEEP:	3072:82ya/vPWqodwFYAjkiV6vnjBr/WPUShgk04YZEnhacoAX8+FeHbnGmgjZzpTBfRP:j7JoiVGj+hIWNmKFpTBJ8B
MD5:	717DBDF0E1F616EA8A038259E273C530
SHA1:	926CE8EC8F79B62202ED487C5FB0C3E1A18F5F70
SHA-256:	E3227EA4C39F5B44F685EEA13D9F6663945E46B12CABE5D29DAEF28B6EEF1A9B
SHA-512:	C09BF38AC93C350DFD0638BEEDD40FBCC9435A06B0013D214F57B181C1B4292E4B8A8310DB2DB48200BCFED872BC656EA92A207ACB6F7B344E3F134226C2AB3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Af......................jq......jq=.....jq..............jq<.5...jq......jq......jq......Rich............................PE..L....A.O...........!.................".......0............................... ............@.........................p...j.......................................l......................................@............0...............................text............................... ..`.rdata......0......................@..@.data...<...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\starter_ply.ui

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Microsoft Cabinet archive data, single, 326717 bytes, 1 file, at 0x44 +AX "starter_ply.html.new", flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0 compression
Category:	dropped
Size (bytes):	337549
Entropy (8bit):	6.17318977867477
Encrypted:	false
SSDEEP:	6144:MbeMSlVNGtB0781MjjdY2r+Y8C44X3pr7s+Ch/watVnilRgOZc4vEw5WVuSgh:EYT2B+wuxjiY8p4X3NhI1cZeOWkxh
MD5:	14256CF22F6FFCF19878E7827ACBAE78
SHA1:	2596AFF196E36B4313F9A9943D07BA92E478A0F9
SHA-256:	9D015B29F1F3508F1625749E656DDDF5D7B095CC6D1F916DC288B7213DE18275
SHA-512:	B2C30B7CCE63D0A20015EA7B0E14AD4A5862309037256D2CCFE1AED6624C50B2E2BA7B96BC60C4501CA0255994127482D5AC43789D285B21A9BF40E7DAA35F03
Malicious:	false
Preview:	MSCF....=.......D...........................=...P*..........i.................4U..`.starter_ply.html.new.............oSdf4GSKNQPEWl+fxsL0B3w5SEDe8DjEYzYvuV6oNHBEPd+4CWq4wStlF9fDZaUsoYzkk2Czz3QlBEpVh4gG8QdH/f6IlF+quzQKd1WdZfgQmlUxSZ6FPmLckIKMq6WSw+Olf9raonw/lesMF76JezCE0uihs2kB9L7bjFbK+54z1JNX5Ois2RE4iHGjNEy97+Mxuy7KRXQz6zv+bCkGiRTx7FoX7Zg+LyUx3RRh4QymXSCPWK0m7738ZG33jXYopfmygv7OebRuGFG23uh7b2PooBYmLPEbxs7W3hOjPNVl6Mkr+tK9zmmbxTgkqAAa/TU2xcj9uIN5KnM6tiB/IIUGNtDbQFVc19PYCIv4PMxnkYcRKuGhDLq8t+lcS8PtznfsfEak5iQobjUbivG6Ry7aSDNB7gx8nX6Qq9t/i6X27ZEmH+PdVh99kHbkBbQsLBaMemC2oAuWm3PMlnWdQn2aKHdzQPVVCIbKyew4J4gHp5MX1aW+CVh7N3ZR3EChPvycpPdBPLg6RCBYk4eqQ4FmSnSHeESaeopDa4tJc4/FafwRlzczbxK9hp0SHNZXmjsm10xAUPJNUNaFsmC2wKAcMhD/buA7AqwgW0j72jcm94BWaL7egEtYJ8cvzywti0OpqfT75oHvgd5zNJa11ec5KmkIUvntG5ISjpjgFFcu+9nI+6MvHrpjiINx121BiBzOR0FMPsORI4sCXjYDz/VzDkOgsFc3eRBoWzUARDegHhIImMrJna5bzkfkOBhce2JzfdjlfS8QHs5dfxwp9S2Lztkalv/kuN8KfjiU7qxkSqBgMkfjSvyOF51LgNCNkG6t88g6UGxfACldBcrdOElauQEfNdSmejhzxUi3UlxFZPgKxf0

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 28 x 24, image size 898, resolution 2834 x 2834 px/m, cbSize 952, bits offset 54
Category:	dropped
Size (bytes):	952
Entropy (8bit):	1.0784336760196316
Encrypted:	false
SSDEEP:	12:D8f22U8888888dXaEaRVVokZL2l7QvRVoCaJRVVM5YT:L2U8888888dT3kewAzqE
MD5:	C5130DA68CA6B2E12304A979E09DA751
SHA1:	10A97010FF7615553A5FE243B61E7EF341AACB3D
SHA-256:	AFD19CA20266AF5FBF98CBFFA66BB4D054E633002E11878BB86D50DE46CFBD63
SHA-512:	E4B10AADB881D70E3445E01F572B0102344C797AD5B4C92F932B1D23B7329A443AFBC93C2B12506A118ABF6DC938F50D99BBBE8983B6A7CA1EBDF8DA7B98C7DC
Malicious:	false
Preview:	BM........6...(............................................................................................n..............................X*...............................................................................................<...............................O..............................,J...............................................................................................0...............................P..............................E................................R...............................................................................................................................e...............................>...............................................................................................................................................................................................l..............................................................rs..................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_normal_bg.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	1.1015848871604925
Encrypted:	false
SSDEEP:	3:illl/Pl/h+lFlxlY62Q/88888888888888888gXXXXXXXXXXXXXXXXXXXXXXXXX3:i/glfM62U88888888888888888gXagl
MD5:	EBDD73B25F0F819A1A91BAA1A4BC65B5
SHA1:	22F25AFFBAF50F3525E36198C160CF6005E04932
SHA-256:	6E8C06BA2F71473B6DF7F1BB2408BE9654DECF45F0E057CE1D9EB396EBE0E812
SHA-512:	3F43B03B2687345182AA3840F0B6AD7A1B3A315682F5D3CB0CE7D96253EA3B1F205CFA6F4520081B0E2C98F9D647D6AB02789AC54F9FCEA622C529E5EA120A59
Malicious:	false
Preview:	BM........6...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_normal_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 28 x 24, image size 114, resolution 2834 x 2834 px/m, cbSize 168, bits offset 54
Category:	dropped
Size (bytes):	168
Entropy (8bit):	2.1415728713599056
Encrypted:	false
SSDEEP:	3:wltSlxlslFlEl362l3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3j3d35Dlj3Q3xSe:QQljslfEt624BL/
MD5:	58AEC9446493E696D752408A2D55DD12
SHA1:	FB82079A3A7B86CCB4ADF8CFA8E0959DB40504E7
SHA-256:	6BCA57B6BF3D9FB74560BDEED11C50ABD3440A97DE322B076B67DB333364F6AB
SHA-512:	AE1A43EFC68D9FE3C41F02DB4ECEF253A8560139EB66847DED60F6DCB56E80BB6637AB1F74724B3BDAE8A7AA0AC089C72300FB699A21C460D95221699528A637
Malicious:	false
Preview:	BM........6...(...................r.................................................................................................~..................s...~..........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_over_bg.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	2.4677390617579165
Encrypted:	false
SSDEEP:	12:iIfF2U88888888888888888QidididididididididididididididididididiZ:F2U88888888888888888G
MD5:	0BECD73EB7B9BC3A87A7DF8A037B8343
SHA1:	8FCD4002804744CBC3FAD020BBDEE37F935C6C96
SHA-256:	C6B927CC0C8786DAB77406A4F5DFB80E6A657C16E855D9C5D926C95BA255D771
SHA-512:	08FD22552F7D4ECF0B3B0078B20766A05C78E8B6BDA7BB5FE95EA77041D8461A434A922FECF8B3F8338976B68705965B4F990047F319FD309629AADA826CA443
Malicious:	false
Preview:	BM........6...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_over_line.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 28 x 24, image size 114, resolution 2834 x 2834 px/m, cbSize 168, bits offset 54
Category:	dropped
Size (bytes):	168
Entropy (8bit):	2.8491454163247076
Encrypted:	false
SSDEEP:	3:wltSlxlslFlEl362Z9VfVfVfVfVfVfVfVfVfVfVfVfVfVfVfVfVfRt7Fl9Vfypae:QQljslfEt62IZ/
MD5:	71249226E88A1507D75F5DB49042E4F3
SHA1:	CD85CCCC8F5610E6A5EEB35B8377EF1607EF32E2
SHA-256:	9E56DA108ECB375DB4AFA639DD5922E8026FDC503E5FE34E552AE52C1DC464FB
SHA-512:	24FB2A3516E393E79326F9664855ACD0D2BF1CA2617F5A174EC3DEE8C6071965E1053FEBE16D6E6DA14BB9BFCC00E720D0D48A5A2888EC0012A43AAC1B1ED144
Malicious:	false
Preview:	BM........6...(...................r.................................................................................................~...................s...~..........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_sel_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.7980352477030295
Encrypted:	false
SSDEEP:	48:FmBBBBBBBBBBBBBBBBBBBBBBBBBBw88888888888888888W:F588888888888888888W
MD5:	29ABEDFE5169B1A9E46E5E7167D0C776
SHA1:	8A4A853D4059B90859A36445CBDE90BA7744A395
SHA-256:	EFCF81C614FC9C6CA6307C05B1A4AA7F34CF8FA2C9A3B0FD59FC5F2D05B78EB7
SHA-512:	8BFB3F572D4DFDC167263AD8FB275739C50373CCFA53A475CDD68429D0B84A97BC390374251D4FDA9D002234F9AD71E56C215F5D3348D7E2C35F54D83DE529EC
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_sel_mid.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.5367394076291824
Encrypted:	false
SSDEEP:	3:illl/Pl/h+lFlxlY6XR6w88888888888888888Sl:i/glfM6B6w88888888888888888Sl
MD5:	17B9FEE7091D778279C27DBC503BB695
SHA1:	50AF5F25911D3F481A224D8B1E677892C7A3D2B3
SHA-256:	B1F18E3A3DF55967832E51D52D1FB7981E5681813E0C93EA9758F2EDE2EDF2F4
SHA-512:	10F45D4BEBEA3A92F461D2F01DEB2C8FFD938465AB7C0F5CCDDB3712AC86E88684C9241B709FDD0C8684AC89A844CF8CA77AF7A31425C8557716C09968FF57CE
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_sel_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 28 x 24, image size 1682, resolution 2834 x 2834 px/m, cbSize 1736, bits offset 54
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	0.7980352477030295
Encrypted:	false
SSDEEP:	48:FrBBBBBBBBBBBBBBBBBBBBBBBBBBw888888888888888888W:Fc888888888888888888W
MD5:	0B5D2F38A99E85A1FCA16BE731C8F335
SHA1:	9C3981D4633FC6A1A377D6E531F42196997E490C
SHA-256:	BDD44ED295A1377CE3CA717212022D22A9343F2D1CA7FD3BBABCA44C3AC93EE9
SHA-512:	287EC282E429DDC2F00960DDCC864B153273A1ABD3CF131373E4D34EF45930432BE7B2F681E0FD7D04940D36D8A3E72763C9D3657339C1DC4F01C42B8FE3E8C1
Malicious:	false
Preview:	BM........6...(..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_selected_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	0.995503138083669
Encrypted:	false
SSDEEP:	6:2Ul/C0e/6BsIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIINFFFT:28a0eifFFFT
MD5:	112B3D853BAEC9DCD7A5FD9708925F5B
SHA1:	17FF03B7881FAC1DBC3EB8DC6AA6258C243D356A
SHA-256:	DE83C89F151CAC8D1C3157AD3AD68CA6964C4456BAF3DCE51EC13328B3183E6F
SHA-512:	117272E8D2E2E230BA70EB1835B5128ECFED3F5A3668A8A4D22E71924F8C79204EBD6F7039F92D2827BB1FF800EA7ECA668B4F075D2FB1C0E81D3F6BDA5F92A1
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|..\|..\|..\|..\|...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_selected_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.7507102405026216
Encrypted:	false
SSDEEP:	6:2Ul/C0e/6BV8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8W8Wp:28a0eitFFT
MD5:	FBAD9DC94C04C38EF746E6B08B395FA0
SHA1:	860C527A746C02931F19586996F64FB6CC7DCD05
SHA-256:	B8527A97FACCF182CE6744FBC67952DC2A8A8BFD318787CD925DFE499AD5AEC8
SHA-512:	D79B674A041741D776DD7CD4276E8F63206048E169EBDF36B13843E02D2528725B099068E9C3759FF624C530AE20FC1996F68825A3869A8ECF79F7CCAF1D7E30
Malicious:	false
Preview:	BMh.......6...(.......#...........2.................................\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...............\|...\|..\|..\|..\|..\|...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_unselected_left.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.1438885235805132
Encrypted:	false
SSDEEP:	3:2tlEl/Cc/ldc/36QKFFFbFVVVVVVVVVVlVVVV/VVVVVVVVVlVVVV/VVVVVVVVVlz:2Ul/C0e/6fFFFECfFFFT
MD5:	A808E2A49AD21C93B33A335D9EC20D0F
SHA1:	367558A96E8BE6A960AD7FC8A5606232834CF750
SHA-256:	D9A9406E8872E6D685A50451B838EA4BD7A0B65AE89D0F88129A550DC98223EB
SHA-512:	902D9A4FD76F2E5152CAD76CB2A477CB867337CF2057A39F32C19EF038C99BAE2A01DCEA5C42DFCD9BFA82F9AA8635670244CA5152237AE700ED96A0FE675AA6
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................\|..\|..\|..\|..\|...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|..\|..\|..\|..\|...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tab_unselected_right.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 5 x 35 x 24, image size 562, resolution 2834 x 2834 px/m, cbSize 616, bits offset 54
Category:	dropped
Size (bytes):	616
Entropy (8bit):	1.8148794356700846
Encrypted:	false
SSDEEP:	12:28a0eiNFFFlVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lVV5lH:2d1iFVV7VV7VV7VV7VV7VV7VV7VV7VVb
MD5:	0F90820E88DCFDFCB79E4FC075F69EC0
SHA1:	BDCD5B75AB8D3ABE7A8E1E6FD5012634A42EE5E1
SHA-256:	A82AB1FBCD255C1500968750E3CAC1325F23187F3D64C312271EFED928543A3D
SHA-512:	93150AB82E4B4DF8FC41979263518B8A997B4E79F023A68194D522D8A2F364B787CE479BCC6AEE4E938E3F920EABA7A50DB567DF20E82B919765C7F5D19494CA
Malicious:	false
Preview:	BMh.......6...(.......#...........2.....................\|..\|..\|..\|..\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|.............\|...\|..\|..\|..\|..\|...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\title_logo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 142 x 11 x 24, image size 4710, resolution 2834 x 2834 px/m, cbSize 4764, bits offset 54
Category:	dropped
Size (bytes):	4764
Entropy (8bit):	3.521267431098461
Encrypted:	false
SSDEEP:	24:boGyuI/uFkLzaaQ3Q9v101xo6MeafS8XFEvuM2P77xQt:s3uFkHaLiv1yxo6MPag+uVBw
MD5:	FEE2FE80EF2A157AF94C3FCA2E9F8AFC
SHA1:	062F4ABB886555CDCBE7A23CE91D205983839330
SHA-256:	224B00A9E7BCFB9AC00DFB2D0B7389FAFA12EDBB097905147BD48657A5E0800B
SHA-512:	62A4023CF71D6D954669B88DB6799A80DDD4BC70E5EF69E0932BAEAE02A45841520CA29FC6D0B36610956477E43022941E133C75E82387C1DED563D41982A893
Malicious:	false
Preview:	BM........6...(...................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................r....333...............EEEKKK...333.........WWW???...333ooo.........333......www444333333......AAA333333333UUU......aaa333333333<<<.....................III333III............III]]]}}}333......333]]]............III333nnn..................]]]333.........]]]333............III333...nnn]]]...333]]]......]]]333...nnn333333}}}......nnn333...nnn]]].........]]]333III......]]]333......333]]].........]]]333nnn......]]]333.........333]]]\....555kkk............333......333.........WWW???...333ooo.........333.....333hhh.........

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\title_logo_about.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 251 x 16 x 24, image size 12098, resolution 2834 x 2834 px/m, cbSize 12152, bits offset 54
Category:	dropped
Size (bytes):	12152
Entropy (8bit):	3.4699014505496284
Encrypted:	false
SSDEEP:	192:WF5ijgwx9R0WFCfNSBNapeWUsnPt1UB+RKEfZ:WF8drcl0ZWx11US
MD5:	42FE02A9E320890CF9A9CD0BEBC16EE4
SHA1:	4A9ADB6744E1B4A3116E957E7318935A8C9322B8
SHA-256:	685D316A58B90C72F759E3DA0220B01650C15226B56066B1B388D4E9592AE7A1
SHA-512:	2F632F22F8430E4779EE2239FCB7719433A9BE2C86DBF6B84C719857CBAF284577CD9D52D610D1393CF1DFBFE44D7599F419E496E71F2BFDEDF6AB5EA9D6EA9B
Malicious:	false
Preview:	BMx/......6...(...................B/.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................oN.jH..b........................jH.jH....d.jH..c..............y.jH.mM.......jH.jH...............jH.jH...............~a.mM.jH.jH.jH.........\|^.O(.H..H..P).}`...............~.\8.H..H..

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tnnipprt.rul

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	7.988215448875895
Encrypted:	false
SSDEEP:	384:7MwJ7JA2eVbEzFph4XQ24X7tooM+XJybmwDbFtSZQ2kC:7M87JAQbh4XtI7tooITDbFtSZQ2kC
MD5:	3A28B4C88E01A18E52E35D3D7B55C6E4
SHA1:	0BC5BE2CC060D68810FEAC1EDF8A1943B1429E5D
SHA-256:	48F8CA22A0FE2FE2B7B89FF415E04F83C893E231DA1199C065810D71BA52D564
SHA-512:	B685ED4CE23174F1200AEC65BEC10D9064617F75002E5DBC4DB2687C3EB6FFE03F4E5E6976E04A1F518C06B054436641D9BA26F0FDCF42A421D0C69D90C8769F
Malicious:	false
Preview:	.P..&kc.w3.d).u.....@ .....7~I......8.....z..I.W...+#)gS.aL.............~..2............].ly^.jm..`l..d<%5~.6.h:....Fy8<<w..Y...z.."..E#{.L.....Mb./.../;.[...&N..\|.pI.9.i.t...#.6.v-..EU.G4.W\|.$P.\N...l.v).$}.. .y&.m..e.$....ZN..@...eB.....rL..^..<K.....z.l.n...G.C..l..i..A..t.z.......rV=Sn.'j_......t>......x..1}..5...&."K9....QM....=.R.....p..?..`.V..... ..[..&.yE....!..(5.9.h(:k.). #..O#^...t..'c.N..*...@Exy..-...d..P.(G/......6...Q.(.q.c..J..2.=..2C.W.A.~...D....jL~.GY4....f..I..)..`..],..T.3!6AM.:.vXg3~.....\.g..~......W.Qmp.B.@y=aO."".......pq>-r..........1..\|q..2.E..!DPCV".........\|{1c.ySL~..v.D...<QN=........8Rl..T...._..!..1..=..lp..3.Q..>.r..\|.P...".L..h...G.....S.v.....>.z.s.$...G.!......v~.@{.1w.o...@.....;.}.w..[-l:a.E.[..........j......&...].7(..p9....A.[8].-.......Pq....R-.)U.m....h'..."...+....G.....j..r4...3.p.......s.c....Dn.q"...nZ.a.......0`.H...P.j.1..ln..1........Z..P4.......q....c...\.e......i....r.....G.{

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tnnipsig.rul

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.998582722595543
Encrypted:	true
SSDEEP:	3072:IYNBriFUd4hT3TTblAs0DUwA0Jv4QEEv4+chBAFsqOVYRWe7r:BNVizTpAsIUwAUwQlEhBe06RBr
MD5:	4F6ECE9FE521269B3D94F2B8698CB12E
SHA1:	3FDD3955E05BE86F2A65FEB9AEE173A81E88B56D
SHA-256:	0E1A8E296DAAB3623FBDBE25142741DA0DEF87DB226C980FFAE88F97CCBF999D
SHA-512:	7B7FE7EECB936203532BC6281AA38A3F9E0A0301EA032B3CCA6FE28FC1E25690C5F15533B79BFE1A6346CFEB0FBF221D30B201BB38D1693F0015EDDBC3E8DB1B
Malicious:	true
Preview:	) .@.M.....#...&.....@ ..Q...+.JxX...{...Iz#... ......5Mq..p.[..]A......K..l.ji..C}rN.u.[.Op.y....:K..".....0.O....;.q.0,.....A.......(l.-.......xsy,u..i'q....\|...?.....#...~..Dw-.M../9........iiZ.G..2...u.g...,>....S..K...J..O..9.4x.....g~z.%%......F..o.....P.sKY..-.^..(n.....l....&.gn.(...K.............%..0.k...G;Q.!v....'gd\|.xy..q...3[.(..E..Nt..[.O..).Je...{......!..<(..B..u.K.!...EP..x...$.......l...ED.T..e=.C.."..M'y.......FT....D$.,......nj.D.1.s.-w"...V..$....)...E.(p..&e..N<^..q&?b.r..+c.`.YS......EL.Sceh...v..zV.......\..f...[(..........4..z.#4-.....B.{.:....6.m..@......?.....r.........../........5..p.8.k.t.k.{.d..IB>.......O....c.......TX......./..[#...w....+...,..9.Gf[...-.Q...T.)6....W]....q5.p4sj.].....28d...\5.x..K8.P..+.+z.^...V..UO.v.>...n.FE.4-.@.._X...>G...@....V.....w..$R1=A.ek`x..oW].d?......BB.".....~..5.........'.....`D.fTBH1R..9_.7.}...R.R9\|.../..#.B...0.;.lD.8....td$.....$.lbk..h0s.(.vNO..l.kT.<Z....0]c....

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\trueeyesu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1255168
Entropy (8bit):	7.031795624450013
Encrypted:	false
SSDEEP:	24576:CQiGWaZW6nCdcKjKuy3xe3jrmsiCEGsHy6Jf4938gDW9X0:CEWaNCdcK2u6kPmcPRR1ZDZ
MD5:	B21244B6FFD05B4402AF7560F6305A04
SHA1:	1A5110F3FBE2F4D10A2681ADD544243A6138F5A3
SHA-256:	0D216D7B2666962A1D0897E61924D802F05864C40050B026F2A07B15549DC351
SHA-512:	8AA1B053DD92A0B0CD5E7A6A343675B38ABC5F4BAAE3E62D87C3F66B78CC2547FCC969405BEB0590A83AEB09390486E9054975EB8EFE24794B0F1234D183182B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>..r`...>...V..>.......>...>...>.......>.......>.......>..Rich.>..................PE..d...*a.b.........." .....^...B.......,.......................................p...............................................................w..<....`.......=..<............P.......q...............................................p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data...T............n..............@....pdata..p............p..............@..@.detourc.!......."...v..............@..@.detourd............................@....UPX0....c.......d..................`..h.reloc.......P......................@..@.rsrc........`......................@..@........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\tsmime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93264
Entropy (8bit):	6.542990111685332
Encrypted:	false
SSDEEP:	1536:hIPVhmws1JhKB7slvjhdv7hc4Esas6WE+UqKq66rMCYgHbIKc30l/0A:aGQKv7qU6WE0Kq66gC9HbIx30l/0A
MD5:	A917BBF825CA674F036EB74A8BF7A3E4
SHA1:	73FA7B54EC4B039878F4746DDD911D473ACE82A8
SHA-256:	4B03CFBDC356F7EFBDE3EC9C638772330D46832B749DB31794BB5FA4F1A3416F
SHA-512:	DA4200203D56D9E9A2BD2EA0BB467732CE09FAAD4C20012F36144BEB0E710C60C74AD2099121B650E00E1137E145787D1B1C4B4D56BD585229EE5F873ED86906
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....r.H.r.H.r.H...H.r.H...H.r.H...H.r.H...H.r.H8..H.r.H.r.HZr.H...H.r.H...H.r.H. .H.r.H...H.r.HRich.r.H................PE..d...JL]\.........." .........R......d........................................p......<.....@.........................................."..m.......<....P.......@..........P>...`.......................................................................................text...Q........................... ..`.rdata...3.......4..................@..@.data...P....0......................@....pdata.......@......................@..@.rsrc........P.......&..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\uh.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8655860171879
Encrypted:	false
SSDEEP:	24:7+V50HeJqFj9j/Vhi8JqDn0OAsYg+MuscyWJyoXVU8/bBVM0JW:yk+AN/VfJq7VhJ+MusKyoFBzB/W
MD5:	562C353E6B4F038CD5B52EAD4D5DA77A
SHA1:	197EED463470156F4564896E5E4572D222AF0466
SHA-256:	06A0D4D25F8C9C01F1B05492FF7FC1BB1531421FC5F2BA640F2656939FD04AEF
SHA-512:	8A23C03C0F2C817A6B468490F49F1F28573E1965118959610A4A8215A9E0FF207F65AD02690A94798EB6575036A8006DC98568148D66463E84BBF0E7BF2F0867
Malicious:	false
Preview:	......g".XU+`.y\..{.:..OaNS..H6aed..2...y....f..Q...Q=A.v.zZM_...6..y...B....R.@JdT......5u~...xc....I.......>...E....N....1.9.a@\|-...B.}.B.8f....%P..zT.6!/Zg.....#....A.....zL._.v..K......@d....u!.$.#.s.H..< ....C.d.L....~..qq.r.1R..N,Q...]..F.{i...\.w.L....$t;.H_.^....-...OB+5.b....A...we.fJ....$.,.a..m.F......]M<?._j.a.kz.....f`....x..%..Odz.....(:iw........^x... ..%.B...t..8i.):\|.....[..oq.Ogu.....4...\..n...e.3.+N..[>...].s.....x^.A.J.N....."y....w.8..-..a..S.g...o\|.6.@...T..N....2q5....d...<..8M.........O91I..E..l..2.4r..3..r..-....R...yg[.......?...GMZ..K+%!.wW{.a.F..Z!;!.....UL....K...1...R?.....M.e.m.Z`.@Fa.F7._w.`%.T.mx....T...3.......46U.+.....;7..s..C/..=)..5.J..2.hS...:...9m.w..cPJ(n2.....H..x^..Y...R.y.?...<Y...5(...j..X......`O.....^....[}mj..}q..C.k]:...G.4.X.X..z....._...C.m.....C.X ..e..A74."....IN...$..G..:.kI.+...FJV.e..^..u.....Dr..A.Z..\|.w.......^..8/..~G...B..2..2....rj..5\|.k..m..@.s.I+jR...t.).....fp.....".

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\warning_icon.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 47 x 40 x 24, image size 5762, resolution 2834 x 2834 px/m, cbSize 5816, bits offset 54
Category:	dropped
Size (bytes):	5816
Entropy (8bit):	1.698865887106523
Encrypted:	false
SSDEEP:	24:jqtsX22222222222222222222q2222222222222222222222wM22222222Pw222C:etspF4W6/RVTNXJ+get
MD5:	90DC3A9FD17DD7D229BB310FC3414293
SHA1:	0171E007FB42391702539EEB3CB4F8D734BCE8E0
SHA-256:	C83A0EF50D9C2237319BC34F6126579278B3E7691CC9B6C0CC5AAAD3EECCC3FB
SHA-512:	894B43E5C506F58D378F19395333E1CE247748C7D80A94B94384C21163F6DAFFC701FD25B16A9186632AC802A2B3A017793A55F696CF8D080831F11563859C61
Malicious:	false
Preview:	BM........6...(.../...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\e\wlist.asd

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	493566
Entropy (8bit):	7.81581227839091
Encrypted:	false
SSDEEP:	12288:JBb74u12ILVyTW/Tc1nW8wDoDqvpI3faHGuwuuSt2Y:JBbcfILVy2L8IoOvW3nu8St/
MD5:	C812F7791912E817E79FAC44361C3835
SHA1:	AE36E182A1124064A1192C2CF253F1016182AB06
SHA-256:	D0B9EE8D937DEA3A7FC058A5412C7518DBA0F4F31A102660986D15A8FF9582E9
SHA-512:	0CBCBFA857A1BE6B94AAC9BE4E5362A3686D8257841B2554CFFABD93F36C64D9055F0D333BE90C6F6AC3B94565C10EFFCA5BA27268D1E163C4B169CF95BD68EC
Malicious:	false
Preview:	AhnLab MeD Technology White List Data File.............{eM........JKCJSWOTHSUS.s.......................z.1.8....M../....".......{G.......e................7......\.....7.......s......-..Q.............p.....8..;............................&.........`......H.A....................}......v........(e.....f+#.....R.........Z.....ml...............H............................W..O....bO......u.'.....)......................b'......................\|4.............`V......2...............P.......aJ....j................^.............&i......,.]X....0..........G......j..............Z.{............\.......i........J.u....F.......L3b......u...............h.....3..............F.z.......V....j..........E....c.......`.........+!.....%3....r........z.....>1.3..............j....................i ......?.~\....4........6.......k.'............-................................9...........0`........f..............J......4.............\|.Df.....Y......H................1..............n.9...

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	3.634300406258848
Encrypted:	false
SSDEEP:	24:Q+sxv5SADyqWCs7y6Za09ny6R8JCsGKIC96hKy6QSjLPEUg/kvECvyMLn:rsxwA+qQLalbPylSjLPEUg2OYn
MD5:	91E9C6F905E4DB8BAADE0C924A700BAC
SHA1:	B37A143613088792676D3C42A2E9CD3E93820A3C
SHA-256:	226C132ED5B2AE4C21B26950E6E04755A6F0F770A4CA065C2B954A9A59F15003
SHA-512:	139A8215BC7ABE79EEC2BB2FC8EED5A58E2C58760E43F1C879892D4F8DC7BA03BD979155C9860D61FA8DEAA911E71CE074676248AEDD4BA2D1B149D48C11A191
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....R.e.c.t.=.1.0.4.4.....N.u.m.F.i.e.l.d.s.=.3.....R.T.L.=.0.....N.e.x.t.B.u.t.t.o.n.T.e.x.t.=.....C.a.n.c.e.l.E.n.a.b.l.e.d.=.....S.t.a.t.e.=.0.....[.F.i.e.l.d. .1.].....T.y.p.e.=.b.i.t.m.a.p.....L.e.f.t.=.0.....R.i.g.h.t.=.1.0.9.....T.o.p.=.0.....B.o.t.t.o.m.=.1.9.3.....F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T.....T.e.x.t.=.C.:.\.U.s.e.r.s.\.a.l.f.r.e.d.o.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.d.E.1.8.B...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....H.W.N.D.=.1.3.1.7.8.0.....[.F.i.e.l.d. .2.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.1.0.....T.e.x.t.=.W.e.l.c.o.m.e. .t.o. .t.h.e. .A.h.n.L.a.b. .S.a.f.e. .T.r.a.n.s.a.c.t.i.o.n. .S.e.t.u.p. .W.i.z.a.r.d.....B.o.t.t.o.m.=.4.8.....H.W.N.D.=.1.3.1.7.7.8.....[.F.i.e.l.d. .3.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.5.5.....B.o.t.t.o.m.=.1.8.5.....T.e.x.t.=.T.h.i.s. .w.i.z.a.r.d. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .i.n.s.t.a.l.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\modern-header.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 175 x 59 x 24, image size 31154, resolution 3778 x 3778 px/m, cbSize 31208, bits offset 54
Category:	dropped
Size (bytes):	31208
Entropy (8bit):	7.200453354077403
Encrypted:	false
SSDEEP:	768:rXwwDA8aFepIQdCoYbPo87r6FadwesmFbYxZ002kjBksdjPCFvk:jhDlaFeldcv4adwe78vr
MD5:	3B49A22E5AD9741734DE6EB84B820B3C
SHA1:	9B4B06D882F022A79C701FC7A78F0A3514894029
SHA-256:	141B90842FA130717A5A3BE61C20E3D9351BE50BFE9AD479D97BF850D9388D67
SHA-512:	C20073EE0DCFC448EF07E409B3E5ADED7BD356569F93F9426C4B6BDDFFAEFEE9B9DDE4491D64B82F872D21FBFD8571D75CF27FC0A8A25D1B6C7C41B4614B6105
Malicious:	false
Preview:	BM.y......6...(.......;............y.............................................................................................................................................................................................................................................................}..}..z..w..q..l..g..c..a.._..\..Z..Y..V..T..R..Q..N..L..J..H..F..D..B..A..?..=..:..9..7.5.3.1.2.5.6.:.8.9.:.7.7.4.2.1.0./.-.+.)..'.&.$.$.$.".. .}..{..z..y..x..w..u..s..s..q..p..o..n..m..m..l..j..j..j..i..h..h..g..g..g..f..d..e..e..c...............................................................................................................................................................................................................................................\|..{..z..x..v..t..n..i..c..`..]..Z..X..W..T..R..P..N..M..J..H..F..D..B..A..?..=..;..9..7.5.5.8.:.=.>.<.;.:.6.5.5.1.1.0...,...(..&.

C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PC bitmap, Windows 3.x format, 179 x 312 x 24, image size 168482, resolution 3778 x 3778 px/m, cbSize 168536, bits offset 54
Category:	dropped
Size (bytes):	168536
Entropy (8bit):	6.8829267193217945
Encrypted:	false
SSDEEP:	1536:GXc22hyNMXd/LBDVzVVVVVVK377TjfSafFe8lerfGoVOOGGGGGGGGGGGGGGZGGGn:922Ywd/tk377TjherNB2wxwwChwwnwe
MD5:	A14EA58AAC9CD0EE52AC87D2BB7A3149
SHA1:	E8E1FED3E9096E0454501CE2003476CED1B085AF
SHA-256:	37E9A5ED080B312D165C6C4C30A5BC8D8A43508FEDD3B266C8412281B944E627
SHA-512:	1C50F764D792437FC8DD9D8123D6532877A262C14CD436EA797D0BA18D0F44B93D66B06ADA345CCE4102A778B1E1C5102180C1654A293B1DE26B7303D323DCC4
Malicious:	false
Preview:	BMX.......6...(.......8..........."....................L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..M..M..M..M..M..M..M..M..M..M..M..M..M..M..M..M..M..N..N..N..N..N..N..N..N..N..N..N..O..N..N..N..N..N..N..N..N..O..O..O..O..O..O..P..Q..Q..R..R..R..R..S..T..T..U..U..U..V..V..V..W..W..X..X..X..X..Y..Y..X..Y..X..Y..X..T..M..M..M..M..M..M..M..M..M..M..M..M..M..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..O..S..V..V..V..V..V..V..U..U..T..T..T..T..T..S..S..R..R..R..R..Q..Q..Q..Q..Q..Q..P..P..O..P..O..O..O..O..O..O..O..O..N..N..N..N..N..N..N..N..N..N..N..N..N.....L..vD.vD.uC.uC.uB.uB.tA.uA.t@.t@.s?.s?.s>.s>.r=.r=.q<.q<.q;.p:.p:.p:.o9.o9.o8.n7.n7.m6.m6.l5.l5.l4.l4.k3.j2.j2.j2.j1.j1.i0.i0.i0.h/.h/.h..h..g-.g-.f,.f,.f,.e+.d.d.c).d).d).c(.c(.b'.c(.c).b(.b(.b(.a'.a'.a'.b'.b'.b'.b&.b'.b'.b'.b'.b'.b'.c(.c'.c(.c(.c(.b(.c).b(.b).b(.d(.d(.d(.c).c).d).c(._".Z..X..W..W..V..V..T..T..T..T..S..S..S..S..R..R..R..Q..Q..Q..Q..Q..P..P..P..P..O..O..O..P..T..W..W..W..V..V..U..U..

C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\AhnIEx.dll

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1601008
Entropy (8bit):	6.749281650919733
Encrypted:	false
SSDEEP:	24576:vedIJcNVXu2hBHfU+eraM8kOJAoy2eXWDhhOfrRP8HE+2EJfE9iQsnL44Euxo2Uv:qJHflhrGqkAJfEHKLZEux3Uv
MD5:	A349F78CBC6A07BDF100FFC6ADED53A5
SHA1:	CE33518766DAF017E8F06168217FA35E5FD35F4D
SHA-256:	80A61411DFE7A4F97B0FA2E5D5FE1138A1D60451EE27C37A7D3B2039A3D4DC83
SHA-512:	70F56E5EE2747151F3744D91E825ACB18896FC3E9E566531383C00D0288794D77BB6AF61ADF8C1E200B3081E4432D380E25E5399E00AE4C66E21D68CBE14189A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!m.uO>.uO>.uO>...>.uO>..">.uO>...>.wO>..4>.uO>.uN>.tO>...>.uO>...>.uO>.'.>.uO>...>.uO>Rich.uO>................PE..L....+.c...........!.....R...................p......................................xH...................................%..,............_...........D...)...0......`t..................................@............p...............................text...NP.......R.................. ..`.rdata.......p.......V..............@..@.data............$..................@....rsrc...._.......`..................@..@.reloc.......0.......d..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\NSIS.cat

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	data
Category:	dropped
Size (bytes):	17031
Entropy (8bit):	7.429641447353002
Encrypted:	false
SSDEEP:	384:EUdO7g3lNIYitvz+asm4i/8E9VFL2UtVV:EUdHEYitqazeEdj
MD5:	4FA154851FA10EA7EF62D063FCD0FD6E
SHA1:	51D4ADFC6C533DBC2D0C6B0CF972A49CF7575E21
SHA-256:	902B98ACBE2CCF435233FA1ED00F623A714FDF107851975494832B1D730A897E
SHA-512:	D373D0052DD8F2B705857ADD0B3A7EFB8C476C0C3BE2ACD11974F617F8F697D28A2AA012AF3E47D73A31304FB54F3BB62CB76A9E63D27949B90794C8DAF2AAB7
Malicious:	false
Preview:	0.B....H........Bt0.Bp...1.0...`.H.e......0.....+.....7......0...0...+.....7......"L..+.N..fc.v....220627014823Z0...+.....7.....0...0...87.#.(s..4.\F.q...1.0...+.....7...1...0... ..$.6Ro.-??+.d.1.w..`..#..C..61q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..$.6Ro.-??+.d.1.w..`..#..C..60....i.$..4..W......B<1.0...+.....7...1...0... ...k....3..B_.Gwn....$N..I....1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...k....3..B_.Gwn....$N..I....0... .;..Re...5...9..D......FZ ...KiE1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .;..Re...5...9..D......FZ ...KiE0... .X.p.u.J....].=...\|Y...n...x..1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .X.p.u.J....].=...\|Y...n...x..0..........i..2{W....(1.0...+.....7...1...0....u..npk+.<.<"...v.1.0...+.....7...1...0....n....A..i......u{b1.0...+.....7...1...0... ....P.7..;R.\....R4_....y...H.1q

C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.8749018746022035
Encrypted:	false
SSDEEP:	192:aS8LqFZBOtRG/+VE6HwIobhj+PJu97wI88QF+wnazLL:/ZQtsh6HQdj4OnauzLL
MD5:	1C6C387F9A72F7CC591B0C296EE8C58B
SHA1:	D167CDFC4F8D0265299AF33DEC4EE5E3B84FBE41
SHA-256:	18C7E74A71E88CCF61795DCD4E8DFF42318CF1CBB3C1777F312DD7B45ACB4BE3
SHA-512:	5950456B4032736AA0DBB0C9C273C25F394696134C1EDF4D98346D9AC3A1158B10B83FADC85A976219730BBCB4F8A618DE237C96CA094E5F766FC2F963D9DB1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~_...1...1...1..M....1...J...1...0...1..g....1..g....1..g....1..g....1.Rich..1.................PE..L....v.`.........."!..... ..........]&.......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata.......0.......$..............@..@.data...D....@.......(..............@....reloc..~....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslB5A3.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\astx_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.536354079504902
Encrypted:	false
SSDEEP:	96:/va1Wu2U506yQQ7fHKAHfDokp+gKBn2qANcOApYQhwLX2+ySX2+yUPApazpMzuH3:/vKoQYyAHUo+g1q8TaboPFXARIkiZ
MD5:	E6031F4E2795CE4EEFFEC14952EDD699
SHA1:	4D288C7AAB3CC27134EBCA76669026B4057CD9D5
SHA-256:	CAE8627A46500BAB7B8D2FA42586865F6546E78B69300C448E05AE19102C7987
SHA-512:	FB42050B9EAFED16595B7E6CE7F0AB2CA7268A4150FF2F3D6F7051A40FC62CE0AF145798FD7CF90811F1E88AEF0FC33C7DB3AD9FDD3CC36E2A932739ED14C72B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.._.........*.........#.......................Rich...........PE..L....v.`.........."!......................... ...............................P............@..........................%..l...l!..P............................@....................................................... ...............................text...m........................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\AhnInst.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5468
Entropy (8bit):	3.725691032566733
Encrypted:	false
SSDEEP:	96:npU5ByhxSdYGYrhYrNYrAYGYr7YGYrSYrNYrHYGYryPGUHmILYY24g:nm5B9f8h8N8Af87f8S8N8Hf8q1mUYX4g
MD5:	5902AFFAF9CF0EA28D11BAA528788293
SHA1:	F447B8353B3D61A2C85602CF14DD04C32BC321D9
SHA-256:	DA59F83163C46BD06A069807EF8A5FCD1D202270FA47BAB7933928F968EA106A
SHA-512:	F246C02958E0A1DB06BEFB03D97D8B160B28A8C2F3A69CD75E0A9F8A4A23955D9F131CF583A8AC37E6279DAA4EAB55748B4AAB30CDA6BF673E240A2D82A9DD39
Malicious:	false
Preview:	..@.A.h.n.I.n.s.t.L.o.g.1...0. .0.0.0.0.0.0.5.4.3.8.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....1.9.e.0.:. .........................................................1.9.e.0.:. . .A.h.n.L.a.b. .S.a.f.e. .T.r.a.n.s.a.c.t.i.o.n. .(.V.e.r.:.1...7...0...1.6.3.0.,. .2.0.2.2./.1.1./.2.8. .1.3.:.4.0.:.5.0.).....1.9.e.0.:. .........................................................1.9.e.0.:. .A.I.S. .v.e.r.=.3...1.0...6...1.1.....1.9.e.0.:. .A.I.S._.O.n.I.n.i.t.(.).....1.9.e.0.:. ...A.I.L.:.S.t.r.A.d.d.(.P.r.o.d.u.c.t.N.a.m.e.=.A.h.n.L.a.b. .S.a.f.e. .T.r.a.n.s.a.c.t.i.o.n.).....1.9.e.0.:. ...A.I.L.:.I.n.i.t.(.).....1.9.e.0.:. .....A.h.n.I.E.x. .v.e.r.=.3...1.0...6...3.5.....1.9.e.0.:. .....I.n.i.t.F.l.a.g.=.0.x.e.1.c.7.6.....1.9.e.0.:. .....L.a.n.g.I.D.=.1.0.3.3.....1.9.e.0.:. .....A.I.L.:.S.t.r.A.d.d.(.U.s.e.r.I.n.f.o.T.a.b.l.e.I.n.d.e.x.=.2.1.8.).....1.9.e.0.:. .....I.n.s.t.a.l.

C:\Windows\System32\drivers\AMonCDW7.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	203320
Entropy (8bit):	6.081440173056831
Encrypted:	false
SSDEEP:
MD5:	02E548E0641ACC66791036004D3098F8
SHA1:	A118739E2A62EDBA5241DE550BFC57C784F62409
SHA-256:	BFB270C00D7DBEAEAD95DBE9630EA37F4307A01E5D10324EF87E3DA6D075622F
SHA-512:	822597FCC34E0F0E1FB8957DE8CF2CD30271156550A7E10611236A2336B68B1D9576F1EB25D65320EEB3CA02E3DC84AAC5345067A6C17DAFD24A44E10BEDC544
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........l...l...l...2...l...1...l...l..#l...1...l...1...l...1...l...2...l...2...l...2...l...2...l..Rich.l..................PE..d...@..c.........." .....l...X...............................................@......# ....`.............................................8.......P.... .. .......t.......8R...0..(.......8........................... ................p...............................text...OV.......X.................. ..h.rdata...3...p...4...\..............@..H.data...............................@....pdata..t...........................@..H.gfids..............................@..H.edata..8...........................@..@INIT................................ ..b.rsrc... .... ......................@..B.reloc..(....0......................@..B................................................................................................................................

C:\Windows\System32\drivers\AMonCDW8.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	217024
Entropy (8bit):	6.073394498066033
Encrypted:	false
SSDEEP:
MD5:	3F24CAD3EEBA3C4E598BDED50814C3C2
SHA1:	7D148267FF92168E5735AE0EDE068BD598AF2219
SHA-256:	401206A4B7445D9B01742EFD1C73B20EC3B550166D5A38BF2FEB039996E3BD08
SHA-512:	A6955C9A7CF89C2438F1020F13D732284056E38332C953EFDAAFB6A852CF4E225ECE235BC2AC017369CCD730A10593AB73A79785359CA3FF73986EE5F6A6A25C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z+...J...J...J..s....J.......J..s....J...J...J..s....J..s....J..s....J.......J.......J....u..J.......J..Rich.J..........................PE..d...@..c.........." .........`.......0.......................................p............`.......................................... ..Y...\0..P....P.. .......(........O...`..(...0...8...........................p................................................text.............................. ..h.rdata...8.......:..................@..H.data...............................@....pdata..(...........................@..H.gfids..............................@..H.edata..Y.... ......................@..@INIT.........0...................... ..b.rsrc... ....P......................@..B.reloc..(....`......................@..B................................................................................................................

C:\Windows\System32\drivers\AMonHKnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89160
Entropy (8bit):	6.1361091588452785
Encrypted:	false
SSDEEP:
MD5:	03186C8DF0EDB6AAC7AF1682BAB6CF2B
SHA1:	7810E6D751DEF6CAD76AFD3B3A0AC6C5E433417D
SHA-256:	C847C2D3AC4DB2AB38A966CD8BCC82C504F8B60183E8E8973E062A1F1F47F06C
SHA-512:	1FEF416C4C976B465F0CDD62A514E0D96016A56FE57D5287AD7B23854D014B6C7D52D5F63B55FD766EA9DE0A16E97CE3E019F2A6104D9EC2227764E13A25B15A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..}..}..}..}......&..x...&..\|..Z}..~..Z}..\|...&..z..Z}..\|..Z}..r..Z}..\|..Z}..\|..Rich}..........PE..d...'&.b.........."..........$.......0.......................................`......?................................................ ..3...d0..<....@..........D.......HR...P..........................................................x............................text...y........................... ..h.rdata..L...........................@..H.data...............................@....pdata..D...........................@..H.edata..3.... ......................@..@INIT....^....0...................... ....rsrc........@......................@..B.reloc..0....P......................@..B................................................................................................................................................................................

C:\Windows\System32\drivers\AMonLWLH.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71320
Entropy (8bit):	6.508611684996172
Encrypted:	false
SSDEEP:
MD5:	431E04EBDF9BF0403EE689F8A1DFDFC3
SHA1:	E74E4846A34D29A4373FAE1230388411BF2E83B8
SHA-256:	187A08D268EF09AA7C9EDF6C49642451FF14BA7455B0A8F01B0585FC8B2B2AAF
SHA-512:	46174E1BE2BC7D8AD0B89A6ECE07730408A35399CBF740FC69FAC7040A60782E70C2443C1976C5530D33243FD29D0EB3304B04A13670CE435BDBE72A17DDE51C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p...#...#...#.s.#...#...#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#.(.#...#Rich...#........PE..d...m7.].........."................................................................./C..................................................3...d...<...............\|........d..........................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..\|...........................@..H.edata..3...........................@..@INIT................................ ....rsrc...............................@..B.reloc..0...........................@..B........................................................................................................................................................................................

C:\Windows\System32\drivers\AMonTDLH.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155488
Entropy (8bit):	5.971299991395469
Encrypted:	false
SSDEEP:
MD5:	CA458A30EE04278B2C99B4F9888A456F
SHA1:	2A6BCA16ED7ABEA6489F6808CD2F7960667C32D5
SHA-256:	A36452DC60A867925CD836C530FAA37ABB7164E9B57BEB8F41FCC8F1657A73EB
SHA-512:	57751042F276CE871D9419CCF03C837D41C3446EB8D287DC4686F4CE8A317598A5F70B639BBD4C5D4248B78B826527D339D944B15D9DEE836DF89FC13455D7EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D..D..D..)..D..E.].D..S?..D..S..D..S9..D..S)..D..S>..D..S5..D..S8..D..S<..D.Rich.D.........PE..d...=.Bb.........."..........>.......@.......................................p.......P...............................................0..8...d@..P....P..........\|.......`K...`..<...p...................................................p............................text...`........................... ..h.rdata..............................@..H.data...x...........................@....pdata..\|...........................@..H.edata..8....0......................@..@INIT.........@...................... ....rsrc........P......................@..B.reloc..P....`......................@..B................................................................................................................................................................................

C:\Windows\System32\drivers\AMonTDnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	170848
Entropy (8bit):	5.90588176587215
Encrypted:	false
SSDEEP:
MD5:	D574CE304863D2596EDA05616D20D69B
SHA1:	46E0D6495233099ADD799094B3BA5A9D6D69C4E8
SHA-256:	F8C950DDE7397CB2FD7794944024BC282EF50EA5D8E785E72FA2F9B60557C1FA
SHA-512:	58D84A95110A81DC6C5E8E3F25C599456C2BCAF1E4076644DA658980DB463B01D5869765E114EFC8D745973C50F0C5BE921226C8DCB8F41B5D0D7FBBF1CF3FFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......GZ7-.;Y~.;Y~.;Y~.;X~.;Y~u."~.;Y~$.4~.;Y~$.$~.;Y~u.4~.;Y~$.#~.;Y~$.(~.;Y~$.%~.;Y~$.!~.;Y~Rich.;Y~........................PE..d...=.Bb.........."..........>......................................................8................................................p..8...d...P............P.. ....P..`K......H...p#............................................... ..p............................text...`........................... ..h.rdata....... ......................@..H.data...0....@......................@....pdata.. ....P......."..............@..H.edata..8....p.......6..............@..@INIT.................<.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................

C:\Windows\System32\drivers\AhnRghNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84728
Entropy (8bit):	6.275471101510284
Encrypted:	false
SSDEEP:
MD5:	70DED0AEB037D93D8367B9BFD2C0732D
SHA1:	09C85128610A56B14860342EF6A6D7616AE606C6
SHA-256:	4D36C2B219A7D1800381FEC548A68948CC12AB9D2D44754AF61F631E306A3262
SHA-512:	425F82B8BE0B9869DBE23ED7E72ADC5341F6891EED6AA99B8ED5068AAC9AC8569163540A92665B84D24194B9FED2A039B69EDDFB37822A645E792C330048BAF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h(F..F...F...F...G...F..TG...F..TC...F..TE...F..TB...F.sWB...F.sW....F.sWD...F.Rich..F.........PE..d...Z.qb.........."..........b.......`.........@....................................E........................................................`..(....p.......@...........H...... .......8...........................P................................................text............................... ..h.rdata..............................@..H.data....B..........................@....pdata.......@......................@..H.gfids.......P......................@..HINIT.........`...................... ..b.rsrc........p......................@..B.reloc.. ...........................@..B................................................................................................................................................................................................

C:\Windows\System32\drivers\Cdm2DrNt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92632
Entropy (8bit):	6.674944255059838
Encrypted:	false
SSDEEP:
MD5:	69B34600118F281D507261F04A8FAB66
SHA1:	957942CCE6C8289119513B184B5EAC04E14E03FC
SHA-256:	E05D1F6470F50F2F46481AC799C96F65FEBEADAF3AA50B48172C4BF76BC7B975
SHA-512:	D960BB343E5DBC885A1B3C9DECF733525F9186084987B8C8403953B61F5B8ACD53E58A82F8D9074B0AB9BE90D810666F13A0509DFC179BCD1BA51A067B4CB48E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[..[..[..[...[......[......[......[..4...[..4...[..4.:.[..4...[..Rich.[..........................PE..d....~.b.........." .........l.......`...............................................W....`..........................................P.......`..(....p.......0...........O..............8...............................................p............................text............................... ..h.rdata..TX.......Z..................@..H.data... .... ......................@....pdata.......0......................@..H.gfids.......@......................@..H.edata.......P......................@..@INIT....x....`...................... ..b.rsrc........p......................@..B.reloc..............................@..B........................................................................................................................................

C:\Windows\System32\drivers\HsbDrv64.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178624
Entropy (8bit):	6.154085729231531
Encrypted:	false
SSDEEP:
MD5:	5681909BC6996A5F8AF15985CA222778
SHA1:	45BA737EE702E0307D3607B4B70C3BAA7D74088F
SHA-256:	E2E6F3067E89F67E470701BF0890F87A8DF58C3629A7F4B122A59D10F0CE8B0D
SHA-512:	DE60FF64CC9ECE1DECCEAEA108110CC7B53622F6B3CF624A87F86CA0763DD45EB6AC0384A95092F549B467247A81B28633B200B5A280D4B399821F3C42B015B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N.W.N.W.N.W.N.W.N.W..V.N.W..V.N.W.*.V.N.W.'.V.N.W.'&W.N.W.'.V.N.WRich.N.W................PE..d.....b.........."..........z.................@...........................................A....................................................(.......0....p.......j...O...... ...0S..8...........................pS..................@............................text............................... ..h.rdata...Z.......\..................@..H.data........`.......L..............@....pdata.......p.......N..............@..HINIT.................X.............. ..b.rsrc...0............b..............@..B.reloc.. ............h..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\Mkd2Nadr.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	195528
Entropy (8bit):	6.077374996014525
Encrypted:	false
SSDEEP:
MD5:	A5DEE08B25BE259017ABA062DE62A8F4
SHA1:	A0630F5EF42611CACD32ADAB662F722060CBB260
SHA-256:	D670E36344AFAE809588CF7B0476C4A9322A977DC3832A9E4B92BECE558A429C
SHA-512:	B45562FA433645645C7EDA4E7CACEDB3C7BA077D1D2A2D524076E15703278AC58C6E5765C74EBD79FFF0FDD333AA21CBAC93686BACD9578C4B7AC21BBD8251FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.3...]...]...].y.Y...].y.^...].y.\...]...\.W.].Y...].....]._...].Rich..].........................PE..d......b.........."......,...~.................@.....................................}....`A....................................................P...............X........O..............8...........................................@.. ............................text...$!.......".................. ..h.rdata..\|^...@...`...&..............@..H.data...P...........................@....pdata..X...........................@..HINIT................................ ..b.rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\drivers\Mkd2bthf.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	154048
Entropy (8bit):	6.152804361167168
Encrypted:	false
SSDEEP:
MD5:	DA9F775610EBB9EF7BAEFDB916033ADA
SHA1:	F4A659ECD5CD10C43ED9E7EA4B08EA94EEBFF3BC
SHA-256:	B666B68C6BC91C3D676CB3BEC67BCF22BCA35305726831E82131902149185401
SHA-512:	D1A4838CE6183FBA94F24AF2A1A12E21E724691EBB01CA5E2CB968EA6025A229FE7AE0E29D7BB2B395F52442B602923543E2FADB592FFFC903CC18A0444FE724
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j;...Z...Z...Z...Z...Z..A>..-Z..A>..+Z..A>..+Z..3.. Z..3=./Z..3../Z..Rich.Z..........PE..d......b.........."..........l.......0.........@.............................`............`A.................................................0..(....@....... ...........O...P...... ...8...........................`................................................text...B........................... ..h.rdata...W.......X..................@..H.data...............................@....pdata....... ......................@..HINIT.........0...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Windows\System32\drivers\V3ElamDr.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	11060
Entropy (8bit):	7.299919649499237
Encrypted:	false
SSDEEP:
MD5:	D2D74621B89258D22B9B372C53007E4E
SHA1:	7ED8D616B711C7A16CC3233467E32F01AFA8B2C0
SHA-256:	1BDF93E02B701495EDF5165B42C504FAE8A40BF6245CD13082A2E86F7A48B805
SHA-512:	B2C485D65B0958A4448006A4C389B4D992E85D4680FE912C2DCF3F53CF546B3106D4033F68BC7C1EC83A40E2CBD6C8AEFB3B33D53489F4964D86BDD2496C2A89
Malicious:	false
Preview:	0.+0...H........+!0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....=......B.W..c...220218064208Z0...+.....7.....0..X0.... .}.6....U.....(.....I.g.2m.j.._.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}.6....U.....(.....I.g.2m.j.._.0......1<.">.i.{r..q.I..U1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...i.n.f...0.... .".!.Sex0.(...jE9.b...A..#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .".!.Sex0.(...jE9.b...A..#...0..........%V..!...F._n1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........v.3.e.l.a.m.d.r...s.y.s......30../0J.

C:\Windows\System32\drivers\V3ElamDr.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.0535325046738295
Encrypted:	false
SSDEEP:
MD5:	60EF12FB5FCCA038EA99C77440E4A073
SHA1:	CBDB313CA5223E1B69A77B729EFC718449A9BE55
SHA-256:	0D7DD636D016820255B6820DC09F2897E9F8C3D549CE67B5326DA46AA1945FDE
SHA-512:	4441A8B2E97ECB8E8718E4C5F326B0462EE79F05057DFE9D4186AB3B4ECD5672983A785CC9EFDBBDDC23A9E5F0CE5580BB26B6D680339A78A51EFDBD6415726D
Malicious:	false
Preview:	;;;..;;; V3ElamDr..;;;..;;;..;;; Copyright (c) AhnLab.Inc All rights reserved...;;;....[SignatureAttributes]..V3ElamDr.sys=SignatureAttributes.Elam....[SignatureAttributes.Elam]..Elam=true....[Version]..signature .= "$Windows NT$"..Class..= "AhnLabELAM"....;This is determined by the work this filter driver does..ClassGuid .= {D7D1DBFC-3F64-4684-99A3-EA59FCB7FDBC}.;This value is determined by the Class..Provider .= %AhnLab%..DriverVer .= 07/14/2012, 9.0.0.3..CatalogFile = V3ElamDr.cat ; A CatalogFile entry is required for a WHQL signature... ; The actual catalog file will be provided by WHQL. The.. ; catalog file for this sample is not provided for use...[DestinationDirs]..DefaultDestDir. = 12..V3ElamDr.DriverFiles = 12... ..;%windir%\system32\drivers..V3ElamDr.BackupFiles. = 10,ELAMBKUP....[SourceDisksNames

C:\Windows\System32\drivers\V3ElamDr.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26552
Entropy (8bit):	6.238330022661952
Encrypted:	false
SSDEEP:
MD5:	5340F8746457FA07150A1BE143AA329B
SHA1:	1F09565BE2959D1F96EFEE1D92379EEF3022D0CD
SHA-256:	4B364217AE68446BDAEAF61465ACB99ACA1E0851FD8585EA9B926217A247ECF0
SHA-512:	A4AB7873D0E64BBDEE78B7EBC2894C8EEC4F328503882C6AE4C24E8DEF6039F4653FFC3DAD93F419707A1BC277CAB8C406B15F290C5D68878C0C48D92AC51089
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'..'..'...z..'..^Pg.'..'..'...z..'...z..'...z..'...z..'...z..'..0y..'..0y!.'..0y..'..Rich.'..........PE..d...}:.b.........."......(...*.......!.........@....................................>m....`.....................................................<....... ....p.......F...!......$....@..8............................A...............@...............................text...v .......".................. ..h.rdata.......@.......&..............@..H.data........P.......,..............@....pdata.......p......................@..H.gfids...............0..............@..HINIT....b............2.............. ..b.rsrc... ............8..............@..B.reloc..$............D..............@..B........................................................................................................................................................................

C:\Windows\System32\drivers\klb64mkd.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	data
Category:	dropped
Size (bytes):	147
Entropy (8bit):	6.702261355184907
Encrypted:	false
SSDEEP:
MD5:	E7D39852C968C498D7B0880D64B5D5C3
SHA1:	D7A65018CCAFE92465281C82BABFB202C48EAAA8
SHA-256:	9282B7F5291BDAA832A2FFFF23FBDB1462942E14071710718C47811046E70EE1
SHA-512:	34FFC4EC487FE269858A05FA3755053B7A409927822803D6C7C313CE8E941456C21A3E43499E3BCC57ADAB466CF43AA6759689F3A363FD260273817B213BD606
Malicious:	false
Preview:	KLIB_MODSIGN_V1$$$$s.j.X......M)..}.!..o\...'..^.;.&..zG.......X...*z9k.E..Q(uY...-w...VL.5.].<S.B.\|.2X.5...7..$....5.n.....o...&......dv..

C:\Windows\System32\drivers\klb64mkd.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176784
Entropy (8bit):	5.720763208103024
Encrypted:	false
SSDEEP:
MD5:	AA5AD93780DA8F74BFF806743CB1C351
SHA1:	99BF97C164F7FCB25B5F10B985CEF3B75328DFD3
SHA-256:	D5A787F5D139FA9FF8F3C748BF1085DB41077EF7549775CDAB4F239C4BC10224
SHA-512:	4BDCB83797F103D6BA890BD217565A950F4D1378D818A1C338DA950EAEED4694ADB241A9DAE11127A5E5B1DFA7C302DC952E10D50287FCCEFD3622203FCA8907
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E2..$\W.$\W.$\W.$]W.$\W..'W.$\W..!W.$\W..&W.$\W..1W.$\W$+.W.$\W..$W.$\WRich.$\W........................PE..d....U.T..........".................@................................................\..........................................................<...............p....r...@...........................................................................................text...r........................... ..h.rdata..\5.......6..................@..H.data....c...0...D..................@....pdata..p............Z..............@..H.edata...............d..............@..@INIT.................f.............. ....rsrc................j..............@..B.reloc...............n..............@..B........................................................................................................................................................................................

C:\Windows\System32\drivers\mkd3kfnt.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235952
Entropy (8bit):	6.443902757897077
Encrypted:	false
SSDEEP:
MD5:	8ABD5664A08ACFC33E4200B8F7A4B289
SHA1:	3E2598194066DC9C3700B3B7E7AE92E5DD6C112A
SHA-256:	71187C37B27B4B99954C44A963D141F111561F37888B64BF9559A4D5AFACB001
SHA-512:	1F0B43CE332405B7453C0D5490E805A6EB1B51472CC4408B5A0079CADA0AB24AC8559DCFC6DB231458F061D4D57F094DFE58389EF91410A5C2D7796A22F36E41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;.l.Za?.Za?.Za?.Z`?.Za?.>`>.Za?.>b>.Za?.>e>.Za?.>d>.Za?(3b>.Za?(3e>.Za?(3.?.Za?(3c>.Za?Rich.Za?........PE..d......b.........."............................@.....................................\|....`A....................................................(............`.......J...O......<....&..8............................&..................H............................text...J........................... ..h.rdata..,...........................@..H.data........@......................@....pdata.......`.......&..............@..HINIT.................:.............. ..b.rsrc................D..............@..B.reloc..<............H..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999983994478894
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	astx_setup.exe
File size:	81412376
MD5:	7dd75b2c2e214c0347df3dc137161b19
SHA1:	072a03d9279d3ecbdb5a76c70a862a75fb50d95b
SHA256:	06f360d2a25c75619cb769f56ced75d3d92cd339cb3ec2e3aa9c642ba6f3158f
SHA512:	0e0b29069e12ac20c5ca34be9daa14415fefba2503e36fef65e35d3135c729111855d6c31baf3f29257242fbc41f3ae90f3cc15df43cd04fe3172488ad7d7791
SSDEEP:	1572864:V/kvfSyDj2/tdz2XqzpQWvrb8bKjCuss/4CSKdwdLexZyUemQr7VbY7:VOXO/tohWUbiCussB1WdLePtemk7t
TLSH:	3A0833B8BCC9E210FF3AF97DC25EB1A0F5502C035C64E42E5F0612947BF7A996360696
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................M.............h.......m.....Rich....................PE..L...9v.`.................d...,.....

File Icon


Icon Hash:	70fcd2afcbfaf021

Static PE Info

General

Entrypoint:	0x403528
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x609C7639 [Thu May 13 00:43:37 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	25ed4ce053872020aef1006182cbb182

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	1/10/2022 1:00:00 AM 1/8/2023 12:59:59 AM
Subject Chain	CN="AhnLab, Inc.", O="AhnLab, Inc.", L=Seongnam-si, S=Gyeonggi-do, C=KR, SERIALNUMBER=110111-1138985, OID.1.3.6.1.4.1.311.60.2.1.1=Seongnam-si, OID.1.3.6.1.4.1.311.60.2.1.2=Gyeonggi-do, OID.1.3.6.1.4.1.311.60.2.1.3=KR, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	6EBDE07766B873648E04CE4C1362C752
Thumbprint SHA-1:	D9A0D370CD710CC4344B17AF5AD3351264437570
Thumbprint SHA-256:	EDE44A2FD6E42811226397C469421B503C7F9EE60D0186E5AD6DD08D5E9DA058
Serial:	0DDDA3FAE15DDCB377EFDCE3AA6BC2A5

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 00408450h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A4h]
call dword ptr [004080C4h]
and eax, BFFFFFFFh
mov dword ptr [00429D40h], eax
cmp ax, 0006h
je 00007FC64086B4A3h
push ebx
call 00007FC64086DFFEh
cmp eax, ebx
je 00007FC64086B499h
push 00000C00h
call eax
mov esi, 00408510h
push esi
call 00007FC64086DF78h
push esi
call dword ptr [0040812Ch]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FC64086B47Dh
push 0000000Ch
call 00007FC64086DFD2h
push 0000000Ah
call 00007FC64086DFCBh
push 00000008h
mov dword ptr [00429D44h], eax
call 00007FC64086DFBFh
cmp eax, ebx
je 00007FC64086B4A4h
push 0000001Eh
call eax
test eax, eax
je 00007FC64086B49Ch
or dword ptr [00429D40h], 40000000h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [0040829Ch]
push ebx
push 000002B4h
mov dword ptr [00429E38h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebx
push 004085E8h
call dword ptr [00408184h]
push 004085D0h

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x89b4	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x19f88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4da1700	0x2a18
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63d7	0x6400	False	0.6702734375	data	6.482645761656697	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1838	0x1a00	False	0.4248798076923077	data	4.816710225566031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1fe3c	0x200	False	0.2265625	data	1.730463198659969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x11000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0x19f88	0x1a000	False	0.7925837590144231	data	7.4146495664247976	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3b388	0x10e9a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x4c228	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x4e7d0	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 6912	English	United States
RT_ICON	0x50478	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x51520	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x523c8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States
RT_ICON	0x53070	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x53918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x53e80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_ICON	0x542e8	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States
RT_DIALOG	0x54650	0x100	data	English	United States
RT_DIALOG	0x54750	0x11c	data	English	United States
RT_DIALOG	0x54870	0x60	data	English	United States
RT_GROUP_ICON	0x548d0	0x92	data	English	United States
RT_VERSION	0x54968	0x2d0	data	English	United States
RT_MANIFEST	0x54c38	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegDeleteKeyW, RegCloseKey, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegSetValueExW, RegDeleteValueW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	ShellExecuteExW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, SHFileOperationW, SHGetSpecialFolderLocation
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	GetDlgItemTextW, SetDlgItemTextW, RegisterClassW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, SetWindowPos, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, CreateDialogParamW, EndDialog, GetSystemMetrics, CreatePopupMenu, AppendMenuW, GetWindowRect, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, ScreenToClient, CheckDlgButton, LoadCursorW, MessageBoxIndirectW, GetWindowLongW, GetSysColor, CharNextW, ExitWindowsEx, DestroyWindow, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, CharPrevW, DispatchMessageW, wsprintfA, SetCursor, PeekMessageW, SystemParametersInfoW
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	CreateProcessW, lstrcmpiA, GetTempFileNameW, WriteFile, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, lstrcatW, GetCurrentProcess, GetVersion, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, RemoveDirectoryW, lstrcpyA, MoveFileExW, CopyFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2022 13:42:39.917131901 CET	63642	53	192.168.2.3	1.1.1.1
Nov 28, 2022 13:42:39.948183060 CET	53	63642	1.1.1.1	192.168.2.3
Nov 28, 2022 13:42:40.051069021 CET	52540	53	192.168.2.3	1.1.1.1
Nov 28, 2022 13:42:40.077526093 CET	53	52540	1.1.1.1	192.168.2.3
Nov 28, 2022 13:42:46.376266956 CET	57418	53	192.168.2.3	1.1.1.1
Nov 28, 2022 13:42:46.666229010 CET	53	57418	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2022 13:42:39.917131901 CET	192.168.2.3	1.1.1.1	0x1cc3	Standard query (0)	gms.ahnlab.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:40.051069021 CET	192.168.2.3	1.1.1.1	0x68bb	Standard query (0)	gms.ahnlab.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:46.376266956 CET	192.168.2.3	1.1.1.1	0xf392	Standard query (0)	webclinic.ahnlab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2022 13:42:39.948183060 CET	1.1.1.1	192.168.2.3	0x1cc3	No error (0)	gms.ahnlab.com	gms.wip.ahnlab.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 13:42:39.948183060 CET	1.1.1.1	192.168.2.3	0x1cc3	No error (0)	gms.wip.ahnlab.com		34.249.110.217	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:40.077526093 CET	1.1.1.1	192.168.2.3	0x68bb	No error (0)	gms.ahnlab.com	gms.wip.ahnlab.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 13:42:40.077526093 CET	1.1.1.1	192.168.2.3	0x68bb	No error (0)	gms.wip.ahnlab.com		211.115.106.72	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:46.666229010 CET	1.1.1.1	192.168.2.3	0xf392	No error (0)	webclinic.ahnlab.com	webclinic.ahnlab.com.cdngc.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 13:42:46.666229010 CET	1.1.1.1	192.168.2.3	0xf392	No error (0)	webclinic.ahnlab.com.cdngc.net		101.79.212.66	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:46.666229010 CET	1.1.1.1	192.168.2.3	0xf392	No error (0)	webclinic.ahnlab.com.cdngc.net		101.79.212.97	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:46.666229010 CET	1.1.1.1	192.168.2.3	0xf392	No error (0)	webclinic.ahnlab.com.cdngc.net		163.171.75.97	A (IP address)	IN (0x0001)	false
Nov 28, 2022 13:42:46.666229010 CET	1.1.1.1	192.168.2.3	0xf392	No error (0)	webclinic.ahnlab.com.cdngc.net		163.171.75.66	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:40:29
Start date:	28/11/2022
Path:	C:\Users\user\Desktop\astx_setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\astx_setup.exe
Imagebase:	0x400000
File size:	81412376 bytes
MD5 hash:	7DD75B2C2E214C0347DF3DC137161B19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2413738502.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	13:40:30
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C "ECHO Y\| cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)"
Imagebase:	0x390000
File size:	236032 bytes
MD5 hash:	4943BA1A9B41D69643F69685E35B2943
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	3
Start time:	13:40:30
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff74e0f0000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	13:40:30
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"
Imagebase:	0x390000
File size:	236032 bytes
MD5 hash:	4943BA1A9B41D69643F69685E35B2943
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	13:40:31
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	cacls C:\Users\user\AppData\Local\Temp\asfB6FB.tmp /s:D:PAI(A;;FA;;;BA)
Imagebase:	0x630000
File size:	27648 bytes
MD5 hash:	B304B0EF47E125F696425BD99096D3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	13:40:49
Start date:	28/11/2022
Path:	C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\asfB6FB.tmp\V3Medic.exe"
Imagebase:	0x400000
File size:	1294968 bytes
MD5 hash:	F4116873D9C057697783C2C128708617
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	15
Start time:	13:40:53
Start date:	28/11/2022
Path:	C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Imagebase:	0x400000
File size:	95728 bytes
MD5 hash:	9005E21833E657558F139A3D3945C97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	13:40:53
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff74e0f0000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	17
Start time:	13:40:58
Start date:	28/11/2022
Path:	C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\nsdE18B.tmp\SysX64.exe
Imagebase:	0x400000
File size:	95728 bytes
MD5 hash:	9005E21833E657558F139A3D3945C97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	13:40:59
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff74e0f0000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.3%
Total number of Nodes:	133
Total number of Limit Nodes:	7

Executed Functions

Function 100FA845 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 100FA868
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 100FA878
_memset.LIBCMT ref: 100FA899
GetVersionExW.KERNEL32(?), ref: 100FA8A8
CreateMutexW.KERNELBASE(?,00000000,Global\_Mutex_AIL_Log_), ref: 100FA8C4
CreateMutexW.KERNEL32(?,00000000,_Mutex_AIL_Log_), ref: 100FA8DD
GetCurrentProcessId.KERNEL32 ref: 100FA8E4

Strings

18cc: , xrefs: 100FA8F2, 100FA8F7, 100FA907
Global\_Mutex_AIL_Log_, xrefs: 100FA8BA
_Mutex_AIL_Log_, xrefs: 100FA8D3
%x: , xrefs: 100FA8EB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CreateDescriptorMutexSecurity$CurrentDaclInitializeProcessVersion_memset
String ID: %x: $18cc: $Global\_Mutex_AIL_Log_$_Mutex_AIL_Log_
API String ID: 32204487-1247887270
Opcode ID: 5434310d2436ad30de44d782ab64c81c8002cac7f23df6ecfc7324712f53812b
Instruction ID: 08bc467aceb7f9b2971a43f8ea8e4cbd36d6f59fc47abdf703c775a191dc3e82
Opcode Fuzzy Hash: 5434310d2436ad30de44d782ab64c81c8002cac7f23df6ecfc7324712f53812b
Instruction Fuzzy Hash: A62139B290022CABDB20DBA48C89EDE7BBCFB85304F40452AF904E7140EBB85649CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10105871 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,100FF377,00000001,?,?,?,100FF4F0,?,?,?,1016B468,0000000C,100FF5AB), ref: 10105886

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 22a0a3b02109f1abe6196b7eefe36aeaa4cf366423e30f023b4c0f7fca7a9548
Instruction ID: bd1e2e24618afe4b1b49431c40e2ff5888f6702a7a7066471cfa3ef226f164b8
Opcode Fuzzy Hash: 22a0a3b02109f1abe6196b7eefe36aeaa4cf366423e30f023b4c0f7fca7a9548
Instruction Fuzzy Hash: E0D097325903855ED7004FB1AD487223BECF380380F008472F80DC2944F23CC480CA10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1000B0F4 Relevance: 107.8, APIs: 9, Strings: 52, Instructions: 1012COMMON

Download Yara Rule

APIs

Part of subcall function 10005B3C: GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,00000000), ref: 10005BC9
Part of subcall function 10005B3C: GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,?), ref: 10005BFA
Part of subcall function 10005B3C: GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,?), ref: 10005C10

AhnIEx_SetMode.AHNIEX(?,?,?,?,?,BrandingText,?,?,00000000,101158CE,000000FF,?,100012AE), ref: 1000B44E
AhnIEx_GetMode.AHNIEX(?,EvaluationPeriod,?,?,?,?,?,?,APC,?), ref: 1000B564
AhnIEx_GetMode.AHNIEX(?,APC,?), ref: 1000B5E1

Strings

URLHomepage, xrefs: 1000B36E, 1000B383, 1000B39E
User, xrefs: 1000B9E9, 1000BAFA, 1000BC1E, 1000BCE1
CreateShortcutOnStartMenu, xrefs: 1000B7EB, 1000B813, 1000B82E
%ExeDir%\BldInfo.ini, xrefs: 1000BD09
PublisherNickName, xrefs: 1000B293, 1000B2C7, 1000B2E2
Publisher, xrefs: 1000B22E, 1000B262, 1000B27D
APC, xrefs: 1000B462, 1000B471, 1000B4BE, 1000B4D9
RegisteredDepartment, xrefs: 1000BC60, 1000BC7D
Jump, xrefs: 1000BE0B, 1000BE10, 1000BE99
StartMenuDir, xrefs: 1000B72A, 1000B775, 1000B790
APC2, xrefs: 1000B487
ChildSetup, xrefs: 1000BDBA
UserProductNumber, xrefs: 1000BCC1, 1000BCF5
AhnLab, Inc., xrefs: 1000B246
JumpNext, xrefs: 1000BE46, 1000BE7E
UserDepartment, xrefs: 1000BBFA, 1000BCA5
CreateUninstallShortcut, xrefs: 1000B83A, 1000B862, 1000B87D
Software\Microsoft\Windows\CurrentVersion, xrefs: 1000BAA1, 1000BBB5, 1000BC8C
UserOrganization, xrefs: 1000BAD6, 1000BBCE
URLOnlineRegistration, xrefs: 1000B3B4, 1000B3C9, 1000B3E4
UserInfoTableIndex, xrefs: 1000B966
Scenario, xrefs: 1000B553, 1000B558, 1000B5D0, 1000B5D5, 1000B69C, 1000B72F, 1000B7A1, 1000B7F0, 1000B83F, 1000B890, 1000B909
silent, xrefs: 1000B417
BuildNumber, xrefs: 1000BD32, 1000BD52, 1000BD57, 1000BD6E
DeleteRecycledData, xrefs: 1000B904, 1000B932, 1000B94D
JumpFlag, xrefs: 1000BEAE
nonstop, xrefs: 1000B42A
EvaluationPeriod, xrefs: 1000B4F4, 1000B51C, 1000B537
AfterReboot, xrefs: 1000BD7E, 1000BD83, 1000BD97, 1000BDAA, 1000BDEB, 1000BDFE
Build, xrefs: 1000BD37
Department, xrefs: 1000BC19
Organization, xrefs: 1000BAF5
UserName, xrefs: 1000B9C5, 1000BABA
%PublisherNickName%\%ProductName%, xrefs: 1000B742
BrandingText, xrefs: 1000B2FA, 1000B32E, 1000B349
InstDir, xrefs: 1000B66D, 1000B67E, 1000B697, 1000B6F2, 1000B712
Name, xrefs: 1000B9E4
UninstallMode, xrefs: 1000B5CB, 1000B624, 1000B63F
RegisteredOwner, xrefs: 1000BA75, 1000BA92
%ProgramFilesDir%\%PublisherNickName%\%ProductName%, xrefs: 1000B6B5
RebootType, xrefs: 1000B88B, 1000B8DD, 1000B8F8
ReinstallMode, xrefs: 1000B54E, 1000B5A7, 1000B5C2
RegisteredOrganization, xrefs: 1000BB89, 1000BBA6
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 1000BA7C, 1000BB90, 1000BC67
Mode, xrefs: 1000B3F2, 1000B456
InstallInfo:GetInstallInfo, xrefs: 1000B12F
Main, xrefs: 1000B14F, 1000B17D, 1000B233, 1000B298, 1000B2FF, 1000B373, 1000B3B9, 1000B3F7, 1000B467, 1000B4F9
AhnLab Installation System, xrefs: 1000B312
CreateShortcutOnDesktop, xrefs: 1000B79C, 1000B7C4, 1000B7DF
ProductName, xrefs: 1000B15F, 1000B178, 1000B19B, 1000B1FA, 1000B216
ProductNumber, xrefs: 1000BCDC
AhnLab, xrefs: 1000B2AB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ModePrivateProfileString
String ID: %ExeDir%\BldInfo.ini$%ProgramFilesDir%\%PublisherNickName%\%ProductName%$%PublisherNickName%\%ProductName%$APC$APC2$AfterReboot$AhnLab$AhnLab Installation System$AhnLab, Inc.$BrandingText$Build$BuildNumber$ChildSetup$CreateShortcutOnDesktop$CreateShortcutOnStartMenu$CreateUninstallShortcut$DeleteRecycledData$Department$EvaluationPeriod$InstDir$InstallInfo:GetInstallInfo$Jump$JumpFlag$JumpNext$Main$Mode$Name$Organization$ProductName$ProductNumber$Publisher$PublisherNickName$RebootType$RegisteredDepartment$RegisteredOrganization$RegisteredOwner$ReinstallMode$Scenario$Software\Microsoft\Windows NT\CurrentVersion$Software\Microsoft\Windows\CurrentVersion$StartMenuDir$URLHomepage$URLOnlineRegistration$UninstallMode$User$UserDepartment$UserInfoTableIndex$UserName$UserOrganization$UserProductNumber$nonstop$silent
API String ID: 1894349426-2082289680
Opcode ID: 961af9a6d6c1ba42bef9e525480bb244038df5bb1ce87e40e99d636abcb2ab8c
Instruction ID: 4f9d662567acf429643580ff533d79a7283524eca030de0def3892734bdf4773
Opcode Fuzzy Hash: 961af9a6d6c1ba42bef9e525480bb244038df5bb1ce87e40e99d636abcb2ab8c
Instruction Fuzzy Hash: 8F6285B65002CD6AFB64DEB0DD41FEF32ACEF05284F440925FD19AD185EFB4AAC48661

Uniqueness

Uniqueness Score: -1.00%

Function 100151A4 Relevance: 96.7, APIs: 49, Strings: 6, Instructions: 494
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32(?,everyone,1016AF58,0000007C,10002BC2,?,?,?,?,00000040,?,?,00000104,?), ref: 100151DC
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10015209
GetLastError.KERNEL32 ref: 1001521C
LookupAccountNameW.ADVAPI32(00000000,?,?,?,00000000,?,?), ref: 1001525C
GetLastError.KERNEL32 ref: 1001526F
GetProcessHeap.KERNEL32(00000008,?), ref: 100152A4
HeapAlloc.KERNEL32(00000000), ref: 100152B1
GetProcessHeap.KERNEL32(00000008,?), ref: 100152BE
HeapAlloc.KERNEL32(00000000), ref: 100152C5
LookupAccountNameW.ADVAPI32(00000000,?,?,?,00000000,?,?), ref: 100152EF
GetLastError.KERNEL32 ref: 100152FD
GetFileSecurityW.ADVAPI32(?,00000004,00000000,00000000,?), ref: 10015325
GetLastError.KERNEL32 ref: 10015333
GetProcessHeap.KERNEL32(00000008,?), ref: 10015363
HeapAlloc.KERNEL32(00000000), ref: 1001536A
GetFileSecurityW.ADVAPI32(?,00000004,00000000,?,?), ref: 1001538C
GetLastError.KERNEL32 ref: 1001539A
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 100153BB
GetLastError.KERNEL32 ref: 100153C9
GetSecurityDescriptorDacl.ADVAPI32(?,?,00000000,?), ref: 100153F4
GetLastError.KERNEL32 ref: 10015402
GetAclInformation.ADVAPI32(00000000,?,0000000C,00000002), ref: 10015441
GetLastError.KERNEL32 ref: 1001544F
GetLengthSid.ADVAPI32(?), ref: 1001546A
GetProcessHeap.KERNEL32(00000008,00000008), ref: 1001547A
HeapAlloc.KERNEL32(00000000), ref: 10015481
InitializeAcl.ADVAPI32(?,00000008,00000002), ref: 1001549D
GetLastError.KERNEL32 ref: 100154B1
GetAce.ADVAPI32(00000000,?,?), ref: 100154FB
GetLastError.KERNEL32 ref: 10015509
EqualSid.ADVAPI32(?,?), ref: 1001552D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 10015545
GetLastError.KERNEL32 ref: 10015553
AddAccessAllowedAce.ADVAPI32(?,00000002,?,?), ref: 1001557B
GetLastError.KERNEL32 ref: 10015589
GetAce.ADVAPI32(?,?,?), ref: 100155A5
GetAce.ADVAPI32(00000000,?,?), ref: 100155D4
GetLastError.KERNEL32 ref: 100155E2
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 10015604
GetLastError.KERNEL32 ref: 10015612
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 10015637
GetLastError.KERNEL32 ref: 10015645
GetModuleHandleW.KERNEL32(advapi32.dll,SetSecurityDescriptorControl), ref: 10015663
GetProcAddress.KERNEL32(00000000), ref: 1001566A
GetSecurityDescriptorControl.ADVAPI32(?,?,?), ref: 1001568D
GetLastError.KERNEL32 ref: 1001569B
GetLastError.KERNEL32 ref: 100156E5
SetFileSecurityW.ADVAPI32(?,00000004,?), ref: 10015703
GetLastError.KERNEL32 ref: 10015711

Strings

everyone, xrefs: 100151D6
SetSecurityDescriptorControl, xrefs: 10015659
AIL:AddAccessRightsToFile(%s) err=0x%x, xrefs: 10015742
W, xrefs: 10015347
advapi32.dll, xrefs: 1001565E
AIL:AARTF(%s)=ok, xrefs: 100157C8

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Heap$Security$AllocDescriptorProcess$FileInitialize$AccountDaclLookupName$AccessAddressAllocateAllowedControlEqualHandleInformationLengthModuleProclstrcmpi
String ID: AIL:AARTF(%s)=ok$AIL:AddAccessRightsToFile(%s) err=0x%x$SetSecurityDescriptorControl$W$advapi32.dll$everyone
API String ID: 2961784714-1417947794
Opcode ID: 641d5b878a7db8941e2e7c60752e568aa0fd709639592ed0744a0e17f16df465
Instruction ID: b5bd655443229f19c407bee0578b3e7109a83b66d0843b4c163948b842c97749
Opcode Fuzzy Hash: 641d5b878a7db8941e2e7c60752e568aa0fd709639592ed0744a0e17f16df465
Instruction Fuzzy Hash: D6025D71D00219EFDB11DFB5DD85A9EBBB9FF08292F284425E505EE250EB36C980CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A7B7 Relevance: 84.8, APIs: 16, Strings: 32, Instructions: 837
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 1000A7D6
AhnIEx_IsWinNT.AHNIEX(InstallInfo:Init,00000018), ref: 1000A7F5

Part of subcall function 10018600: AhnIEx_GetOS.AHNIEX(1000A7FA,InstallInfo:Init,00000018), ref: 10018609

AhnIEx_IsWow64Process.AHNIEX(InstallInfo:Init,00000018), ref: 1000A7FD

Part of subcall function 10017CC7: GetModuleHandleW.KERNEL32(Kernel32.DLL,?,?), ref: 10017CE5
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017D0A
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 10017D14
Part of subcall function 10017CC7: GetCurrentProcess.KERNEL32(00000018,?), ref: 10017D24

AhnIEx_GetOS2.AHNIEX(?,00000000,InstallInfo:Init,00000018), ref: 1000A818
AhnIEx_IsWorkstation.AHNIEX(InstallInfo:Init,00000018), ref: 1000A821
GetTickCount.KERNEL32 ref: 1000A865
GetSystemDirectoryW.KERNEL32(?,00000400), ref: 1000A91B
GetLastError.KERNEL32(?,ProgramFiles64Dir,?,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 1000A993

Part of subcall function 1001806F: __EH_prolog3.LIBCMT ref: 10018076
Part of subcall function 1001806F: IsCharAlphaW.USER32(00000000,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 100180D6
Part of subcall function 1001806F: SetLastError.KERNEL32(00000000,?,?,?,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 1001810C

GetTempPathW.KERNEL32(00000400,?,CommonFilesDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?), ref: 1000AB8F
AhnIEx_IsWinNTOrLater.AHNIEX(00200000,00000000,CommonAppData,?,TempDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir), ref: 1000AE66
GetModuleFileNameW.KERNEL32(?,00000400,CommonAppData,?,TempDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir), ref: 1000AEFA
_wcsrchr.LIBCMT ref: 1000AF02
GetModuleFileNameW.KERNEL32(00000000,?,00000400,PluginDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?), ref: 1000AF3D
_wcsrchr.LIBCMT ref: 1000AF45
GetCommandLineW.KERNEL32(?,?,IniFile,SecFile,ExeDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir), ref: 1000B004
GetCurrentProcessId.KERNEL32(CmdLine,10117AB8,?,?,IniFile,SecFile,ExeDir,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?), ref: 1000B07F

Strings

Desktop, xrefs: 1000ABFE, 1000AC22, 1000AC3A
ProgramFilesx86Dir, xrefs: 1000AA29, 1000AA2E, 1000AA48
StartMenu, xrefs: 1000AC7C, 1000ACA0, 1000ACB8
AppData, xrefs: 1000ADA9, 1000ADCD, 1000ADD2, 1000ADE6
CommonFilesx86Dir, xrefs: 1000AB0F, 1000AB14, 1000AB2E
ProgramFiles64Dir, xrefs: 1000A9E1, 1000A9E6, 1000A9FC
WinDir, xrefs: 1000A8B9, 1000A8C3, 1000A90E
PluginDir, xrefs: 1000AF12, 1000AF2A
LocalAppData, xrefs: 1000AE1A, 1000AE3E, 1000AE43, 1000AE57
%d.%d SP%d (%s), xrefs: 1000A840
InstallInfo:Init, xrefs: 1000A7E1
WinSysWow64Dir, xrefs: 1000A961, 1000A966, 1000A978, 1000A9A4
CommonFiles64Dir, xrefs: 1000AAC3, 1000AAC8, 1000AAE2
Server, xrefs: 1000A82F, 1000A834, 1000A83B
LocalAppDataLow, xrefs: 1000AEA4, 1000AEC8, 1000AECD, 1000AEE1
Parent(%u)=%u,%s, xrefs: 1000B0AD
SecFile, xrefs: 1000AF76, 1000AF7B, 1000AF9D, 1000AFAD, 1000AFB4
%s=Err %#x, xrefs: 1000AC03, 1000AC81, 1000ACFC, 1000AEA9
%s=Err, xrefs: 1000ADAE, 1000AE1F
CommonAppData, xrefs: 1000AD64, 1000AD69, 1000AD7D
ExeDir, xrefs: 1000AF55, 1000AF5A, 1000AF6E
CommonFilesDir, xrefs: 1000AB5C, 1000AB61, 1000AB75
%ExeDir%\AhnSec.ini, xrefs: 1000AFCE
WinSysDir, xrefs: 1000A92F, 1000A934, 1000A944, 1000A99D
Tick=%d:%02d:%02d, xrefs: 1000A893
Parent(%u)=%u, xrefs: 1000B0CB
TempDir, xrefs: 1000ABA8, 1000ABAD, 1000ABC0
ProgramFilesDir, xrefs: 1000AA7F, 1000AA84, 1000AA98
IniFile, xrefs: 1000AFBD, 1000AFC2, 1000AFE4, 1000AFF4, 1000AFFB
Programs, xrefs: 1000ACF7, 1000AD1B, 1000AD20, 1000AD34
CmdLine, xrefs: 1000B03E, 1000B043, 1000B05D, 1000B062, 1000B077
%ExeDir%\AhnSec.dat, xrefs: 1000AF87

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ModuleProcess$AddressCurrentErrorFileH_prolog3LastNameProc_wcsrchr$AlphaCharCommandCountDirectoryHandleLaterLinePathSystemTempTickWorkstationWow64
String ID: %ExeDir%\AhnSec.dat$%ExeDir%\AhnSec.ini$%d.%d SP%d (%s)$%s=Err$%s=Err %#x$AppData$CmdLine$CommonAppData$CommonFiles64Dir$CommonFilesDir$CommonFilesx86Dir$Desktop$ExeDir$IniFile$InstallInfo:Init$LocalAppData$LocalAppDataLow$Parent(%u)=%u$Parent(%u)=%u,%s$PluginDir$ProgramFiles64Dir$ProgramFilesDir$ProgramFilesx86Dir$Programs$SecFile$Server$StartMenu$TempDir$Tick=%d:%02d:%02d$WinDir$WinSysDir$WinSysWow64Dir
API String ID: 3004014789-599961807
Opcode ID: af3ed466e522d6fbbbe54ac67ff2d6b98fa945b6bec0654c2f6cb5a5df4ff765
Instruction ID: f0f857351586a05687643f8dbd9263c51c7e73070d5966d82a9d41a63653dfca
Opcode Fuzzy Hash: af3ed466e522d6fbbbe54ac67ff2d6b98fa945b6bec0654c2f6cb5a5df4ff765
Instruction Fuzzy Hash: E7328EB66142096BEB08DBB49D85EEF33ECEB49150F40052AFE15DA185EF39EDC48760

Uniqueness

Uniqueness Score: -1.00%

Function 1001D082 Relevance: 68.5, APIs: 21, Strings: 18, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 1001D0CF

Strings

CertCloseStore, xrefs: 1001D106
CertGetIntendedKeyUsage, xrefs: 1001D1E6
CertVerifySubjectCertificateContext, xrefs: 1001D14E
CryptMsgControl, xrefs: 1001D16C
CryptMsgGetParam, xrefs: 1001D161
CertGetEnhancedKeyUsage, xrefs: 1001D1EE
CryptDecodeObject, xrefs: 1001D1A3
crypt32.dll, xrefs: 1001D0BF
CertOpenStore, xrefs: 1001D0FB
CertGetSubjectCertificateFromStore, xrefs: 1001D177
CertVerifyTimeValidity, xrefs: 1001D204
CertFreeCertificateContext, xrefs: 1001D111
CryptMsgClose, xrefs: 1001D18D
CertEnumCertificatesInStore, xrefs: 1001D1F9
CryptQueryObject, xrefs: 1001D198
CertFindCertificateInStore, xrefs: 1001D156
CertGetNameStringA, xrefs: 1001D0F0
CertFreeCertificateChain, xrefs: 1001D182

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast
String ID: CertCloseStore$CertEnumCertificatesInStore$CertFindCertificateInStore$CertFreeCertificateChain$CertFreeCertificateContext$CertGetEnhancedKeyUsage$CertGetIntendedKeyUsage$CertGetNameStringA$CertGetSubjectCertificateFromStore$CertOpenStore$CertVerifySubjectCertificateContext$CertVerifyTimeValidity$CryptDecodeObject$CryptMsgClose$CryptMsgControl$CryptMsgGetParam$CryptQueryObject$crypt32.dll
API String ID: 1452528299-922342421
Opcode ID: 3d79d556a32e0fa44cdd7a86fef9ee772bc2f6941b66c80ce478b91a29800a24
Instruction ID: ca1065d3dd5f884ad48fbd6e3237ced24b323cf1a9b8114aac72363788292d8b
Opcode Fuzzy Hash: 3d79d556a32e0fa44cdd7a86fef9ee772bc2f6941b66c80ce478b91a29800a24
Instruction Fuzzy Hash: FC71A670D01229ABCB51EFA9D8846DEBEF4EF19750F20456BE814A7250D7B8D981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 100136B9 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 149servicewindowsleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 100136DD
OpenServiceW.ADVAPI32(00000000,?,00000014), ref: 100136F3
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 10013708
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A,?), ref: 10013718
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A,?), ref: 10013725
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A), ref: 10013763
QueryServiceStatus.ADVAPI32(?,?), ref: 10013772
DispatchMessageW.USER32(?), ref: 1001378A
PeekMessageW.USER32(?,00000000,0000000F,0000000F,00000001), ref: 1001379D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A,?), ref: 100137D5
CloseServiceHandle.ADVAPI32(?), ref: 10013806
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A,?), ref: 10013810
CloseServiceHandle.ADVAPI32(?), ref: 1001382C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002A6A,?), ref: 10013834

Strings

AIL:StartService:Open Service(%s) err=%d, xrefs: 1001381A
AIL:StartService(%s)=ok, xrefs: 100137F3
AIL:StartService:Open SCM err=%d, xrefs: 1001383D
AIL:StartService:Pending(%s, %d), xrefs: 100137BD
AIL:StartService(%s) err=%d, xrefs: 1001372B
AIL:StartService:Quert Status(%s) err=%d, xrefs: 100137DF

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLastService$CloseHandleMessageOpen$DispatchManagerPeekQuerySleepStartStatus
String ID: AIL:StartService(%s) err=%d$AIL:StartService(%s)=ok$AIL:StartService:Open SCM err=%d$AIL:StartService:Open Service(%s) err=%d$AIL:StartService:Pending(%s, %d)$AIL:StartService:Quert Status(%s) err=%d
API String ID: 196827563-66515971
Opcode ID: c32c6473320de3b0e0634caab7a3167ed0c2e07bc7bfc790a42e8bedf2d51864
Instruction ID: 556c44c6311f0b00c33c6b506dfb8beabdba42268a9452321874985836cad6cc
Opcode Fuzzy Hash: c32c6473320de3b0e0634caab7a3167ed0c2e07bc7bfc790a42e8bedf2d51864
Instruction Fuzzy Hash: 424180F16043157FE324EB308C8AE1B7BBCFB81791F008418F9059A6D0EB34DC8586A1

Uniqueness

Uniqueness Score: -1.00%

Function 10006383 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 121processCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1000638A
_memset.LIBCMT ref: 100063BD
GetLastError.KERNEL32(UserEnv.dll,?,?,00000104,?,?,00000400,?), ref: 10006400

Part of subcall function 1000A260: GetProcAddress.KERNEL32(?,101728B8), ref: 1000A267

GetLastError.KERNEL32 ref: 1000644F
CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,04000400,?,?,00000044,?), ref: 10006483
GetLastError.KERNEL32 ref: 1000648F
GetLastError.KERNEL32(DestroyEnvironmentBlock,CreateEnvironmentBlock,UserEnv.dll,?,?,00000104,?,?,00000400,?), ref: 100064CB

Strings

CreateProcessAsUser err=%d, xrefs: 10006496
Load UserEnv err=%d, xrefs: 10006407
D, xrefs: 100063B6
Get addr err=%d, xrefs: 100064D2
UserEnv.dll, xrefs: 100063EC
CreateEnvBlock err=%d, xrefs: 10006456
AIL:ExecAsAdmin(%s, %s), xrefs: 100063A3
CreateProcessAsUser=ok, xrefs: 100064A7
DestroyEnvironmentBlock, xrefs: 1000641E
CreateEnvironmentBlock, xrefs: 10006411

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressCreateH_prolog3ProcProcessUser_memset
String ID: AIL:ExecAsAdmin(%s, %s)$CreateEnvBlock err=%d$CreateEnvironmentBlock$CreateProcessAsUser err=%d$CreateProcessAsUser=ok$D$DestroyEnvironmentBlock$Get addr err=%d$Load UserEnv err=%d$UserEnv.dll
API String ID: 692707844-2291447661
Opcode ID: b500a701b3d157bcc8b58352fc41e1a27cb5745a9b78225e9f0a5f1bcb145366
Instruction ID: 0eb708b57ef7f724c8685014d3b1a0fa356bc0c8afcf0cdaeab4ca69e88ff579
Opcode Fuzzy Hash: b500a701b3d157bcc8b58352fc41e1a27cb5745a9b78225e9f0a5f1bcb145366
Instruction Fuzzy Hash: 18411675901128BFEF15DBF0CC85ADE777AFF08790F208024F510AA195EB395A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10013A39 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 94serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,?,00000040,?), ref: 10013A55
OpenServiceW.ADVAPI32(00000000,?,00010000), ref: 10013A70
DeleteService.ADVAPI32(00000000), ref: 10013A7D
GetLastError.KERNEL32 ref: 10013A8D
AhnIEx_SetReboot.AHNIEX ref: 10013AA6
GetLastError.KERNEL32 ref: 10013AAD
CloseServiceHandle.ADVAPI32(00000000), ref: 10013AD5
GetLastError.KERNEL32 ref: 10013AE3
GetLastError.KERNEL32 ref: 10013AEC
CloseServiceHandle.ADVAPI32(?), ref: 10013B05
GetLastError.KERNEL32 ref: 10013B0F

Strings

AIL:DeleteService(%s)=ok, xrefs: 10013AC5
AIL:DeleteService:Open SCM err=%d, xrefs: 10013B18
AIL:DeleteService(%s) err=%d, xrefs: 10013AB3
AIL:DeleteService(%s)=ERROR_SERVICE_MARKED_FOR_DELETE, xrefs: 10013A97
AIL:DeleteService:Open Service(%s) err=%d, xrefs: 10013AF2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Service$CloseHandleOpen$DeleteManagerReboot
String ID: AIL:DeleteService(%s) err=%d$AIL:DeleteService(%s)=ERROR_SERVICE_MARKED_FOR_DELETE$AIL:DeleteService(%s)=ok$AIL:DeleteService:Open SCM err=%d$AIL:DeleteService:Open Service(%s) err=%d
API String ID: 3490298539-937803892
Opcode ID: bc53a5afa6fec39893d1d362ffa0facb859149da0cb9132cfacd0b56fc799a10
Instruction ID: c90df4d71e63e0a9048f25a0faf45f320f97bf7ccfb07aeb62b91a4698be8ab1
Opcode Fuzzy Hash: bc53a5afa6fec39893d1d362ffa0facb859149da0cb9132cfacd0b56fc799a10
Instruction Fuzzy Hash: F421F5716012207FD224E3714C8AF5B7F6CEF56B91F004424F949ADA92E67598C0C1F2

Uniqueness

Uniqueness Score: -1.00%

Function 1001869A Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 75shutdownCOMMON

Download Yara Rule

APIs

AhnIEx_IsWinNT.AHNIEX ref: 100186A3

Part of subcall function 10018600: AhnIEx_GetOS.AHNIEX(1000A7FA,InstallInfo:Init,00000018), ref: 10018609

GetCurrentProcess.KERNEL32(00000028,?), ref: 100186BA
OpenProcessToken.ADVAPI32(00000000), ref: 100186C1
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 100186D5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 100186F3
GetLastError.KERNEL32 ref: 100186F9
GetLastError.KERNEL32 ref: 100186FF
GetLastError.KERNEL32 ref: 1001870A
ExitWindowsEx.USER32(?,00000000), ref: 10018720
GetLastError.KERNEL32 ref: 10018740

Strings

AIL:ExitWindows:Get shutdown privilege err=%d, xrefs: 10018702
AIL:ExitWindows(%u) err=%d, xrefs: 10018746
SeShutdownPrivilege, xrefs: 100186CF
AIL:ExitWindows:Get token err=%d, xrefs: 1001870D
AIL:ExitWindows(%u), xrefs: 1001872F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueWindows
String ID: AIL:ExitWindows(%u)$AIL:ExitWindows(%u) err=%d$AIL:ExitWindows:Get shutdown privilege err=%d$AIL:ExitWindows:Get token err=%d$SeShutdownPrivilege
API String ID: 3454885151-545293504
Opcode ID: f7f591db40793a41b91de915d710bc7fae50523dd6119d743538bc1e21a73d1a
Instruction ID: 3155c52a38d1707c5d95cad9fd70922e1a8d1d52d1db96acfcca8d481f50e58a
Opcode Fuzzy Hash: f7f591db40793a41b91de915d710bc7fae50523dd6119d743538bc1e21a73d1a
Instruction Fuzzy Hash: 0A11B2B9A00118BFEB00EBB59D8AEAF7E7CEB45680F204025F905DA181D775DB8497B1

Uniqueness

Uniqueness Score: -1.00%

Function 100086D8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 10008747
GetLastError.KERNEL32 ref: 1000875A
GetLastError.KERNEL32 ref: 10008761
GetLastError.KERNEL32 ref: 10008768
GetLastError.KERNEL32 ref: 1000876F
GetLastError.KERNEL32 ref: 10008776
GetLastError.KERNEL32 ref: 100087F3
FindNextFileW.KERNEL32(00000000,?), ref: 100087FD
FindClose.KERNEL32(00000000), ref: 10008808
GetLastError.KERNEL32 ref: 10008821

Strings

AIL:DelDir ff err=%d, xrefs: 10008779
*.*, xrefs: 10008727

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Find$File$CloseFirstNext
String ID: *.*$AIL:DelDir ff err=%d
API String ID: 1981398982-599000819
Opcode ID: 5f65b2fee4e36e1379780730702cb9b5b67bf1a3838c96b4888df1e4474d3b03
Instruction ID: c2ba906d8d2c7f707fce2ebe9ee1a5a8f65d3d04cdef9d4ec5e73fe49d397a32
Opcode Fuzzy Hash: 5f65b2fee4e36e1379780730702cb9b5b67bf1a3838c96b4888df1e4474d3b03
Instruction Fuzzy Hash: 4841E431D0425C8AEB34DBB0CC44ADE7BFCFF082A4F60452AE859E3089EB7496858F51

Uniqueness

Uniqueness Score: -1.00%

Function 100135A9 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 85serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,?,?,?,?,?,?), ref: 100135D8
CreateServiceW.ADVAPI32(00000000,?,?,00000004,?,?,00000001,?,?,?,?,?,?,?), ref: 10013608
CloseServiceHandle.ADVAPI32(00000000), ref: 1001362D
GetLastError.KERNEL32 ref: 10013637
GetLastError.KERNEL32 ref: 10013640
CloseServiceHandle.ADVAPI32(00000000), ref: 10013656
GetLastError.KERNEL32 ref: 1001365D

Strings

AIL:CreateService:path=%s, xrefs: 100135B4
AIL:CreateService:Open SCM err=%d, xrefs: 10013664
AIL:CreateService(%s)=ok, xrefs: 1001361D
AIL:CreateService err=%d, xrefs: 10013643

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLastService$CloseHandle$CreateManagerOpen
String ID: AIL:CreateService err=%d$AIL:CreateService(%s)=ok$AIL:CreateService:Open SCM err=%d$AIL:CreateService:path=%s
API String ID: 2412742882-3556275758
Opcode ID: d4f79deb52013b0e1085abc15179c392ba5a2b0ccdcef9f83b968ee16d662f91
Instruction ID: c0d52caa765dc0992409d61d3cffeee2e40f382392d3428576b69228f31c4e13
Opcode Fuzzy Hash: d4f79deb52013b0e1085abc15179c392ba5a2b0ccdcef9f83b968ee16d662f91
Instruction Fuzzy Hash: 0521B676900208FBDF02AFB18C46EDE7F79FF59350F108024FA056A251D6769A90AB90

Uniqueness

Uniqueness Score: -1.00%

Function 100162BF Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 219comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100162DE

Part of subcall function 10007633: IsCharAlphaW.USER32(B2A1A428,00000104), ref: 1000764E
Part of subcall function 10007633: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?), ref: 1000769D
Part of subcall function 10007633: GetLastError.KERNEL32(?,?,?,?,?), ref: 100076B9

CoCreateInstance.OLE32(1016802C,00000000,00000001,10167FEC,?), ref: 1001640F
_wcsrchr.LIBCMT ref: 10016449

Part of subcall function 1000978A: IsCharAlphaW.USER32(00000000,00000104,?,?,?,10018891,?,00000000,?,?,101728B8), ref: 10009796

Strings

err=0x%x, xrefs: 100164D9
.lnk, xrefs: 1001639E
Arg=%s, xrefs: 100163D4
Target=%s, xrefs: 100163BC
Link=%s, xrefs: 100163AD
Icon=%s, %d, xrefs: 100163F0
AIL:CreateShortcut, xrefs: 10016304

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AlphaChar$CreateErrorFileFindFirstH_prolog3InstanceLast_wcsrchr
String ID: .lnk$AIL:CreateShortcut$Arg=%s$Icon=%s, %d$Link=%s$Target=%s$err=0x%x
API String ID: 3431470-2406143318
Opcode ID: 10bbe55b530da26c0a67b08cda83c2cbd8bb2bdae511841cc107f05dc96a766b
Instruction ID: 8f5f5b5eea0bffa0b04bb3b64361e1a46a3ceeaac29ce117b7f0252fd1d2b4c7
Opcode Fuzzy Hash: 10bbe55b530da26c0a67b08cda83c2cbd8bb2bdae511841cc107f05dc96a766b
Instruction Fuzzy Hash: 4C716D79A00209AFDB14DFA4CC45EAF77B9EF49350F204519F915EB281DB75EA80CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100157E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 100151A4: lstrcmpiW.KERNEL32(?,everyone,1016AF58,0000007C,10002BC2,?,?,?,?,00000040,?,?,00000104,?), ref: 100151DC
Part of subcall function 100151A4: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10015209
Part of subcall function 100151A4: GetFileSecurityW.ADVAPI32(?,00000004,00000000,00000000,?), ref: 10015325

FindFirstFileW.KERNEL32(?,?,?,?,?,?), ref: 1001583A
GetLastError.KERNEL32(?,?,?,?), ref: 1001584B
FindNextFileW.KERNEL32(?,00000010,?,?,?,?,?,?,?,?,?,?,?), ref: 100158E9
FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 100158FD

Strings

., xrefs: 10015888
., xrefs: 1001589C
AIL:AddAccessRightsToDir ff(%s) err=%d, xrefs: 10015853
*.*, xrefs: 10015817

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FileFind$AllocateCloseErrorFirstInitializeLastNextSecuritylstrcmpi
String ID: *.*$.$.$AIL:AddAccessRightsToDir ff(%s) err=%d
API String ID: 3052594510-2979254234
Opcode ID: 4f39abd90ccd2fdde0df7d71b176e31691f25466d69c94028fb8e013a5b55585
Instruction ID: 26c654e668ea9e3b4eaf0d5e41e086e8ab22191c701523f0db7be69d18de7a0d
Opcode Fuzzy Hash: 4f39abd90ccd2fdde0df7d71b176e31691f25466d69c94028fb8e013a5b55585
Instruction Fuzzy Hash: DF31A1B5C0025CEBDB20DB61CC45ADE77BCEF08315F444191FA04AA182E776DAD48F61

Uniqueness

Uniqueness Score: -1.00%

Function 1000C1D0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,00000059,?,00000010,?,00000000,00000000,?,1001042D,?,00000010), ref: 1000C208
GetLocaleInfoW.KERNEL32(00000400,0000005A,00000001,?), ref: 1000C23F

Strings

ko_KR, xrefs: 1000C27D
pt_BR, xrefs: 1000C276
en_US, xrefs: 1000C268
jp_JP, xrefs: 1000C284
zh_CN, xrefs: 1000C26F
zh_TW, xrefs: 1000C28B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: InfoLocale
String ID: en_US$jp_JP$ko_KR$pt_BR$zh_CN$zh_TW
API String ID: 2299586839-3946043243
Opcode ID: 5972b545d87f91750b1b558106bbfa6646caa62ced57660d3d6012a01cd0095d
Instruction ID: dea3f5c043367e218417ea1995bc833e231f787ee13add3fe364c444499000eb
Opcode Fuzzy Hash: 5972b545d87f91750b1b558106bbfa6646caa62ced57660d3d6012a01cd0095d
Instruction Fuzzy Hash: FC11D57270431EA7F69DCBB88C40EBB3398EF453D0F014629F906E699CDA34F9408615

Uniqueness

Uniqueness Score: -1.00%

Function 10009FBA Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 1000A037
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 1000A045
FindNextFileW.KERNEL32(?,?), ref: 1000A156
FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 1000A167

Strings

AIL:CopyFiles=no file, xrefs: 1000A065
AIL:CopyFiles ff err=%d, xrefs: 1000A07C
AIL:CopyFiles(%s, %s), xrefs: 1000A01D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID: AIL:CopyFiles ff err=%d$AIL:CopyFiles(%s, %s)$AIL:CopyFiles=no file
API String ID: 819619735-911871817
Opcode ID: ed68c5ec57696bf044024a3887308172603a046644edb323bdb64ad4c2c3102f
Instruction ID: c27800284aa81a58112ee52c718f50f382f9b1e01cc6902230c1f317d7a7b038
Opcode Fuzzy Hash: ed68c5ec57696bf044024a3887308172603a046644edb323bdb64ad4c2c3102f
Instruction Fuzzy Hash: 1A417272D0018D5AEB35DAA4CC85ADF77ACEF09390F004226F919D7185EA74A6C58BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1007F680 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,10057790,00000000), ref: 1007F6BC
CryptGenRandom.ADVAPI32(?,00000000,00000000), ref: 1007F6CD
CryptReleaseContext.ADVAPI32(?,00000000), ref: 1007F6E0
CryptAcquireContextW.ADVAPI32(?,00000000,Intel Hardware Cryptographic Service Provider,00000016,F0000040,?,?,?,?,10057790,00000000), ref: 1007F73A
CryptGenRandom.ADVAPI32(?,00000000,00000000,?,?,?,?,10057790,00000000), ref: 1007F74B
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,10057790,00000000), ref: 1007F75E

Strings

Intel Hardware Cryptographic Service Provider, xrefs: 1007F72D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Intel Hardware Cryptographic Service Provider
API String ID: 1815803762-3323058758
Opcode ID: 640c32f637e0045de3eac04fe614f4f8bc262f58bd10219f806de641ef29e635
Instruction ID: 4f7d3b02e4fa7a2712afbf266ccdbc539d4e54d7c376a0186dce51d370a35ff7
Opcode Fuzzy Hash: 640c32f637e0045de3eac04fe614f4f8bc262f58bd10219f806de641ef29e635
Instruction Fuzzy Hash: 6C21D47A2043096BE724DB71AC85FBB32ADFB85650F00041CF648D6141EB79E905A2B9

Uniqueness

Uniqueness Score: -1.00%

Function 10007633 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

IsCharAlphaW.USER32(B2A1A428,00000104), ref: 1000764E
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?), ref: 1000769D
FindFirstFileW.KERNEL32(10018885,?), ref: 100076AE
GetLastError.KERNEL32(?,?,?,?,?), ref: 100076B9
FindClose.KERNEL32(00000000), ref: 100076F7

Strings

AIL:IsFileExist(%s)=1 (warning=%d), xrefs: 100076E1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Find$FileFirst$AlphaCharCloseErrorLast
String ID: AIL:IsFileExist(%s)=1 (warning=%d)
API String ID: 1902726286-2231273969
Opcode ID: bcfa8f9f6291a8cfae70a452885570777c077e4017d8c029077b158e30e9e8ca
Instruction ID: ee2f38e2cf85386ac6cb7743887fdd4850bf605296bb695baaa8937fbccae689
Opcode Fuzzy Hash: bcfa8f9f6291a8cfae70a452885570777c077e4017d8c029077b158e30e9e8ca
Instruction Fuzzy Hash: CB21F371C00524ABEB20DB68CC99DAE77BCFF05290F508562F41BE2055D778E9C4CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 1000776E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

IsCharAlphaW.USER32(B2A1A428,?), ref: 10007789
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 100077D8
FindFirstFileW.KERNEL32(?,?), ref: 100077E9
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100077F4
FindClose.KERNEL32(00000000), ref: 10007814

Strings

AIL:IsDir(%s)=%d (warning=%d), xrefs: 100077FF

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Find$FileFirst$AlphaCharCloseErrorLast
String ID: AIL:IsDir(%s)=%d (warning=%d)
API String ID: 1902726286-4046085516
Opcode ID: 57e0998c2f82dd7f673c3232905dee878123c35e7a15e385be9a8df1211864da
Instruction ID: b32473f03d014040d98bcdd97bc58aa694f1f20bddefc42fc909e6039cc5550f
Opcode Fuzzy Hash: 57e0998c2f82dd7f673c3232905dee878123c35e7a15e385be9a8df1211864da
Instruction Fuzzy Hash: DB11B4B1D00218ABDB10DBA4CC89D9AB7BCFF08291F40C1A5F919D2145D778EA85DB51

Uniqueness

Uniqueness Score: -1.00%

Function 100FB0BA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 101040A0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 101040B5
UnhandledExceptionFilter.KERNEL32(101682FC), ref: 101040C0
GetCurrentProcess.KERNEL32(C0000409), ref: 101040DC
TerminateProcess.KERNEL32(00000000), ref: 101040E3

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 206d9b2cb7bc893e9155ed0136484ce8e25e4ee8f6c7de61c3ba6301483d289e
Instruction ID: 8b87ee59fcdd12e6cce6d6801217f7b6b5cd07d3849d5ac4769274c08d077aaa
Opcode Fuzzy Hash: 206d9b2cb7bc893e9155ed0136484ce8e25e4ee8f6c7de61c3ba6301483d289e
Instruction Fuzzy Hash: 0321D0B6842224DBD341DFA4CDC46447BB0FB8831AF924259F60893A68DBBC54E1CF15

Uniqueness

Uniqueness Score: -1.00%

Function 1000D6BA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_ExitWindows.AHNIEX(00000000,TRUE,?,00000001), ref: 1000D6D2

Part of subcall function 1001869A: AhnIEx_IsWinNT.AHNIEX ref: 100186A3
Part of subcall function 1001869A: GetCurrentProcess.KERNEL32(00000028,?), ref: 100186BA
Part of subcall function 1001869A: OpenProcessToken.ADVAPI32(00000000), ref: 100186C1
Part of subcall function 1001869A: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 100186D5
Part of subcall function 1001869A: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 100186F3
Part of subcall function 1001869A: GetLastError.KERNEL32 ref: 100186F9
Part of subcall function 1001869A: GetLastError.KERNEL32 ref: 100186FF
Part of subcall function 1001869A: ExitWindowsEx.USER32(?,00000000), ref: 10018720

Strings

false, xrefs: 1000D6E8
TRUE, xrefs: 1000D6C7
true, xrefs: 1000D6E1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorExitLastProcessTokenWindows$AdjustCurrentFreeGlobalLookupOpenPrivilegePrivilegesValue
String ID: TRUE$false$true
API String ID: 1799191906-3801493375
Opcode ID: 3bb00dde30f99f79470ebb540fc391c7c52cbb721d1737f1ba57c41951c08376
Instruction ID: 03cb4f9529c1e247ad381f456e1e82b780f601868da3a222cf9de94d51d96992
Opcode Fuzzy Hash: 3bb00dde30f99f79470ebb540fc391c7c52cbb721d1737f1ba57c41951c08376
Instruction Fuzzy Hash: 15E08676A4020477DB04EAA58C03D8F33CCDB58240F008411FA08AE296E677E6900563

Uniqueness

Uniqueness Score: -1.00%

Function 1000D788 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_GetDiskFreeSpace.AHNIEX(TRUE,?,00000001), ref: 1000D798

Part of subcall function 100183EA: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 100183F5
Part of subcall function 100183EA: GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 10018405

AhnIEx_snprintf.AHNIEX(?,?,10117588,00000000,TRUE,?,00000001), ref: 1000D7B0

Strings

TRUE, xrefs: 1000D793

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Free$AddressDiskEx_snprintfGlobalHandleModuleProcSpace
String ID: TRUE
API String ID: 1352618111-3412697401
Opcode ID: e47e7603dee7744032efac1329134cc502f9b88e5f1fb7135f33971b5ef1464b
Instruction ID: b60ff8b53ecf5fcc6cabb00061eb5ac560eae0e4790237d453ad7301c079b897
Opcode Fuzzy Hash: e47e7603dee7744032efac1329134cc502f9b88e5f1fb7135f33971b5ef1464b
Instruction Fuzzy Hash: 8CD0A9A6A402006BC600EF648C83E8BB6ECEBAC642F804440B140E92A2D235E7840223

Uniqueness

Uniqueness Score: -1.00%

Function 10081531 Relevance: 4.7, APIs: 3, Instructions: 156networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 100815AD
recv.WS2_32(?,?,?,00000000), ref: 100815C3
WSAGetLastError.WS2_32 ref: 100815E1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: fc9f9da4133b15e36fd8798f5d9e872e48e1d04287c13c9daf19620101ce3a52
Instruction ID: 4c0f50088265d4c1aa36fd1e652438aa2dfb248886fa851e94c2eb014afe8f44
Opcode Fuzzy Hash: fc9f9da4133b15e36fd8798f5d9e872e48e1d04287c13c9daf19620101ce3a52
Instruction Fuzzy Hash: 1C01D836D01A316BC321C624AC84BAB77ECFF896A2F160617FC91F7250D634DD5186E1

Uniqueness

Uniqueness Score: -1.00%

Function 10019718 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,?,?,100197D0,00000000,00000000,?,?,?,1001A62A,?,00000000,?,1001AD95,00000000,1001AE96), ref: 10019721
LockResource.KERNEL32(00000000,1017B2C4,?,100197D0,00000000,00000000,?,?,?,1001A62A,?,00000000,?,1001AD95,00000000,1001AE96), ref: 1001972F
SizeofResource.KERNEL32(00000000,?,?,100197D0,00000000,00000000,?,?,?,1001A62A,?,00000000,?,1001AD95,00000000,1001AE96), ref: 10019741

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: bf77b67d3f9673ffbcb400aa44ad6e5a6f82760f9c7714ac3e32f66c94529d58
Instruction ID: 7a7c33e96060a38e2787ff5fedb87e2a8c4493f4067bd9e27720d269caadd008
Opcode Fuzzy Hash: bf77b67d3f9673ffbcb400aa44ad6e5a6f82760f9c7714ac3e32f66c94529d58
Instruction Fuzzy Hash: 0DF0F032628536A7CF216F74ED444AA7BE9FF006E27018825FD99DA1A0E634D890D680

Uniqueness

Uniqueness Score: -1.00%

Function 10007A49 Relevance: 4.5, APIs: 3, Instructions: 35fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?), ref: 10007A6C
FindClose.KERNEL32(00000000), ref: 10007A8C
GetLastError.KERNEL32 ref: 10007A96

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 0a9ca1fa8a32b62875e40f664c95297042cadc9d1462b8ef61a26180da181e45
Instruction ID: 445bc19fb9216b763b6de1cc81dbb56e6a30dac414f7d21cc5c2aa621fd1887e
Opcode Fuzzy Hash: 0a9ca1fa8a32b62875e40f664c95297042cadc9d1462b8ef61a26180da181e45
Instruction Fuzzy Hash: 74F0BB35A00518AFC710EF74CD899EE73B8FF89264F004154F91AD3284EF74AA468B51

Uniqueness

Uniqueness Score: -1.00%

Function 100506F0 Relevance: 4.3, Strings: 3, Instructions: 590COMMON

Download Yara Rule

Strings

0, xrefs: 10050AC1
, xrefs: 1005077F
gfff, xrefs: 10050A70

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: $0$gfff
API String ID: 0-3930087101
Opcode ID: 42a1b4514ac685a119434fe7afce7f1be7b1ed37c031a65947e225c2dc42aa4c
Instruction ID: d03d5919b9fb5f4640ea8e77c7cdaaa4eb7d63d97ab63de98480f249486a6458
Opcode Fuzzy Hash: 42a1b4514ac685a119434fe7afce7f1be7b1ed37c031a65947e225c2dc42aa4c
Instruction Fuzzy Hash: 9112CE72E083469BD755DF24C94075EB7E4FB84294F114A2DF8C5A3292EB31EC488BD2

Uniqueness

Uniqueness Score: -1.00%

Function 100C7320 Relevance: 4.1, Strings: 3, Instructions: 369COMMON

Download Yara Rule

Strings

:, xrefs: 100C75A3
), xrefs: 100C757C
..\..\Src\openssl-1.1.1n\crypto\conf\conf_def.c, xrefs: 100C76A6, 100C76B9, 100C76DB, 100C76F6, 100C7711, 100C771F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: )$..\..\Src\openssl-1.1.1n\crypto\conf\conf_def.c$:
API String ID: 0-2642297163
Opcode ID: f577412791f5572bd135231a93500cd66efde630594552962b621c4906f11d37
Instruction ID: 4f885daf7652e248f1109d2bb117c42879bf5c22ee9bd879aa212174c0241671
Opcode Fuzzy Hash: f577412791f5572bd135231a93500cd66efde630594552962b621c4906f11d37
Instruction Fuzzy Hash: 91C142346087929BC319CE18C68076EBBE1FB95380F54858EFCD94B346C7B4DA46D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E5CE Relevance: 3.8, Strings: 3, Instructions: 30COMMON

Download Yara Rule

Strings

false, xrefs: 1000E60E
TRUE, xrefs: 1000E5F3
true, xrefs: 1000E607

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal
String ID: TRUE$false$true
API String ID: 2979337801-3801493375
Opcode ID: 9f2cc02551817e257a99a7105a033b3bfc1454898aeeb7eb8505ef1a9f4df836
Instruction ID: 791d739e823129d0b34f184629921528245994344fb8fa700a3d47a2c3adab3b
Opcode Fuzzy Hash: 9f2cc02551817e257a99a7105a033b3bfc1454898aeeb7eb8505ef1a9f4df836
Instruction Fuzzy Hash: 4EE092627402053AE714DA64AC07ED7338CDB28260F00C021FA14BD291FF76E9900127

Uniqueness

Uniqueness Score: -1.00%

Function 100A51C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100A51CD

Strings

..\..\Src\openssl-1.1.1n\crypto\modes\ocb128.c, xrefs: 100A51D7, 100A5200

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID: ..\..\Src\openssl-1.1.1n\crypto\modes\ocb128.c
API String ID: 2102423945-2825094535
Opcode ID: c96be11b7f3f9b6456b78ae9637dc1b0077b4bb57194f343726621e09c08ef4a
Instruction ID: 9585a73d2fdc49d6b5aad92e627a6b721b58699a146e99c1661001eac6114f5f
Opcode Fuzzy Hash: c96be11b7f3f9b6456b78ae9637dc1b0077b4bb57194f343726621e09c08ef4a
Instruction Fuzzy Hash: 1041ED31685B41DFC310CBB8D802FC6BBA4FF86300F084A48E1989B293C7BAB104CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1008E390 Relevance: 3.6, APIs: 2, Instructions: 574COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1008E3C1
_memset.LIBCMT ref: 1008E3E2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0919b18b61a5b12cb1de8a452bf8c268c7277876f0ff2691eaa1f8fbb17b5fe5
Instruction ID: d6b025885f6d9704f2a7f10c6d015810a5603bb668ee52b596d29028c3e27527
Opcode Fuzzy Hash: 0919b18b61a5b12cb1de8a452bf8c268c7277876f0ff2691eaa1f8fbb17b5fe5
Instruction Fuzzy Hash: 9D12B43174A7C18FD34AC6AD84943157FD2DBAF200B4D86ACDAD6DF793C4A4681AC3A1

Uniqueness

Uniqueness Score: -1.00%

Function 100B4610 Relevance: 3.6, Strings: 1, Instructions: 2305COMMON

Download Yara Rule

Strings

@, xrefs: 100B463F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 04911b81260464f8de79a7108a5103904d7f5712cb3990e638d75a89aeefb1e8
Instruction ID: b512de9d417721c089188aa78813e65cd38816693dcc7927e8fd3cf11714d86f
Opcode Fuzzy Hash: 04911b81260464f8de79a7108a5103904d7f5712cb3990e638d75a89aeefb1e8
Instruction Fuzzy Hash: 6E2393B1A483488FC350DF9AC8C054AFBF0FF8C618F85593DEB9893312D675AA548B56

Uniqueness

Uniqueness Score: -1.00%

Function 1008D780 Relevance: 3.3, APIs: 2, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1008D7A4
_memset.LIBCMT ref: 1008D7C4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: ea418b4607e3f52f7302e79cc0d2eb5acb3f618db2bc43575d71264ec6115c55
Instruction ID: 4b738df58e8be2d2d0e649e980775cf14f4c6f21914957286d9c87de7bc7bc38
Opcode Fuzzy Hash: ea418b4607e3f52f7302e79cc0d2eb5acb3f618db2bc43575d71264ec6115c55
Instruction Fuzzy Hash: 8FA1842564D7C18FD35EC62E588462ABF92CFFB100754C6DCC8D6DB79AC860981ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 100C1D20 Relevance: 3.2, APIs: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100C1D44
_memset.LIBCMT ref: 100C1D64

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d613fa030d9c180c73d538db76d7df05ebc5af9a6bc5f9ee168ce9af7020705b
Instruction ID: f3b8c75048a72a900d8848124521d1613faa7e2d4cf75900e86f4c9947dbbeb2
Opcode Fuzzy Hash: d613fa030d9c180c73d538db76d7df05ebc5af9a6bc5f9ee168ce9af7020705b
Instruction Fuzzy Hash: BA51B42564E7C18FD34EC62E588462ABF92DFBB100744C29CD8D6DBB86C8609816C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 1008C3E0 Relevance: 3.1, APIs: 2, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1008C404
_memset.LIBCMT ref: 1008C424

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 71173374a3aae18d69b4be782ceaa9ced9bc014a7fb36050b0373661e4bd7f59
Instruction ID: 49601091356d2ee3cf92573f4f4763fb3fbf6f411cbbe20c19267c470f51ef45
Opcode Fuzzy Hash: 71173374a3aae18d69b4be782ceaa9ced9bc014a7fb36050b0373661e4bd7f59
Instruction Fuzzy Hash: 3841F51464D7C25FD34FC62E1C8062A7F96DFAB100B08828DD8D6DBB87C464A856C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 100C3C80 Relevance: 3.1, APIs: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100C3CA4
_memset.LIBCMT ref: 100C3CC4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c34a3a2157a54ae86369166595106ea7b0a379cb361ef1531cebd669c0ee63a4
Instruction ID: 8a1da7bd002d2f57061cac82470f202d107ba70574a3c0b91b652523a4918df1
Opcode Fuzzy Hash: c34a3a2157a54ae86369166595106ea7b0a379cb361ef1531cebd669c0ee63a4
Instruction Fuzzy Hash: 5841E81424D7D19FD30ACA3D18806297F96DFB7100B0886DCD8D69BB87C564A856CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 100C45C0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100C45E4
_memset.LIBCMT ref: 100C4604

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e67bef7655e593b5df27dbf3d559a18b55592ed9cbfffe6badb4dcc37c3ee0af
Instruction ID: de1110fbdca2bf641560448e1c13ae2caa64757aead50ebc448033b9941bf6b7
Opcode Fuzzy Hash: e67bef7655e593b5df27dbf3d559a18b55592ed9cbfffe6badb4dcc37c3ee0af
Instruction Fuzzy Hash: DC41E55414D7D29FD30ACA3E0C8076A7F96DFA7100B0886CDE8D69BB87C564A859CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 10007AAA Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 10007AC8
FindClose.KERNEL32(00000000), ref: 10007AD4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 996ab71cab5126f2c8d767ad5f721e38618b9a9bc700a0897b1a3482963905db
Instruction ID: 9a4ac7192b2d3782567e2e15c46949fdb6c9e9c731cf7e775bfec1b5aaa45a65
Opcode Fuzzy Hash: 996ab71cab5126f2c8d767ad5f721e38618b9a9bc700a0897b1a3482963905db
Instruction Fuzzy Hash: BEE09B30A00108DBCB04EB74CD8995E73F8FB48304F504294F41AD3194EA78AE49CB01

Uniqueness

Uniqueness Score: -1.00%

Function 1008C5F0 Relevance: 2.8, Strings: 1, Instructions: 1512COMMON

Download Yara Rule

Strings

, xrefs: 1008D5FA

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6ed2dafa304c3a0459da9cad7346e005a64b28bc17f4c53275af2dfd71a975d7
Instruction ID: 6b4bea8f28297258f6e2c6f658770cfce4f232b62547141011bdf9e776735deb
Opcode Fuzzy Hash: 6ed2dafa304c3a0459da9cad7346e005a64b28bc17f4c53275af2dfd71a975d7
Instruction Fuzzy Hash: ECC2B57260C3548FC354DF9AD8C4056F7E2FFC8214F5A492DEAA493302D7B4A90A9BD6

Uniqueness

Uniqueness Score: -1.00%

Function 1008DD00 Relevance: 1.8, Strings: 1, Instructions: 519COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\ec\ec_mult.c, xrefs: 1008E2A2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\ec\ec_mult.c
API String ID: 0-4032731796
Opcode ID: dc61e3fc28aa0368704fc01b5cf4e472291224217321700f7e8cfec096b92c2b
Instruction ID: 8c0e36a41d7782879396648543ae6859f0757df9abc46cf637b1c1a379410418
Opcode Fuzzy Hash: dc61e3fc28aa0368704fc01b5cf4e472291224217321700f7e8cfec096b92c2b
Instruction Fuzzy Hash: BA222B75A083148FD358CF59C48060AFBE2FFC8314F5A8A6DE99897361D7B1E906CB85

Uniqueness

Uniqueness Score: -1.00%

Function 100A3DF0 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100A3FFB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 8efdf7f30cc8219a4d3a1ae98a75e01d42bba6f2b8a75c4349540eb620c0024c
Instruction ID: ec6075f1e0ca4349a87109f5d4fad7f62045409915bc5469d56b1aa050ddabf4
Opcode Fuzzy Hash: 8efdf7f30cc8219a4d3a1ae98a75e01d42bba6f2b8a75c4349540eb620c0024c
Instruction Fuzzy Hash: 828188716087419FD318CF68C481A6BBBE5FF88210F458A2EF49A87651D770EA48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A42A0 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da004bf3204e5b8f5d163112febda1e784d4310bb4a2391b9718b1dd96d827e5
Instruction ID: 1ecfc83a6a07743035055643a7fc371c8bba52ba4e88fea6f131900c054bf103
Opcode Fuzzy Hash: da004bf3204e5b8f5d163112febda1e784d4310bb4a2391b9718b1dd96d827e5
Instruction Fuzzy Hash: 1D61B3765087418FC719CF68D88166BBBF5EFC9210F454A1DF4DA87241DB70EA48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A4050 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100A4202

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 4037849fe4dd2ae669eb58cf97a7e7b5a2c39539552509dcae1b29d55d20d849
Instruction ID: 864d0a982abeaacc7cdedec1629780362b56921844c530b8d8fc3ecf4c823377
Opcode Fuzzy Hash: 4037849fe4dd2ae669eb58cf97a7e7b5a2c39539552509dcae1b29d55d20d849
Instruction Fuzzy Hash: AD618D755087419FC318CF68C491A6BBBE5FFD9204F458A2DF4DAC7241DA34EA48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100E3CE0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_oaep.c, xrefs: 100E3DA1, 100E3DC0, 100E3DE4, 100E411A, 100E4156, 100E416F, 100E419D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_oaep.c
API String ID: 0-425843867
Opcode ID: 7f6f21b92472ebf8e8b46b5fe0767f78d57aa4a3305eea7c0298cbfb11003e99
Instruction ID: 6f445ecbc1403a68795d064ef22940a6448fd343d1a31ac07ef9e80a909ba818
Opcode Fuzzy Hash: 7f6f21b92472ebf8e8b46b5fe0767f78d57aa4a3305eea7c0298cbfb11003e99
Instruction Fuzzy Hash: ADE1D1766183418FC310CF2AC881A5BFBE5EFD8204F454A2DF5D9EB242DB70E9058B92

Uniqueness

Uniqueness Score: -1.00%

Function 100A44A0 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100A45FE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: be3eea03730d72a41a397532957f06e27879d0567842d67822540b6754af0b19
Instruction ID: 0edebe261b6d61d75eb586ae0d04aa809c9480cf843a77263cde93058ec26e56
Opcode Fuzzy Hash: be3eea03730d72a41a397532957f06e27879d0567842d67822540b6754af0b19
Instruction Fuzzy Hash: F2518E756087459FC319CF78C49196BFBE5EFC9214F058A2EF4DA87242DA30E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100F3440 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100F3460

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 12328c45a7277c9a864ef8f581e0019096c758e6dcfc5fd304ef9b6cbeca3eca
Instruction ID: 0747dfd60b4a225782058bdbf443a62bdc82241afdc3da232f1f09281b0924e7
Opcode Fuzzy Hash: 12328c45a7277c9a864ef8f581e0019096c758e6dcfc5fd304ef9b6cbeca3eca
Instruction Fuzzy Hash: 865176726083049FD354DF65CC84A6BB7EAFBC8214F55892DB89583300DB74E90ADB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A53B0 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100A53F9

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 008aa756367cd25f81b387127a63d6a87f0a1abc4b56288225ee17a6841c3b1c
Instruction ID: 85727e18f71c0c42740829a641b17faba10552e6742c133b1d39cce03d5a3827
Opcode Fuzzy Hash: 008aa756367cd25f81b387127a63d6a87f0a1abc4b56288225ee17a6841c3b1c
Instruction Fuzzy Hash: F551657660D3809FC301CB68C490A9FFBF1ABDA210F985D5EF6D487352D662E908CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1009B920 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

, xrefs: 1009BCE4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 02244efa3e7db33a41a9b1162fb4fd7eaf40d12d5c40902eaf1974f0576d98c2
Instruction ID: 4d8e731b72b30e759846a9403cb22fc94454eb74e5b987d0002e575f796aaca5
Opcode Fuzzy Hash: 02244efa3e7db33a41a9b1162fb4fd7eaf40d12d5c40902eaf1974f0576d98c2
Instruction Fuzzy Hash: 91E1CF33A146674BD3149F5CCCC0231B7A2FFC9241F4A0639DA54D76A6CB7CEA52EA90

Uniqueness

Uniqueness Score: -1.00%

Function 100E7CF0 Relevance: 1.6, Strings: 1, Instructions: 346COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_ssl.c, xrefs: 100E7D34, 100E7D4A, 100E8057, 100E806C, 100E80A9

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_ssl.c
API String ID: 0-2114193724
Opcode ID: d6eed8f7c5bc852c10c77d0819851b0496fde110d51c63c2276b2fde99007650
Instruction ID: 202731097c8a8e8a1798ca2b204baa0c77d8136b4a700d9c847618fabab68669
Opcode Fuzzy Hash: d6eed8f7c5bc852c10c77d0819851b0496fde110d51c63c2276b2fde99007650
Instruction Fuzzy Hash: D0C1A275A187458FC308CF2AC89166AB7E1EFC8314F445A2DF5DAEB381DA34D944CB86

Uniqueness

Uniqueness Score: -1.00%

Function 100E8300 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_pk1.c, xrefs: 100E8340, 100E8359, 100E85A0, 100E85B1, 100E85F7

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\rsa\rsa_pk1.c
API String ID: 0-3362632063
Opcode ID: 8bdea76f1918e51315be98e6b3ec33bf99c8cd823df11fa80b774a797a119046
Instruction ID: 4656601c187d6136d90b4cf56b247f9ad861bb319a841c221c0b2c0e6a878967
Opcode Fuzzy Hash: 8bdea76f1918e51315be98e6b3ec33bf99c8cd823df11fa80b774a797a119046
Instruction Fuzzy Hash: 2B9116756483424FC708CF29C89166EB7D1EBC8314F444A2DF59ADB382DB35D648CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1008E058 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\ec\ec_mult.c, xrefs: 1008E2A2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\ec\ec_mult.c
API String ID: 0-4032731796
Opcode ID: 8771ffb312e0a7edd64203a4f79050ba084258315c2a011d6734be1a349a43b6
Instruction ID: e367261d5db850dc878faedcb884614af58cd6c81af788bbc40a3ae092f93f5d
Opcode Fuzzy Hash: 8771ffb312e0a7edd64203a4f79050ba084258315c2a011d6734be1a349a43b6
Instruction Fuzzy Hash: 8CB13072A083148FD358CF59C880A1AF7E2BFC8314F5A866DE95897362D771EC16CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1009F340 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

2-by@, xrefs: 1009F357, 1009F369, 1009F580, 1009F596

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: 2-by@
API String ID: 0-2364143481
Opcode ID: 2b32fde0877535e6298a70399349eb43480751079e8b109125c09197fa528e3b
Instruction ID: f2ee54bde88be95dee7839c409ac9eccdcd86a9f38950b25f45fedc729b2e590
Opcode Fuzzy Hash: 2b32fde0877535e6298a70399349eb43480751079e8b109125c09197fa528e3b
Instruction Fuzzy Hash: 3F81B7B2A183548FD704CF1AC84011AF7E6BFC8618F5A892EF999E3315D771A9058F86

Uniqueness

Uniqueness Score: -1.00%

Function 1003DCD0 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\init.c, xrefs: 1003DCED

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CompareExchangeInterlocked
String ID: ..\..\Src\openssl-1.1.1n\crypto\init.c
API String ID: 3335655927-4069939230
Opcode ID: db0220a01dac16769d011ef5ad3702f1a4bc7de56b732fd8f4113815527546c9
Instruction ID: b1f70ee786bcb86a9b658d679febfda76b719e9094833b0a39a67b102bfa3b0a
Opcode Fuzzy Hash: db0220a01dac16769d011ef5ad3702f1a4bc7de56b732fd8f4113815527546c9
Instruction Fuzzy Hash: 5051D136B316271ACBC7FA34BC03BA63180E750646F06693BF501DB585EF18E8A4C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 100F0220 Relevance: 1.0, Instructions: 999COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318e2d97611aef1cba4e2f44f8ae5618b33680e943e0a16696ffd2b84e69b7c3
Instruction ID: d6e6af761060abd692ee4b86c433dd3abba09dcc7a2e55ba749271abc3a6a79b
Opcode Fuzzy Hash: 318e2d97611aef1cba4e2f44f8ae5618b33680e943e0a16696ffd2b84e69b7c3
Instruction Fuzzy Hash: 12C2EB70908B95CBE368DF26C08064BF7F2FFC9200F518A9DD9959F656C738A481DB92

Uniqueness

Uniqueness Score: -1.00%

Function 100EE350 Relevance: 1.0, Instructions: 997COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca83f0d89127c0f381072eee3e09c685c542b022c8dac3e80ca0a0d603940ad
Instruction ID: fffc4294e338d4fe8b426d0ec940376f820ddf458559b55a8959c30118a957cb
Opcode Fuzzy Hash: 4ca83f0d89127c0f381072eee3e09c685c542b022c8dac3e80ca0a0d603940ad
Instruction Fuzzy Hash: FF82A371D047694FE358DF8E8CC4525BBE1BBC8300F8682BEDA584B367DAB49911DB84

Uniqueness

Uniqueness Score: -1.00%

Function 100A1410 Relevance: 1.0, Instructions: 982COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e56d084ebc02b9da0edae8414d24e6b88c90d21ec76f571aaf3eb45291f17b
Instruction ID: 6f1919d62602e7c913ea0a8af243f449d81e8e37e26023af515c7821ec73ef53
Opcode Fuzzy Hash: 07e56d084ebc02b9da0edae8414d24e6b88c90d21ec76f571aaf3eb45291f17b
Instruction Fuzzy Hash: 76824131A187648BD354CF6EC8C040BF7E2BBCD240F56CA6DE6948736AC674E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100AD970 Relevance: 1.0, Instructions: 950COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36de34125fb0439586a1779142f5a6375aabea8eaf634bf7ebe7f1a5fbcf58c2
Instruction ID: 49358237f168c9955ac8350f63b20e9dffd098777eb8f603cad0bd156c90a440
Opcode Fuzzy Hash: 36de34125fb0439586a1779142f5a6375aabea8eaf634bf7ebe7f1a5fbcf58c2
Instruction Fuzzy Hash: E79244329047724BD785DFAA8CC001677E3ABCE22174B875AEA857B75AC234F815CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 100AB440 Relevance: .9, Instructions: 914COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fb83acf4c805ee5198c95d46feaf2ac584ff4357195e1c6f2732b70f47b075
Instruction ID: 056d952713b344dc194e54ce1a26957a96f9fbc10e67630be58f70fa45852304
Opcode Fuzzy Hash: 55fb83acf4c805ee5198c95d46feaf2ac584ff4357195e1c6f2732b70f47b075
Instruction Fuzzy Hash: 1D7256327157734BE395CEAB8CC4017B7D3ABCE111B95C61AFB804B75AC538A41BCAA1

Uniqueness

Uniqueness Score: -1.00%

Function 100734F0 Relevance: .8, Instructions: 801COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb25b993926e6f180d8251141867fb0831bc4777db2e573d81e1a7e5b97c43f
Instruction ID: 4aaa20f6bd085cc32a838b4ba9f9fd4ff85fa1fe615a400a0fda509f71311c2f
Opcode Fuzzy Hash: dfb25b993926e6f180d8251141867fb0831bc4777db2e573d81e1a7e5b97c43f
Instruction Fuzzy Hash: BC52C7757483058FD708DE2AC88554AF7E2FBC8214B29CA3DE49AC7B10E779E54B8B41

Uniqueness

Uniqueness Score: -1.00%

Function 1008A200 Relevance: .8, Instructions: 791COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f91ad8bbc785aebd95116d2906185b91994df06b9953008607122133f8701a3
Instruction ID: b78aa1b75e9ec61e9d3465c3699a3cacf0fdeaa99d80a10b7b51e1cdd2e8fce4
Opcode Fuzzy Hash: 3f91ad8bbc785aebd95116d2906185b91994df06b9953008607122133f8701a3
Instruction Fuzzy Hash: C052B572D4836C4FC710DEE588C4146F7E1FBC4314F0A866CEEE857212E6B9A90A8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 1008A229 Relevance: .8, Instructions: 779COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf87498146efedfe544180c7589f6ea9aa3880ebf48a453dceb995bfcff7207
Instruction ID: e0b26ee44e18ee83732887408c8cc68d3ef6fd2196ff0d0278395a75df7ad3ff
Opcode Fuzzy Hash: 8bf87498146efedfe544180c7589f6ea9aa3880ebf48a453dceb995bfcff7207
Instruction Fuzzy Hash: D552B572D4836C4FC710DEE58CC4146F7E2BBC4314F0A866CEEE857212E6B9690A8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 100AC0E0 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad10e092b56ec8119a9a287bdfa3519f700b5ad6667342d98b97ef301de010d
Instruction ID: aa1e22d7e8c07d635cf1856f9b5f33b210cded158d04e9b57e4f0276cc4b4aa0
Opcode Fuzzy Hash: dad10e092b56ec8119a9a287bdfa3519f700b5ad6667342d98b97ef301de010d
Instruction Fuzzy Hash: 0862A6719047714BD785DFAD8CC001AB7E1ABCA221B86475FEB812B76AC638F915CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 100C3E10 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7731832ffad0be749a2263797dd770412b9364321a5b72a40d08b7bb47637fa0
Instruction ID: e5ca3f97c8bfa7f437eff4d16b1fdad33bc6d017fec7d25b116ed64c83d65d45
Opcode Fuzzy Hash: 7731832ffad0be749a2263797dd770412b9364321a5b72a40d08b7bb47637fa0
Instruction Fuzzy Hash: FA22D532E0C7684FD718CE2A8CD5165FBE3ABC4314F0E826DE8EA97246DD79540B8794

Uniqueness

Uniqueness Score: -1.00%

Function 100B3700 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189173ab9f89142349a5dafa8a5fb68d6edb67a8bd86c5051bf924958e007559
Instruction ID: 9c52c81011e3259cbab62a5867b8b46527de7dd367a34397880a07bc9ad500fd
Opcode Fuzzy Hash: 189173ab9f89142349a5dafa8a5fb68d6edb67a8bd86c5051bf924958e007559
Instruction Fuzzy Hash: A4626AB4618B40AFD368CF65C581A1BF7F1BF8C704F818A1DEA9A87650DB70A845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 100EF940 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcde0358c2a9db28c46c037cca3d0a4dcecfa3685d2b8a61dda0114ddbf5399c
Instruction ID: 5aab32b844538a49bce995bd0d248736f1b8e40ab4ad5c38f609b691fa563997
Opcode Fuzzy Hash: bcde0358c2a9db28c46c037cca3d0a4dcecfa3685d2b8a61dda0114ddbf5399c
Instruction Fuzzy Hash: 3332B637D107764BD7548FAD8CC4226B792AFDA310F8F4938CA552B766C678BA11C6C0

Uniqueness

Uniqueness Score: -1.00%

Function 100EF060 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286a9a538c9b4ec688bb167fa3b8d902b5357b967420bd5aa6268d0d09115fe4
Instruction ID: 04534fdfbdd457c76f7c6a9d9d867696e9b7a561d05a531993a381a543559f8b
Opcode Fuzzy Hash: 286a9a538c9b4ec688bb167fa3b8d902b5357b967420bd5aa6268d0d09115fe4
Instruction Fuzzy Hash: 4232C677D107764BE7548FA98CC4226B792AFD9310F8F4938CA552B763C6B8BA11C6C0

Uniqueness

Uniqueness Score: -1.00%

Function 10073F10 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2eae94677a8f9243c4f4da7277c92e26654c582eb81516dde0fe4314b6a996
Instruction ID: 9491c24e4484ab20f0cb1ef3b3ca33b036821a78b615319690cab303d80277bf
Opcode Fuzzy Hash: af2eae94677a8f9243c4f4da7277c92e26654c582eb81516dde0fe4314b6a996
Instruction Fuzzy Hash: 84029AB63443150BD718DEB4DC893AA72D2EBD4216F6BC93CD497C3B01FABCA88A4550

Uniqueness

Uniqueness Score: -1.00%

Function 100B1800 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c925561d05607ccf8351286625cd186a92db5367f4632c1e66248d95b32dde09
Instruction ID: efa29f53087eb380826009486c614a5b5200e3791b5a3ffe046ddf9addaf6e5e
Opcode Fuzzy Hash: c925561d05607ccf8351286625cd186a92db5367f4632c1e66248d95b32dde09
Instruction Fuzzy Hash: FD128C3550D3E14BD356CA2D48A059FFFE29EE7240F988D9EF1D487346C2798509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100B30B0 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bac93b56aa069f860c83d5d2caf9ad62692322917f8b4d7e3aeba7ec765e364
Instruction ID: fb1fd4b256ddf20910ed2af1943015a14269cf96f960f922fcdfd49f4be38605
Opcode Fuzzy Hash: 7bac93b56aa069f860c83d5d2caf9ad62692322917f8b4d7e3aeba7ec765e364
Instruction Fuzzy Hash: 6B02EB3050C7E24FD31ACB3E489012AFFE2DFDA201B58CA5EF4E687286D5749555CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100B10E0 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a1abf48ac27fdff10b112e7a26173192fb7bac3b51eba77563bf71079f0e59
Instruction ID: 6e3977a8d916768f6d4d89dca83fb69a86a9038390f03d896d1a162581003afc
Opcode Fuzzy Hash: b8a1abf48ac27fdff10b112e7a26173192fb7bac3b51eba77563bf71079f0e59
Instruction Fuzzy Hash: 2AF1E63050C7E24FD30ACB2E489052EFFE1DEDA240B584A6EF4E7C7292D568D915C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 100A9C50 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a92616b9fe0481b9357f2ac81fa6ec3c1bb7e1be097b41cbb215710762a59f
Instruction ID: f8a075fd3738a2275ff6103c0101c9f60c663fe0d14c365bc45ffdccb8f28d86
Opcode Fuzzy Hash: d0a92616b9fe0481b9357f2ac81fa6ec3c1bb7e1be097b41cbb215710762a59f
Instruction Fuzzy Hash: DFE1D72051C7E24BD30ACB3E489012EFFE2DED6200B588B5EF4E6C7286D678D555CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100B1FA0 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793699c7682d0d331073e4063ce81825dfd0e03d7568ffd83fce8dc606b66e0d
Instruction ID: df074a36ab1a3115be454bdf27a9acbcaa838bd1b5a72e58ba7eddbcb5507ad3
Opcode Fuzzy Hash: 793699c7682d0d331073e4063ce81825dfd0e03d7568ffd83fce8dc606b66e0d
Instruction Fuzzy Hash: 70E1F333E10A7407E318CE4A8C95399764397DA350F5F8339EE665B7DAC9B8AD16C2C0

Uniqueness

Uniqueness Score: -1.00%

Function 100DFC80 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de49062a14000e37357658998cbbc26f099a179cc1cead82276afb971a77aa0
Instruction ID: 5551b8be7b42af5bcffc13c9a039acf01a471652f019c83c40325b634e4ad341
Opcode Fuzzy Hash: 4de49062a14000e37357658998cbbc26f099a179cc1cead82276afb971a77aa0
Instruction Fuzzy Hash: 80F14B31A093458FD344DFAAC88064BFBE2BFC8204F45CA6DE998DB315D6B4D905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 100DF7F0 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad91b9fc1dc5975137f10897cf283aba91042874fa93920f5ddc0c641035816a
Instruction ID: 4f7f1f34b2aaadce960bfe3bd4396c91fc5d6a9354dbe9d9a112f5d050d5649d
Opcode Fuzzy Hash: ad91b9fc1dc5975137f10897cf283aba91042874fa93920f5ddc0c641035816a
Instruction Fuzzy Hash: 12E170716083488FD348DFA9C89062BFBE2BFC8344F44892DF59987351EAB4D909DB95

Uniqueness

Uniqueness Score: -1.00%

Function 1009F7E0 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51024640e856bdf1df823eb33b328327e6bececb33d2abd011dd19e0461bf85a
Instruction ID: fafef2deadac1e3242483273c9a9d8bc9069ddd526e34ec905fcfc1388c8cf9a
Opcode Fuzzy Hash: 51024640e856bdf1df823eb33b328327e6bececb33d2abd011dd19e0461bf85a
Instruction Fuzzy Hash: B1D11AB16183459FD358CF69CC9092BBBEAEFC8214F09892DF595C7351E674E801CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100FC69A Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: e690262fa7b85c9c8f2ab728c23e446e0e1eeeb363177a4a5ff0d60a268485be
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: E1C17177C0E9BB0B83B6C16D425992EEBA2EFD169031BC3E1CCD43F38996265D05A5D0

Uniqueness

Uniqueness Score: -1.00%

Function 100F4340 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26afdff61bdba8b250b2ee83fc3b9d87141ecaabc667575f2447c13374d4f540
Instruction ID: 45723130701a2446ab4fe5e84113101af02c599c70a06ab995ecd3257e97b498
Opcode Fuzzy Hash: 26afdff61bdba8b250b2ee83fc3b9d87141ecaabc667575f2447c13374d4f540
Instruction Fuzzy Hash: B202BEB5A083558FC754CF29C880A4ABBE1FFC8314F158A2EE99997311D730E945CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1009B360 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cabce9d21d602030fcb8efd8b0e9d52452e3fc2f56c27b661fc6d9400a71011
Instruction ID: b27b2509db5ef3d7b4f6be7af6f85c419e690df838e81d108b73ed778dd61672
Opcode Fuzzy Hash: 2cabce9d21d602030fcb8efd8b0e9d52452e3fc2f56c27b661fc6d9400a71011
Instruction Fuzzy Hash: 1DE18437D556774BD310DF58CC80625B352EF8A301F8F4674DE14A7B6ACB38EA12AA80

Uniqueness

Uniqueness Score: -1.00%

Function 100FC2C6 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: d7a3bf2a7bd1c1190fc01476779196f78098a436f908a4108d2d86cb479e5177
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 97C18273C0A9FB0B83B5C16D426992EEFA2EFD168131BC3E19CD43F289D5265E04A5D0

Uniqueness

Uniqueness Score: -1.00%

Function 100A63F0 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88c0c5c0fa2665b7fd1bd516cf7516952ffdd913f957e0a256d3d2487cc2761
Instruction ID: 7ce0b1e072e9e30c1dd50a64d8926494f2ac725b8bb5df1694f9a0b02dc09f00
Opcode Fuzzy Hash: d88c0c5c0fa2665b7fd1bd516cf7516952ffdd913f957e0a256d3d2487cc2761
Instruction Fuzzy Hash: 7BC16D7365456A4BDB18FF58DCA4A3037129BDA360F8B0178D6128BFBBDB3CA501DA44

Uniqueness

Uniqueness Score: -1.00%

Function 100A5F20 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53e9845156c0d0238e62575f99d20d511ac8e0e6bf105e5a532429c99182ff4
Instruction ID: 2f6bcec202c7ca95f682e0ca914108706e1c0e637070121a10afc1ca1fe0b790
Opcode Fuzzy Hash: a53e9845156c0d0238e62575f99d20d511ac8e0e6bf105e5a532429c99182ff4
Instruction Fuzzy Hash: D1C17F73A5456A4BDB18EF58DCA463037529BDA360F8F0138D6024BFBBDB3CA601DA44

Uniqueness

Uniqueness Score: -1.00%

Function 100A46C0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87eb464328cc5dfa9d70c09c845e3e35d441c5a1cc6d51940e82ad695e2a8bb
Instruction ID: 19f5a6362271cbbac685001a18d5c71586c6e97253cd6d0735dc991e42490357
Opcode Fuzzy Hash: d87eb464328cc5dfa9d70c09c845e3e35d441c5a1cc6d51940e82ad695e2a8bb
Instruction Fuzzy Hash: 7DD1C175A087409FC348CF69C48091BFBE1BFC9610F95892EF59A87361DB71E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 100A30E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5dd9cb76552506f81ac1197bc3127edb39344e862662d046f748c330e68657
Instruction ID: dd617f6bccd25ef31bbe67537004fca734dbde69267c3ae8e6acbc4bbdb03758
Opcode Fuzzy Hash: ac5dd9cb76552506f81ac1197bc3127edb39344e862662d046f748c330e68657
Instruction Fuzzy Hash: 94B12671509B419FC364CF69C880A9BFBF5EF89204F448A2DE4DA87641D730EA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A8630 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdeb55c52b2204f07dd822e27e774c2fff51117a2d57b90c6ff576fb5413940d
Instruction ID: 29e888a703feb734e4d5791c7a80db497b2421578f84ff3a3be373208deb6906
Opcode Fuzzy Hash: fdeb55c52b2204f07dd822e27e774c2fff51117a2d57b90c6ff576fb5413940d
Instruction Fuzzy Hash: 83B1BAB7E516034FE3A88E59DC80B653353EFDC328F5B46B88A045B7A3DE7875528680

Uniqueness

Uniqueness Score: -1.00%

Function 100A2080 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1233a216f87ace4da488e25f451d095662bc3624e14b851c253aa0b95af867
Instruction ID: 6919cd6a4eeec577892f2d427309faea8d7b63c745942fac5b211624f6671c4d
Opcode Fuzzy Hash: 4f1233a216f87ace4da488e25f451d095662bc3624e14b851c253aa0b95af867
Instruction Fuzzy Hash: 80818673B1832A4F975CDEB8885512AF7D1FB88200B428A3EEA1AD7742DE709D54C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 100A5A70 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737c3322a49836cf7d1490ba60a63c78418fe55e5df5f28a0abb991cf202d1bd
Instruction ID: ec0d91ba059e995bdd6625ef44c3ee4012ac2551945255b756f573edfb386514
Opcode Fuzzy Hash: 737c3322a49836cf7d1490ba60a63c78418fe55e5df5f28a0abb991cf202d1bd
Instruction Fuzzy Hash: 24A10271A08B059FC358CF69C481A5BF7E1FFC8214F518A2EE59AC7210EB31E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100A5760 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b15cab38e90564d45b0d6034c007c488336c5ee0a6d961d1bacb601f1965ab
Instruction ID: 2da3a484d1f1ac25acab96c1b7c40a8ad6c7303a8a7592ce38fb3b30dee03499
Opcode Fuzzy Hash: a4b15cab38e90564d45b0d6034c007c488336c5ee0a6d961d1bacb601f1965ab
Instruction Fuzzy Hash: 80A1E371608B05DFC358CF69C481A5BF7E1FF88204F558A2DE49AC7620EB31E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100A3750 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f8b40f9876d2f5cf9630172578d8cfaa3506d82e8bd1c7852c444bcf5039aa
Instruction ID: edb941b74f8af37631ea3f093be3b859afcebdad7d0716294d6fb499bcfd7586
Opcode Fuzzy Hash: b2f8b40f9876d2f5cf9630172578d8cfaa3506d82e8bd1c7852c444bcf5039aa
Instruction Fuzzy Hash: 2AA15B75508B419FD324CF69C880AABBBE5EF99304F448A2DF4DA87741D774E508CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A3450 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d041094cb13764e8bbf53f4e8954afdb19d456322e1ac9f4587b9a551cc70ac
Instruction ID: 615c3d9c63c56c068861df97bd198739c9b8d36c07cc297c572cfc749a8ac18c
Opcode Fuzzy Hash: 1d041094cb13764e8bbf53f4e8954afdb19d456322e1ac9f4587b9a551cc70ac
Instruction Fuzzy Hash: CC916D75508B819FD324CF69C8809ABFBE5EFD9204F44892DF8DA87742D674E904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100D6610 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b2e843147d590cfe61bba9cb1a19e3280db8ec71e839e91af5ed5c298eccfe
Instruction ID: a7b0f8064bda915d8d15e926f09877342ff6cbf646fabd7eab345856f57f86ee
Opcode Fuzzy Hash: 50b2e843147d590cfe61bba9cb1a19e3280db8ec71e839e91af5ed5c298eccfe
Instruction Fuzzy Hash: 9C917F742163099BC354CF25D88099BB3EAFFC9604F019E0DF5869B352DA34F519CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100A2340 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbc680b12e9049597f3b6bcba1d2f1a3c802117ba4daf8e31436a29f1355ea4
Instruction ID: 2480fe3bec63a23332a85c5a9775336efb32b4d83088e20f92cf0ebdd7aa7e04
Opcode Fuzzy Hash: 1dbc680b12e9049597f3b6bcba1d2f1a3c802117ba4daf8e31436a29f1355ea4
Instruction Fuzzy Hash: 2FC1D5B19143188FD344DF5AC184A56BBE1BF8C710F4685FEEA589B322DBB0A940CF95

Uniqueness

Uniqueness Score: -1.00%

Function 100A01A0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105f2158a6611993c0257c47a980d4f3f9594e348e6d32af3bd260417d5387b9
Instruction ID: c797faa5ce2fd57d9ff60820058c633a56d10d268611752aa5839d18101de8dd
Opcode Fuzzy Hash: 105f2158a6611993c0257c47a980d4f3f9594e348e6d32af3bd260417d5387b9
Instruction Fuzzy Hash: 4D9178756083868FC314CF68C48495BFBE2EFD9304F548A6DF89987356D631EA09CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100C1EF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee89d689d5afa56b0f34e97a610b6b8622f93ca8cc83a2dadd411fc61f0670f
Instruction ID: 352387aaa190f57d13bafb144d15e6690b7537748c983613247861b0596a425d
Opcode Fuzzy Hash: 7ee89d689d5afa56b0f34e97a610b6b8622f93ca8cc83a2dadd411fc61f0670f
Instruction Fuzzy Hash: 93711071A083458BD324CF24C98079FBBE2FFD5348F19496DE98957342DB74AA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100E0770 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c562e40e045c87c7e4147b9d7fc1a80d448aa0e823dc7ccdabe914be2e647d
Instruction ID: 00a5b462981a1cf8f107ddc03e56872e4445ab8bb6c81a4405e9af4aadc98319
Opcode Fuzzy Hash: 12c562e40e045c87c7e4147b9d7fc1a80d448aa0e823dc7ccdabe914be2e647d
Instruction Fuzzy Hash: 1A91F77154830C8FC750EF99D8C454BF7F0FF88248F94492DEAA493212E775AA2C8E5A

Uniqueness

Uniqueness Score: -1.00%

Function 100F5B10 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df44ac7dcbd0e7cee31d8a69021c8e385fa33f32834fd71a973ec0664753dbc3
Instruction ID: 001404269b230727e93032c9c96cd41cfc6e59053aae61ec727a1d61ad6a564b
Opcode Fuzzy Hash: df44ac7dcbd0e7cee31d8a69021c8e385fa33f32834fd71a973ec0664753dbc3
Instruction Fuzzy Hash: CB61D075600B0A8FD714CE2CC890766B7E2FFC8351F598628EA868B395D732AD15DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 100A0560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43a35025d00178709ad1ce750bbc249231ce6e1d98488e41af471f84a14207d
Instruction ID: 5f78933d06370ca67ef34d8e8948ebb086c519438b6dc1fb0bc8be9b008c93c5
Opcode Fuzzy Hash: e43a35025d00178709ad1ce750bbc249231ce6e1d98488e41af471f84a14207d
Instruction Fuzzy Hash: CE71497190838A8FD314DFA8C48496BBBE4EFDA348F050A6DF98587356D770E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100B15E0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085b87d8920e3b274df818bfaeb7ebfd58492b29fe08ed70cce48bc8f06468b5
Instruction ID: 7834173dfa2f13005fc1506220a209cde86d28c77d89b6a755d9894779119d98
Opcode Fuzzy Hash: 085b87d8920e3b274df818bfaeb7ebfd58492b29fe08ed70cce48bc8f06468b5
Instruction Fuzzy Hash: 9D61E73560D7D18FD30ECB2D889442ABFE2DFDA201B49869DF4D687356C934D909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100A9380 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46abfef278dcf97fb894ad6471a9b46f2686deda216b92bf9dc68f6c039c366
Instruction ID: b00fc3d5a53abe29b59d578b4735fefa544b72dfe887c0a802c13e60286f36db
Opcode Fuzzy Hash: d46abfef278dcf97fb894ad6471a9b46f2686deda216b92bf9dc68f6c039c366
Instruction Fuzzy Hash: 7B61E93560C3D18FD30ECF2D545042ABFD2DEDB241B49859DE4E69B356C938990ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 10073D10 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1880768dfd979665444f3220fc7254c96848f62dc4ad44dc4923d6de58c0862
Instruction ID: c7af47b56d8c578019208be9c5e182fbbd262ece6cc70d7486acc2b7581a4f5f
Opcode Fuzzy Hash: e1880768dfd979665444f3220fc7254c96848f62dc4ad44dc4923d6de58c0862
Instruction Fuzzy Hash: 8B71F8727483058FC344CF6AC88554AF7E2FBC8214B19C97DE89987711E779E98A8B41

Uniqueness

Uniqueness Score: -1.00%

Function 100AA130 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499531912157810fc502619fa23dbb6bdaca9111d4e19ff7ab913dee1b481fe4
Instruction ID: 464b945d995b613c6e2f8915c928e86283f0f152a30e5519063a248cbe82b971
Opcode Fuzzy Hash: 499531912157810fc502619fa23dbb6bdaca9111d4e19ff7ab913dee1b481fe4
Instruction Fuzzy Hash: EA51D63150C7D18FD34ACB2D589042ABFD2DEDB201B19C69DF4E687396CA789909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 100F5D50 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fabebf498c008535001661b98619b50f0172134d3717fb920515986231a579
Instruction ID: b20ae9ee541575e9a0a45b90e307aaf4b5d0ede3017b22807009aab832a6777a
Opcode Fuzzy Hash: 97fabebf498c008535001661b98619b50f0172134d3717fb920515986231a579
Instruction Fuzzy Hash: 92518066EA5F0D0BE360E9BA9C457A576C39BC4305F18C1386E248338AFDBC6A5D81D4

Uniqueness

Uniqueness Score: -1.00%

Function 100F60E0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5214744711500d8bf868958742e71e7c5b0a035537440c7899966b161633f52
Instruction ID: 196c762906fa4c510a7c9e9c628d769838240baf8c56f1d9733054b10aecd72d
Opcode Fuzzy Hash: d5214744711500d8bf868958742e71e7c5b0a035537440c7899966b161633f52
Instruction Fuzzy Hash: 5A6125756083469FC304CF68C980A5BBBE6FFC8348F05891DF9999B212D772F9059B92

Uniqueness

Uniqueness Score: -1.00%

Function 100A5550 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c28108b29a86d334f2634723e0d6b8714d52f3b5f7c10f1ab7f894f523684f
Instruction ID: a05d591d5e9378cf84db8a3921dee10f716620462485459251b3bb8cc102636a
Opcode Fuzzy Hash: d3c28108b29a86d334f2634723e0d6b8714d52f3b5f7c10f1ab7f894f523684f
Instruction Fuzzy Hash: 3C71C271A08B049FC358DF69C481A1BF7E2FF8C614F91892EE59A87760E731E941CB42

Uniqueness

Uniqueness Score: -1.00%

Function 100A7080 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22343de66344219aaca8d61ece09364da34b6e73426b772e80db65d6b5d1b50e
Instruction ID: 251bce121bf567803ef8129c4171e6779542caae6c02cb83190fbfc1bd7fe91f
Opcode Fuzzy Hash: 22343de66344219aaca8d61ece09364da34b6e73426b772e80db65d6b5d1b50e
Instruction Fuzzy Hash: 0B51403160D3818FC309CB6D889055EBFE1AFEA101F884AAEF4D597352C625D905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100A9650 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77b1dbf541bddc92e1fc8c220628755ac28629ec286401bd0be8ccba2ed9d8f
Instruction ID: 20e455fdc5bde967b279905c7a8a674320b79e71f34e814a92df8a80a8d13fda
Opcode Fuzzy Hash: a77b1dbf541bddc92e1fc8c220628755ac28629ec286401bd0be8ccba2ed9d8f
Instruction Fuzzy Hash: AB51503561D3918FC309CB6D849056EBFE1EFEA100F884AAEF4D597352C624D909CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 100B2690 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b2c54f2f7677449592c7a49d6e539ac2b68a9f43bc822b39fc72ccb5e4d7a1
Instruction ID: 6d1aad2f5b1b3b558a9aabef1dfbdd040678755a9f5ee3039b73e6f426c62553
Opcode Fuzzy Hash: 77b2c54f2f7677449592c7a49d6e539ac2b68a9f43bc822b39fc72ccb5e4d7a1
Instruction Fuzzy Hash: FD51303560D3818FC345CB2D849055EFFE1EFEA200F844AAEF4D597352CA759909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100AA3F0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5013b38604afe56145d4a26b50d41edb66f863a534691e0765bb1f03f56cf690
Instruction ID: a813975ea27165ab45f726d73b4287c025a9ecf380de56eeda6288aaa4265bff
Opcode Fuzzy Hash: 5013b38604afe56145d4a26b50d41edb66f863a534691e0765bb1f03f56cf690
Instruction Fuzzy Hash: 4A514E3160D3808FC345CB2D849056EFFE2EBEA201F884AADF4D597352C6749909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 10074420 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52adbe9e5281816011fbc4b5e050a22d7f1536c2447d7e26605eef209e26d04f
Instruction ID: 8c15b9bedb44873dc5b6ef47f903882c704a57ca9dcb95cefd194d896618027a
Opcode Fuzzy Hash: 52adbe9e5281816011fbc4b5e050a22d7f1536c2447d7e26605eef209e26d04f
Instruction Fuzzy Hash: 9A5194B63442054FD708DE68CC857AAB2D6EBC4315F1BC83DE89AC3701FABCA8469651

Uniqueness

Uniqueness Score: -1.00%

Function 100F3A60 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feca345777392cad918198d2136839552a2b5ed476079dfeb647fde3d084aab9
Instruction ID: d3a735a2defb5a2bef99ec2efa73f02423ba0178daae4597e7f2bc018cdf93ce
Opcode Fuzzy Hash: feca345777392cad918198d2136839552a2b5ed476079dfeb647fde3d084aab9
Instruction Fuzzy Hash: E651B072B043158BC318CE6DCC8054AF7D3EFC8324F6A863CE99997385CA79AC498691

Uniqueness

Uniqueness Score: -1.00%

Function 100DF640 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4774b97d26911314886fd226fd9cf99473cf4b69df2164468e95a7c2718f84d
Instruction ID: b4328cfc308614a06041cc32b6fd9d6d28031ca6b9aeb79a537e8e5cdca9e734
Opcode Fuzzy Hash: e4774b97d26911314886fd226fd9cf99473cf4b69df2164468e95a7c2718f84d
Instruction Fuzzy Hash: 9051DCB6D083640DE3589E658480325BED1ABC4341F1BC1BDE9E8CB292DAB9C506DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 100F58F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f1b07f143f11c21a46361b5e726b55540961a1e8f40364cff745b4ad1c0ced
Instruction ID: 8456a96f8dce0d99cbe731be16952523600e377d5091562c9afa61866e665efa
Opcode Fuzzy Hash: 20f1b07f143f11c21a46361b5e726b55540961a1e8f40364cff745b4ad1c0ced
Instruction Fuzzy Hash: F0416DB2A1471A4BC39CEE9A984050BB3D2E7C8204FA5C73CDE5497B89E574F922C7C5

Uniqueness

Uniqueness Score: -1.00%

Function 1009B110 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924a532ec4a937a5cb4da15d753f46e68980388aad204c8ac203645749021fcb
Instruction ID: d80e3447dd3898576b61a7fd81284cd3d92b3a55b788482c6d8bf6c9f581bd18
Opcode Fuzzy Hash: 924a532ec4a937a5cb4da15d753f46e68980388aad204c8ac203645749021fcb
Instruction Fuzzy Hash: B7515B339091728FC715CF48C894A24F7A6EF86390F5F81B9C9086BA76C775F911AB80

Uniqueness

Uniqueness Score: -1.00%

Function 100A2680 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342a4389badde96c65a5eca52a5f503a1a1d242b6fd8f66f25f2fc1b9be3ae58
Instruction ID: 3360459bdbf772fb4c08f5bdbb44ca9f5e93e79b03517173d9bb81f5c3319046
Opcode Fuzzy Hash: 342a4389badde96c65a5eca52a5f503a1a1d242b6fd8f66f25f2fc1b9be3ae58
Instruction Fuzzy Hash: F241A3726087548FE318CF69885051BFBD2AFD9210F49C96CE99B9B792C930F815C791

Uniqueness

Uniqueness Score: -1.00%

Function 100AA6E0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ac393789333d9e3cbccbfd57b5cd3cc078ee7bdc1ae754e466deccc62a9832
Instruction ID: da5b40ba0f1f3855dc81100fb4e0320f0f5a1eb8e70bf138fca7976b66ff688d
Opcode Fuzzy Hash: a9ac393789333d9e3cbccbfd57b5cd3cc078ee7bdc1ae754e466deccc62a9832
Instruction Fuzzy Hash: B741A9201085B10AD32ECB6D88B947AFFD2DFCA111B5DC6AEE1F78E1D6D52C8544DB60

Uniqueness

Uniqueness Score: -1.00%

Function 1009FBF0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6f12e01a101f784fd847205c1da6223f6e4efc2c37c7ce12ef970554e8fc6f
Instruction ID: cdb93d59b53216cae853b9dee3802149fdc4e27acb3e1b14b275fe6965b02a94
Opcode Fuzzy Hash: 0d6f12e01a101f784fd847205c1da6223f6e4efc2c37c7ce12ef970554e8fc6f
Instruction Fuzzy Hash: 6B4162326093558FC308CF19C89145AFBD2EFD8214B4ECAADE88957716C634A905CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 100F41C0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1466559d66ef7a9c8fd82d6fc49a39265b221d8d839ff41d249c76b5f98204bd
Instruction ID: 38884a6315f4e1f79e442f95004a623a043614aef9fe7ebdbc8987d686439642
Opcode Fuzzy Hash: 1466559d66ef7a9c8fd82d6fc49a39265b221d8d839ff41d249c76b5f98204bd
Instruction Fuzzy Hash: 38419272A183098FC314CF6CD88552EB7E1FBC8310F564B2DF9A597281DA74D909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 100F3488 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37aff664f9d256aef14c413e35ce7737bb52a871cf2dd8b6aeb94243b142d9c5
Instruction ID: 3a8cd5faa2c4ad3b97c1967b5d8a0f9df03d6f8b6707bb742a00cfc5ed4f9227
Opcode Fuzzy Hash: 37aff664f9d256aef14c413e35ce7737bb52a871cf2dd8b6aeb94243b142d9c5
Instruction Fuzzy Hash: 96417B716083148FD354DF65CC8596BB3E6FFC8214F55882DA895C7300DB74E80A9B92

Uniqueness

Uniqueness Score: -1.00%

Function 100F3320 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b13bdd273d2c9756156e1b8bdd38ead00bc43ea132ebc60126dbec69c079025
Instruction ID: 5650ef310cac790d8a5f24ed7b0c495cae682f7b14e219f0bac31358b6e85768
Opcode Fuzzy Hash: 6b13bdd273d2c9756156e1b8bdd38ead00bc43ea132ebc60126dbec69c079025
Instruction Fuzzy Hash: F5417E72B093158FC304CF69C88454BF7E2FFC8611F59CA6DE9889B315DA70BA098B91

Uniqueness

Uniqueness Score: -1.00%

Function 100A5D90 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0f8d17bcdf8724a9ea672e4a67b2238bc1481e84950fd360a372ba84fa295b
Instruction ID: 0d2c51f5878165ed423dbb9b03c04025304d62531657ce9887f0e0e54c67fd42
Opcode Fuzzy Hash: 5a0f8d17bcdf8724a9ea672e4a67b2238bc1481e84950fd360a372ba84fa295b
Instruction Fuzzy Hash: 1131E375604B008FD358DF29D592A2BB3E1FFDC704F818D1DE49A87651DA30B905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100B4430 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5243bfddab6d022af0726145ec1be10aa1ce4872a381a644bc82670f2564bf6
Instruction ID: d765f6cfe148dea663d3db8ea5705846a9ec3d545742984e8f0c042bea65ee25
Opcode Fuzzy Hash: b5243bfddab6d022af0726145ec1be10aa1ce4872a381a644bc82670f2564bf6
Instruction Fuzzy Hash: 81210B2A60878A4BC714DDACD84071FB7D5EFD5100F05C96DE9CA97702DB60E918C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 100A3D30 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec08d149ecfa6be2b40e01b4dc94bad01a90ea383ffb5275a71a76fa15f278e
Instruction ID: 6dc84aded64767277a82ca1e1ad33af1fec9cf43660c1bfc53fd7c4bbd7db066
Opcode Fuzzy Hash: aec08d149ecfa6be2b40e01b4dc94bad01a90ea383ffb5275a71a76fa15f278e
Instruction Fuzzy Hash: 3721D1311097C18BD321CE79988465BBBF1EF86224F158E6DE8C647A43D764EA0DC752

Uniqueness

Uniqueness Score: -1.00%

Function 100524D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc281d633757abb1e25df9bd32246cd0c115047ba5503716c0a59fd9e2aa907a
Instruction ID: 22e5c61ec793be3b84c407c6eab48209d7987e519b5809fbb6a4910005246b59
Opcode Fuzzy Hash: dc281d633757abb1e25df9bd32246cd0c115047ba5503716c0a59fd9e2aa907a
Instruction Fuzzy Hash: FF01E773B7182A035B1CC42E9C021AA418757C952439FCB7DED6BEF286F828DC1292D0

Uniqueness

Uniqueness Score: -1.00%

Function 100D0370 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11579eb5e8334947ebe28cc581943f35bc9782ef196a64b1e55edb161b27cd77
Instruction ID: 3be469f4119dd3524e89ed125d8612be05bc80664b915e133b5c0307bb7cb7f6
Opcode Fuzzy Hash: 11579eb5e8334947ebe28cc581943f35bc9782ef196a64b1e55edb161b27cd77
Instruction Fuzzy Hash: B8011272E016248FC704CF6AC944546FBE6FFCD22131AC1D9D849DB23AE6316D018B80

Uniqueness

Uniqueness Score: -1.00%

Function 100B6490 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 8725bd603a8d11bf5c5a21a77c770c9bafb9f62b5db7448ec6a0390127b607a6
Instruction ID: d6c664c554a70d08bff3f895527b46eb22aa63677551d56b376aa1835cf9c695
Opcode Fuzzy Hash: 8725bd603a8d11bf5c5a21a77c770c9bafb9f62b5db7448ec6a0390127b607a6
Instruction Fuzzy Hash: C711CB35605B029B8368CF3AD192952FBF1BF5C7103529A2EA49BC7E60D730F861CE94

Uniqueness

Uniqueness Score: -1.00%

Function 10005755 Relevance: 114.0, APIs: 40, Strings: 25, Instructions: 241
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 10005774
_memset.LIBCMT ref: 1000579D
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100057CC
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100057D9

Part of subcall function 10005105: FreeLibrary.KERNEL32(00000000,?,10005A0E,?,?,?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 1000511F
Part of subcall function 10005105: GetLastError.KERNEL32(?,10005A0E,?,?,?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005129

GetProcAddress.KERNEL32(00000000,AB7FC8EE888E4a9b8E35ECA228EC5A00), ref: 1000584D
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005855
GetProcAddress.KERNEL32(?,AI2E0A2B5D6), ref: 10005873
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005882
GetProcAddress.KERNEL32(?,AI2ED186BB0), ref: 1000588F
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005898
GetProcAddress.KERNEL32(?,AI2E5DE6421), ref: 100058A5
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100058AE
GetProcAddress.KERNEL32(?,AI2EB0BA897), ref: 100058BB
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100058C4
GetProcAddress.KERNEL32(?,AI280A6E132), ref: 100058D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100058DA
GetProcAddress.KERNEL32(?,AI244B9D58C), ref: 100058E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100058F0
GetProcAddress.KERNEL32(?,AI27533E519), ref: 100058FD
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005906
GetProcAddress.KERNEL32(?,AI23F75C85E), ref: 10005913
GetProcAddress.KERNEL32(?,AhnInst2_GetInstallVersion), ref: 10005920
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005929
GetProcAddress.KERNEL32(?,AhnInst2_IsT), ref: 10005936
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 1000593F
GetProcAddress.KERNEL32(?,AhnInst2_IsTOver), ref: 1000594C
GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005955

Strings

AI2E5DE6421, xrefs: 1000589D
AI2EB0BA897, xrefs: 100058B3
AhnInst2_RebuildSerial, xrefs: 100059B2
AI2C69D3464, xrefs: 10005970
AhnInst=%s, xrefs: 100057B9
AI29B2A45A0, xrefs: 100059CC
AI27533E519, xrefs: 100058F5
Load AhnInst Err=%d, xrefs: 100057E2
%PluginDir%\AhnI2t.dll, xrefs: 100057A2
AB7FC8EE888E4a9b8E35ECA228EC5A00, xrefs: 10005847
AI23F75C85E, xrefs: 1000590B
AhnInst2_IsTOver, xrefs: 10005944
AI280A6E132, xrefs: 100058C9
AI2E0A2B5D6, xrefs: 1000586B
AhnInst2_IsT, xrefs: 1000592E
AI244B9D58C, xrefs: 100058DF
AI2BAA2C0CD, xrefs: 100059D6
AhnInst2_InvalidSerialNum, xrefs: 1000595A
DllImport:Init, xrefs: 1000577B
AhnInst2_GetInstallVersion, xrefs: 10005915
AhnInst2_ConcealSerial, xrefs: 1000599C
AI210F4C7D9, xrefs: 10005986
Get AhnInst addr Err=%d, xrefs: 100059F8
AI2ED186BB0, xrefs: 10005887
AI264E8E65A, xrefs: 100059E3

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressErrorLastProc$Library$CurrentFreeH_prolog3LoadProcess_memset
String ID: %PluginDir%\AhnI2t.dll$AB7FC8EE888E4a9b8E35ECA228EC5A00$AI210F4C7D9$AI23F75C85E$AI244B9D58C$AI264E8E65A$AI27533E519$AI280A6E132$AI29B2A45A0$AI2BAA2C0CD$AI2C69D3464$AI2E0A2B5D6$AI2E5DE6421$AI2EB0BA897$AI2ED186BB0$AhnInst2_ConcealSerial$AhnInst2_GetInstallVersion$AhnInst2_InvalidSerialNum$AhnInst2_IsT$AhnInst2_IsTOver$AhnInst2_RebuildSerial$AhnInst=%s$DllImport:Init$Get AhnInst addr Err=%d$Load AhnInst Err=%d
API String ID: 2022409103-795547928
Opcode ID: 8017d9c63eb869fad5fc0e405041cc095e8b3694f4b83c651afe37298c44efa7
Instruction ID: 8fe7936b1f08ecb244df466f680df582b2da874610a80b09feece5cbc253859d
Opcode Fuzzy Hash: 8017d9c63eb869fad5fc0e405041cc095e8b3694f4b83c651afe37298c44efa7
Instruction Fuzzy Hash: 65815E70A0070A9FE725EFBACC4099FFBF9FF44284B01493AE955E6550EBB5E9408E14

Uniqueness

Uniqueness Score: -1.00%

Function 10009A65 Relevance: 61.7, APIs: 20, Strings: 15, Instructions: 417
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001672D: _wcsrchr.LIBCMT ref: 10016739

Part of subcall function 10007633: IsCharAlphaW.USER32(B2A1A428,00000104), ref: 1000764E
Part of subcall function 10007633: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?), ref: 1000769D
Part of subcall function 10007633: GetLastError.KERNEL32(?,?,?,?,?), ref: 100076B9

SetFileAttributesW.KERNEL32(?,00000080,?,00000001,00000104,?), ref: 10009C1B
CopyFileW.KERNEL32(?,?,00000000,?,00000001,00000104,?), ref: 10009C31
GetLastError.KERNEL32(?,00000001,00000104,?), ref: 10009C44
_wcsrchr.LIBCMT ref: 10009C7B
CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 10009E8F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000104,?), ref: 10009E98
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000104), ref: 10009EC8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000104,?), ref: 10009ED2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000104,?), ref: 10009F01
AhnIEx_SetReboot.AHNIEX ref: 10009F42

Strings

AIL:Copy:DeleteOnReboot(%s) err=%d, xrefs: 10009DB8
AIL:Copy(%s, %s) err=%d, xrefs: 10009D4D, 10009F57
.t0_, xrefs: 10009E67
AIL:Copy:SetAttr(%s)=%d, xrefs: 10009DF0, 10009ED9
AIL:FindFromPendingFileList()=%s, xrefs: 10009B16
AIL:Copy(%s)=ok, xrefs: 10009E06
AIL:Copy:Tmp=%s, xrefs: 10009CAC, 10009E76
AIL:Copy:ReplaceOnReboot(%s, %s) err=%d, xrefs: 10009F11
AIL:Dest file is equal or higher, xrefs: 10009B3E, 10009BAF
.t1_, xrefs: 10009C9D
AIL:Copy:Rename(%s, %s) err=%d, xrefs: 10009CEF, 10009D8C
AIL:Copy(%s)=%d -> CopyOnReboot, xrefs: 10009F33
AIL:Copy:CopyToTemp(%s, %s) err=%d, xrefs: 10009EA4
AIL:Copy(%s)=%d -> Rename, xrefs: 10009D1A
AIL:Copy:CompareFile(%s, %s) err=%d, xrefs: 10009BF4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy_wcsrchr$AlphaCharFindFirstReboot
String ID: .t0_$.t1_$AIL:Copy(%s)=%d -> CopyOnReboot$AIL:Copy(%s)=%d -> Rename$AIL:Copy(%s)=ok$AIL:Copy(%s, %s) err=%d$AIL:Copy:CompareFile(%s, %s) err=%d$AIL:Copy:CopyToTemp(%s, %s) err=%d$AIL:Copy:DeleteOnReboot(%s) err=%d$AIL:Copy:Rename(%s, %s) err=%d$AIL:Copy:ReplaceOnReboot(%s, %s) err=%d$AIL:Copy:SetAttr(%s)=%d$AIL:Copy:Tmp=%s$AIL:Dest file is equal or higher$AIL:FindFromPendingFileList()=%s
API String ID: 3008204920-4061539475
Opcode ID: d36fc14ecc063714d15e0b6cc8240ffeb84592d17e0c0caf6ace9dd16553eb08
Instruction ID: ae43074bdcc95430167a19f951c4cc439f0b05fb5f1ed07363bf9d2bdda86df3
Opcode Fuzzy Hash: d36fc14ecc063714d15e0b6cc8240ffeb84592d17e0c0caf6ace9dd16553eb08
Instruction Fuzzy Hash: 35D17CB290064D6BFB21DBB1CD85FDE76ECEF05380F100126FA09DB186EB759A458B61

Uniqueness

Uniqueness Score: -1.00%

Function 100060A0 Relevance: 59.7, APIs: 15, Strings: 19, Instructions: 234librarymemoryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100060A7
GetModuleHandleW.KERNEL32(Kernel32.dll,00000030,100063D6,?,?,00000000,00000040,00000003,AIL:ExecAsAdmin(%s, %s),?,?,00000068,10002B52,?,?,?), ref: 100060CE
GetLastError.KERNEL32 ref: 100060D8
GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 100060EE
GetLastError.KERNEL32 ref: 100060FA
GlobalAlloc.KERNEL32(00000040,00000014,SetSecurityDescriptorDacl,InitializeSecurityDescriptor,DuplicateTokenEx,advapi32.dll), ref: 1000621F
GetLastError.KERNEL32 ref: 1000625D
GlobalFree.KERNEL32(00000000), ref: 1000627E
GetLastError.KERNEL32 ref: 10006293
GetLastError.KERNEL32 ref: 100062C5
GetLastError.KERNEL32(advapi32.dll), ref: 10006340

Part of subcall function 1000A2D6: FreeLibrary.KERNEL32(?,?,1001623A,SHFolder.dll,0000000C,10018802,00000023,?,101728B8), ref: 1000A281

GlobalFree.KERNEL32(00000000), ref: 1000630C

Part of subcall function 100FAADF: CreateFileW.KERNEL32(1017A5D8,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 100FAB67
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 100FAB91
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000036,?,00000000), ref: 100FABB5
Part of subcall function 100FAADF: __wcsnicmp.LIBCMT ref: 100FABD7
Part of subcall function 100FAADF: SetFilePointer.KERNEL32(00000000,0000006E,00000000,00000000), ref: 100FAC8E

GlobalFree.KERNEL32(00000000), ref: 100062E6

Part of subcall function 10006065: CloseHandle.KERNEL32(00000000,00000000,?,00000001,10006379,?,?), ref: 10006082

Strings

AIL:GATI:CurSessionId=%d, xrefs: 1000612A
AIL:GATI:ProcessIdToSessionId not found=%d, xrefs: 10006101
AIL:GATI:ProcessIdToSessionId err=%d, xrefs: 10006120
AIL:GAT:Can't duplicate token. err=%d, xrefs: 100062CC
advapi32.dll, xrefs: 100061BD
Kernel32.dll, xrefs: 100060C6
AIL:GATI:DupT=%x, xrefs: 10006314
InitializeSecurityDescriptor, xrefs: 100061DF
AIL:GAT:Get addr err, xrefs: 10006330
AIL:GATI:GetKernelModuleHandle err=%d, xrefs: 100060DF
SetSecurityDescriptorDacl, xrefs: 100061EF
AIL:GATI:MinT=%x, xrefs: 100061A2
AIL:GAT:hMinToken=NULL, xrefs: 10006363
AIL:GAT:Can't initialize SD. err=%d, xrefs: 10006264
ProcessIdToSessionId, xrefs: 100060E8
AIL:GAT:Load err=%d, xrefs: 10006347
AIL:GAT:Can't Set SD Dacl. err=%d, xrefs: 1000629A
DuplicateTokenEx, xrefs: 100061D2
AIL:GAT:Can't allocate pSD, xrefs: 1000622B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$FileFreeGlobal$HandleRead$AddressAllocCloseCreateH_prolog3LibraryModulePointerProc__wcsnicmp
String ID: AIL:GAT:Can't Set SD Dacl. err=%d$AIL:GAT:Can't allocate pSD$AIL:GAT:Can't duplicate token. err=%d$AIL:GAT:Can't initialize SD. err=%d$AIL:GAT:Get addr err$AIL:GAT:Load err=%d$AIL:GAT:hMinToken=NULL$AIL:GATI:CurSessionId=%d$AIL:GATI:DupT=%x$AIL:GATI:GetKernelModuleHandle err=%d$AIL:GATI:MinT=%x$AIL:GATI:ProcessIdToSessionId err=%d$AIL:GATI:ProcessIdToSessionId not found=%d$DuplicateTokenEx$InitializeSecurityDescriptor$Kernel32.dll$ProcessIdToSessionId$SetSecurityDescriptorDacl$advapi32.dll
API String ID: 3526683403-1348534442
Opcode ID: 068ca483d9c24eb9dcc89961da6940ec16839025114f803bdebbaea1f2bc0b78
Instruction ID: 9df993b49fa5c1904c098df201cbb6853c40c725bd1672f6b1488a7481553982
Opcode Fuzzy Hash: 068ca483d9c24eb9dcc89961da6940ec16839025114f803bdebbaea1f2bc0b78
Instruction Fuzzy Hash: 3A818271904219ABEF15DBB0CD89FEEB6BAFF08380F204125F511B6195DB385A81DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10015E40 Relevance: 54.5, APIs: 13, Strings: 18, Instructions: 236COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10015E5F
AhnIEx_IsWinNTOrLater3.AHNIEX(0000000A,00000000,0000585D,00000024), ref: 10015E71

Part of subcall function 10017BCD: AhnIEx_GetOS2.AHNIEX(00000000,00000024,?,?,10015E76,0000000A,00000000,0000585D,00000024), ref: 10017BD7

Part of subcall function 1000A1C0: GetLastError.KERNEL32(?,?,?,?,80004005,?,?), ref: 1000A234
Part of subcall function 1000A1C0: SetLastError.KERNEL32(00000000,?,?,?,80004005,?,?), ref: 1000A247

GetLastError.KERNEL32(wintrust.dll,?,?,?,?,?,00000024), ref: 10016110

Part of subcall function 1000A260: GetProcAddress.KERNEL32(?,101728B8), ref: 1000A267

GetLastError.KERNEL32(?,?,?,?,?,00000024), ref: 10015F7A
_memset.LIBCMT ref: 10015FA1
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000024), ref: 10015FA9
_memset.LIBCMT ref: 10015FE5
GetModuleFileNameW.KERNEL32(?,00000104), ref: 10015FFB
_wcsrchr.LIBCMT ref: 1001600A
GetLastError.KERNEL32 ref: 1001605A
GetLastError.KERNEL32(CryptCATAdminRemoveCatalog,CryptCATAdminReleaseContext,CryptCATAdminReleaseCatalogContext,CryptCATAdminAddCatalog,CryptCATAdminAcquireContext,wintrust.dll,?,?,?,?,?,00000024), ref: 100160E8

Strings

\NSIS.cat, xrefs: 10016021
AIL:SetCatalog CryptCATAdminAddCatalog %s ok, xrefs: 1001606F
AIL:SetCatalog GetModuleFileName %s err=%d, xrefs: 10016098
AIL:SetCatalog CryptCATAdminAddCatalog err=%d, xrefs: 10016061
AIL:SetCatalog CryptCATAdminRemoveCatalog %s ok, xrefs: 100160D0
Catalog file=%s, xrefs: 10016033
AIL:SetCatalog bInstallMode=%d, xrefs: 10015E87
AIL:SetCatalog CryptCATAdminRemoveCatalog err=%d, xrefs: 100160C2
CryptCATAdminReleaseCatalogContext, xrefs: 10015ED2
AIL:SetCatalog LoadSystem err=%d, xrefs: 10016117
NSIS_%u.cat, xrefs: 10015FB0
CryptCATAdminReleaseContext, xrefs: 10015EE2
CryptCATAdminAddCatalog, xrefs: 10015EC3
wintrust.dll, xrefs: 10015E9E
AIL:SetCatalog Getproc err=%d, xrefs: 100160F1
AIL:SetCatalog CryptCATAdminAcquireContext err=%d, xrefs: 10015F81
CryptCATAdminRemoveCatalog, xrefs: 10015EF2
CryptCATAdminAcquireContext, xrefs: 10015EB6

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$_memset$AddressCurrentFileH_prolog3Later3ModuleNameProcProcess_wcsrchr
String ID: AIL:SetCatalog CryptCATAdminAcquireContext err=%d$AIL:SetCatalog CryptCATAdminAddCatalog %s ok$AIL:SetCatalog CryptCATAdminAddCatalog err=%d$AIL:SetCatalog CryptCATAdminRemoveCatalog %s ok$AIL:SetCatalog CryptCATAdminRemoveCatalog err=%d$AIL:SetCatalog GetModuleFileName %s err=%d$AIL:SetCatalog Getproc err=%d$AIL:SetCatalog LoadSystem err=%d$AIL:SetCatalog bInstallMode=%d$Catalog file=%s$CryptCATAdminAcquireContext$CryptCATAdminAddCatalog$CryptCATAdminReleaseCatalogContext$CryptCATAdminReleaseContext$CryptCATAdminRemoveCatalog$NSIS_%u.cat$\NSIS.cat$wintrust.dll
API String ID: 3449552472-2804136651
Opcode ID: 49c6ca765933e3fa2f676bd0f3438b62c901cae327d6104effbeb9f4efcbaf6c
Instruction ID: be2a7bfe721eff42f44a17be4b315123022fcbaa2302a124f1b9de4332fa53ed
Opcode Fuzzy Hash: 49c6ca765933e3fa2f676bd0f3438b62c901cae327d6104effbeb9f4efcbaf6c
Instruction Fuzzy Hash: 0481F571D0025DAFDB11DFB4DC85DEE77B8EF18240F508229F915AA192EB349A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10017355 Relevance: 54.4, APIs: 23, Strings: 8, Instructions: 188pipeprocessCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,?), ref: 10017395
GetLastError.KERNEL32 ref: 1001739F
CreatePipe.KERNEL32(10177900,?,?,00000000,?,?,?), ref: 100173FF
GetLastError.KERNEL32 ref: 10017405
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:CreatePipe err=%d,00000000), ref: 10017417
CreatePipe.KERNEL32(?,10177904,?,00000000), ref: 10017434
GetLastError.KERNEL32 ref: 1001743A
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:CreatePipe err=%d,00000000), ref: 1001744C
CloseHandle.KERNEL32 ref: 10017460
CloseHandle.KERNEL32 ref: 10017465
_memset.LIBCMT ref: 1001747B
AhnIEx_IsWow64Process.AHNIEX ref: 100174A6
AhnIEx_IsProcessorIA64.AHNIEX ref: 100174AF
AhnIEx_IsProcessorARM64.AHNIEX ref: 100174BF

Part of subcall function 10017DED: GetModuleHandleW.KERNEL32(Kernel32.DLL,?,00000000,00000000,?,1000D5F3), ref: 10017DF8
Part of subcall function 10017DED: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017E08
Part of subcall function 10017DED: GetCurrentProcess.KERNEL32(?,?,?,00000000,00000000,?,1000D5F3), ref: 10017E1C

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,?,?,?), ref: 10017505
GetLastError.KERNEL32 ref: 1001750F
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:CreateProcess(%s) err=%d,?,00000000), ref: 10017525
CloseHandle.KERNEL32 ref: 10017539
CloseHandle.KERNEL32(?), ref: 1001753E
CloseHandle.KERNEL32(?), ref: 10017543
CloseHandle.KERNEL32(?), ref: 10017559
CloseHandle.KERNEL32(?), ref: 1001755E
CloseHandle.KERNEL32(?), ref: 10017563

Strings

"%PluginDir%\SysX64.exe", xrefs: 100174D2
AIL:System64:GetExitCode err=%d, xrefs: 100173A2
AIL:System64:System64 is terminated. (ExitCode=%d) System64 will be created again., xrefs: 100173B9
AIL:System64:CreateProcess(%s) err=%d, xrefs: 10017518
"%PluginDir%\SysARM64.exe", xrefs: 100174CB
"%PluginDir%\Sys32.exe", xrefs: 100174D9
"%PluginDir%\SysIA64.exe", xrefs: 100174B8
AIL:System64:CreatePipe err=%d, xrefs: 1001740A, 1001743F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Handle$Close$Error$LastProcess$Create$PipeProcessor$AddressCodeCurrentExitModuleProcWow64_memset
String ID: "%PluginDir%\Sys32.exe"$"%PluginDir%\SysARM64.exe"$"%PluginDir%\SysIA64.exe"$"%PluginDir%\SysX64.exe"$AIL:System64:CreatePipe err=%d$AIL:System64:CreateProcess(%s) err=%d$AIL:System64:GetExitCode err=%d$AIL:System64:System64 is terminated. (ExitCode=%d) System64 will be created again.
API String ID: 4152661594-140020490
Opcode ID: ba696a351fcd6e21e92afe6f5f63145a3b64ec7b65c74fe26102c535fb865fd8
Instruction ID: 59e545ae46e372606258d4f8084c69604f17fefa2c49942ade41e1c615784149
Opcode Fuzzy Hash: ba696a351fcd6e21e92afe6f5f63145a3b64ec7b65c74fe26102c535fb865fd8
Instruction Fuzzy Hash: C5515D71D0112DABDB12DBA4CC81AEEBFB9FF08354F104525F918F6111D778AA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10015B47 Relevance: 51.0, APIs: 20, Strings: 9, Instructions: 263memorylibrarystringCOMMON

Download Yara Rule

APIs

Part of subcall function 10015912: GetFileSecurityW.ADVAPI32(00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,10015B91,?,00000004,?,?,00000000), ref: 10015930
Part of subcall function 10015912: GetLastError.KERNEL32(?,10015B91,?,00000004,?,?,00000000,?), ref: 10015938

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,?,00000000,?), ref: 10015BB1
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 10015BDB
GetLastError.KERNEL32 ref: 10015BFA
GetModuleHandleW.KERNEL32(Advapi32,ConvertSidToStringSidW), ref: 10015C2D
GetProcAddress.KERNEL32(00000000), ref: 10015C34
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10015C6A
GetAce.ADVAPI32(?,?,100095A1), ref: 10015C86
EqualSid.ADVAPI32(?,10009599), ref: 10015CE8
lstrcmpW.KERNEL32(?,S-1-15-2-1), ref: 10015D17
LocalFree.KERNEL32(?), ref: 10015D2C
GetLastError.KERNEL32 ref: 10015D52
GetLastError.KERNEL32 ref: 10015D62
DeleteAce.ADVAPI32(?,000000FF), ref: 10015D8A
GetLastError.KERNEL32 ref: 10015D93
GetLastError.KERNEL32 ref: 10015DCD
GetLastError.KERNEL32(?,00000000,?), ref: 10015DE7
GetProcessHeap.KERNEL32(00000000,?), ref: 10015DF4
HeapFree.KERNEL32(00000000), ref: 10015DFB
FreeSid.ADVAPI32(?), ref: 10015E09
SetLastError.KERNEL32(00000000), ref: 10015E10

Strings

AIL:CARTD(%s) err=%d, xrefs: 10015E1F
AIFP, xrefs: 10015C03, 10015D5B
AIL:CARTD:%s(%s)=%d, %d, xrefs: 10015C08, 10015D6E, 10015D99, 10015DA6, 10015DDB
S-1-15-2-1, xrefs: 10015D0F
Advapi32, xrefs: 10015C28
ConvertSidToStringSidW, xrefs: 10015C23
AIL:CARTD(%s), xrefs: 10015C12
SFS, xrefs: 10015DD6
AIL:CARTD:ACE(%s, %x, %x), xrefs: 10015CD0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Free$HeapSecurity$AddressAllocateDaclDeleteDescriptorEqualFileHandleInformationInitializeLocalModuleProcProcesslstrcmp
String ID: AIFP$AIL:CARTD(%s)$AIL:CARTD(%s) err=%d$AIL:CARTD:%s(%s)=%d, %d$AIL:CARTD:ACE(%s, %x, %x)$Advapi32$ConvertSidToStringSidW$S-1-15-2-1$SFS
API String ID: 1063421702-690247324
Opcode ID: afe9233bd2e8241cb8b699a9c98d0a723e53103881c97c732409e996637f08fc
Instruction ID: 188aca1618741f99bd0b26b38aa5d81a133eb2d429984e1c5177af3100691d83
Opcode Fuzzy Hash: afe9233bd2e8241cb8b699a9c98d0a723e53103881c97c732409e996637f08fc
Instruction Fuzzy Hash: FCA126B1D00259EFDF11DFA4DC899EEBBBAFB08241F54412AF510BA251D7368A90CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001030C Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 251windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 10010356
GetDlgItem.USER32(00000000,000003E8), ref: 1001037D
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 100103F4
SendMessageW.USER32(00000000,00000449,00000001,?), ref: 10010402

Strings

ExeDir, xrefs: 1001043A, 100104B7
CreateFile(%s) err = %d, xrefs: 1001048B, 100105F0
GetFileSize() err=%d, xrefs: 100105CB
AIL:OnShowLicense, xrefs: 10010335
%s\_Setup\%s_%s.txt, xrefs: 10010446, 100104C3
TRUE, xrefs: 10010390, 100103B1, 100103BB
FileSize=%d, xrefs: 1001051F
#32770, xrefs: 1001034F
LicenseFile=%s, xrefs: 100104FA
StrSize=%d, xrefs: 100103D7
out of memory, xrefs: 100105B4
ReadFile() err=%d, xrefs: 1001059D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: MessageSend$FindFreeGlobalItemWindow
String ID: #32770$%s\_Setup\%s_%s.txt$AIL:OnShowLicense$CreateFile(%s) err = %d$ExeDir$FileSize=%d$GetFileSize() err=%d$LicenseFile=%s$ReadFile() err=%d$StrSize=%d$TRUE$out of memory
API String ID: 1034496673-1920173382
Opcode ID: 1db4c4b2e4e5624aba56e1c31c9f2182510399bb0c3e54d81cd77a2d51a51778
Instruction ID: 664edd06ef6087c97139a3692c88de36615ca4ddfdcde337bb816583109700f4
Opcode Fuzzy Hash: 1db4c4b2e4e5624aba56e1c31c9f2182510399bb0c3e54d81cd77a2d51a51778
Instruction Fuzzy Hash: 2E81B8B5A40218BFDB14DBB08C85EDF7BBCFB08750F104116F915AB581EBB59A809BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000D7F2 Relevance: 50.8, APIs: 15, Strings: 14, Instructions: 95stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,HKCR,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D804
lstrcmpW.KERNEL32(?,HKEY_CLASSES_ROOT,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D814
lstrcmpW.KERNEL32(?,HKLM,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D824
lstrcmpW.KERNEL32(?,HKEY_LOCAL_MACHINE,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D834
lstrcmpW.KERNEL32(?,HKCU,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D844
lstrcmpW.KERNEL32(?,HKEY_CURRENT_USER,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D854
lstrcmpW.KERNEL32(?,HKU,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D864
lstrcmpW.KERNEL32(?,HKEY_USERS,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D870
lstrcmpW.KERNEL32(?,HKCC,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D87C
lstrcmpW.KERNEL32(?,HKEY_CURRENT_CONFIG,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D888
lstrcmpW.KERNEL32(?,HKDD,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D894
lstrcmpW.KERNEL32(?,HKEY_DYN_DATA,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D8A0
lstrcmpW.KERNEL32(?,HKPD,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D8AC
lstrcmpW.KERNEL32(?,HKEY_PERFORMANCE_DATA,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D8B8
AhnIEx_SetError.AHNIEX(32810101,?,?,1000D980,TRUE,?,?,false,?,00000004), ref: 1000D8C3

Strings

HKCR, xrefs: 1000D7FE
HKLM, xrefs: 1000D81E
HKEY_CLASSES_ROOT, xrefs: 1000D80E
HKCU, xrefs: 1000D83E
HKEY_PERFORMANCE_DATA, xrefs: 1000D8B2
HKEY_LOCAL_MACHINE, xrefs: 1000D82E
HKEY_CURRENT_CONFIG, xrefs: 1000D882
HKEY_CURRENT_USER, xrefs: 1000D84E
HKCC, xrefs: 1000D876
HKU, xrefs: 1000D85E
HKDD, xrefs: 1000D88E
HKEY_USERS, xrefs: 1000D86A
HKEY_DYN_DATA, xrefs: 1000D89A
HKPD, xrefs: 1000D8A6

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: lstrcmp$Error
String ID: HKCC$HKCR$HKCU$HKDD$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_DYN_DATA$HKEY_LOCAL_MACHINE$HKEY_PERFORMANCE_DATA$HKEY_USERS$HKLM$HKPD$HKU
API String ID: 1892022687-3824114226
Opcode ID: a65ea81d579bb251ee7f0c487c1012437a726d714f2b725cccf12d091fc68719
Instruction ID: 3e8b29fa84772eb6091754e8accc776b90f54971b5c9ce30d17f4da74d624810
Opcode Fuzzy Hash: a65ea81d579bb251ee7f0c487c1012437a726d714f2b725cccf12d091fc68719
Instruction Fuzzy Hash: A8219E20B4522BA1B645B2750D90F7F19EDCF41AC0B12803BBC00E919CDF3CD8826BB6

Uniqueness

Uniqueness Score: -1.00%

Function 10007B12 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 283sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1001672D: _wcsrchr.LIBCMT ref: 10016739

GetShortPathNameW.KERNEL32(?,?,00000104), ref: 10007B65
GetLastError.KERNEL32(?,?,?,77134670), ref: 10007BC0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,77134670), ref: 10007BF0
GetLastError.KERNEL32(?,?,?,77134670), ref: 10007C00
GetLastError.KERNEL32(?,?,?,77134670), ref: 10007C07
GetLastError.KERNEL32(?,?,?,77134670), ref: 10007C0E
RemoveDirectoryW.KERNEL32(?,?,00000104,00000000,?,?,?,77134670), ref: 10007C53
GetLastError.KERNEL32(?,00000104,00000000,?,?,?,77134670), ref: 10007CE9
GetLastError.KERNEL32(?,00000104,00000000,?,?,?,77134670), ref: 10007CF4
Sleep.KERNEL32(000001F4,?,00000104,00000000,?,?,?,77134670), ref: 10007D04
RemoveDirectoryW.KERNEL32(?,?,00000104,00000000,?,?,?,77134670), ref: 10007D17
GetLastError.KERNEL32(?,00000104,00000000,?,?,?,77134670), ref: 10007D5A
AhnIEx_IsWinNT.AHNIEX(?,00000104,00000000,?,?,?,77134670), ref: 10007D91
SetLastError.KERNEL32(00000000,?,?,?,?,?,00000104,00000000,?,?,?,77134670), ref: 10007E86

Strings

AIL:DecrementSharedCount(%s), xrefs: 10007BA7
AIL:Delete(%s)=%d -> DeleteOnReboot, xrefs: 10007E06
AIL:Delete(%s) err=%d, xrefs: 10007E30
AIL:Delete(%s)=ok, xrefs: 10007E6D
AIL:Delete(%s)=isnotEmpty(%d), xrefs: 10007DA2
AIL:DecrementSharedCount(%s) err %d, xrefs: 10007BCE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$DirectoryRemove$AttributesFileNamePathShortSleep_wcsrchr
String ID: AIL:DecrementSharedCount(%s)$AIL:DecrementSharedCount(%s) err %d$AIL:Delete(%s) err=%d$AIL:Delete(%s)=%d -> DeleteOnReboot$AIL:Delete(%s)=isnotEmpty(%d)$AIL:Delete(%s)=ok
API String ID: 1788316415-1120632267
Opcode ID: eb0f01f05c2cfcdfa064b35b2e4fdcac3c8a3fb844e9744aa6e52b39c6a07edb
Instruction ID: 34f29f1b8748c68cff7b0a82e2a585e53370253597d685057a112a1e3ca5c568
Opcode Fuzzy Hash: eb0f01f05c2cfcdfa064b35b2e4fdcac3c8a3fb844e9744aa6e52b39c6a07edb
Instruction Fuzzy Hash: DB918D72D012999BFB21DBA0CD85BEE77ECFF04380F114466ED09DA199E7389A848761

Uniqueness

Uniqueness Score: -1.00%

Function 100143A2 Relevance: 44.0, APIs: 10, Strings: 15, Instructions: 290fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 100143D0
SetFileAttributesW.KERNEL32(?,00000080), ref: 1001443C
CopyFileW.KERNEL32(?,?,00000000), ref: 10014451
GetLastError.KERNEL32 ref: 1001445A
CopyFileW.KERNEL32(00000000,?,00000000), ref: 10014566
GetLastError.KERNEL32 ref: 1001456C
CopyFileW.KERNEL32(00000000,?,00000000), ref: 100145D4
GetLastError.KERNEL32 ref: 100145DA
SetFileAttributesW.KERNEL32(?,00000080), ref: 10014613
GetCurrentProcessId.KERNEL32 ref: 100143E4

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

Strings

AIL:CopySecClone(%s)=%d, xrefs: 1001457A, 100145E8
AhnUn0%02d.dat, xrefs: 10014485
"%s" -UC %s, xrefs: 100146CF
AIL:CopyClone(%s)=%d, xrefs: 10014468
-Uninstall, xrefs: 1001466E
ppid, xrefs: 100144DE
/Uninstall, xrefs: 1001465D
AIL:CopyUnSecClone:(%s, szPID)=%llu, xrefs: 10014503
TempDir, xrefs: 100143D6
AhnUn0%02d.tmp, xrefs: 10014409
"%s" -UC, xrefs: 100146EE
IniFile, xrefs: 10014599
AIL:DeleteOnReboot=%s, xrefs: 10014620
SecFile, xrefs: 1001452B
CmdLine, xrefs: 1001463B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: File$CopyErrorLast$Attributes$CurrentModuleNameProcess_vswprintf_s
String ID: "%s" -UC$"%s" -UC %s$-Uninstall$/Uninstall$AIL:CopyClone(%s)=%d$AIL:CopySecClone(%s)=%d$AIL:CopyUnSecClone:(%s, szPID)=%llu$AIL:DeleteOnReboot=%s$AhnUn0%02d.dat$AhnUn0%02d.tmp$CmdLine$IniFile$SecFile$TempDir$ppid
API String ID: 362969930-898411901
Opcode ID: ec489469aae5b842edcaad0a364faa2833194b6041fdc74fa1881af7aca38fdb
Instruction ID: a53cbcedcf8308fc76ed8b5dfe53d9cbcd8a90ff493aa1262bc975b2c68973dd
Opcode Fuzzy Hash: ec489469aae5b842edcaad0a364faa2833194b6041fdc74fa1881af7aca38fdb
Instruction Fuzzy Hash: DA9178B69001496FEF61EBB0CC85FEE33ADEF05244F55052AF9099A052EF35E6848B61

Uniqueness

Uniqueness Score: -1.00%

Function 10005DD8 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 224memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10005D0B: _memset.LIBCMT ref: 10005D37
Part of subcall function 10005D0B: _memset.LIBCMT ref: 10005D5E

_malloc.LIBCMT ref: 10005E1E
OpenProcess.KERNEL32(001FFFFF,00000000,00000000,?,00000000,00000000,00000068,10002B52,?,?,?,00000104,?,?,00000400,?), ref: 10005E6B
GetLastError.KERNEL32 ref: 10005E78
OpenProcessToken.ADVAPI32(00000000,0000000F,00000004), ref: 10005E9F
GetLastError.KERNEL32 ref: 10005EA8
CloseHandle.KERNEL32(?), ref: 10005EB4
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),00000008,00000004,?), ref: 10005EDF
GetLastError.KERNEL32 ref: 10005EE9
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 10005F11
_malloc.LIBCMT ref: 10005F1A
CloseHandle.KERNEL32(?), ref: 10005F3B
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 10005F5D
GetLastError.KERNEL32 ref: 10005F67

Part of subcall function 100FB7DB: __lock.LIBCMT ref: 100FB7F9
Part of subcall function 100FB7DB: ___sbh_find_block.LIBCMT ref: 100FB804
Part of subcall function 100FB7DB: ___sbh_free_block.LIBCMT ref: 100FB813
Part of subcall function 100FB7DB: HeapFree.KERNEL32(00000000,?,1016B308,0000000C,10105A72,00000000,1016B8C0,0000000C,10105AAC,?,100FAE08,?,1010B1F2,00000004,1016BA20,0000000C), ref: 100FB843
Part of subcall function 100FB7DB: GetLastError.KERNEL32(?,1010B1F2,00000004,1016BA20,0000000C,1010569C,?,100FAE17,00000000,00000000,00000000,?,1010501D,00000001,00000214), ref: 100FB854

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10005FBA
EqualSid.ADVAPI32(?,00000000), ref: 10005FDD
FreeSid.ADVAPI32(?), ref: 10006002

Strings

AIL:GATI:Can't get token(%d) session id. err=%d, xrefs: 10005EF2
AIL:GATI:Id=%d, IsA=%d, T=%x, xrefs: 10006029
AIL:GATI:Can't open process(%d). err=%d, xrefs: 10005E81
AIL:GATI:process not found, xrefs: 10005E06
AIL:GATI:Can't get token(%d) group Information. err=%d, xrefs: 10005F70
AIL:GATI:out of memory, xrefs: 10005E2A
AIL:GATI:Can't open process(%d) token. err=%d, xrefs: 10005EC5
AIL:GATI:Can't allocate group info., xrefs: 10005F27

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Token$Information$CloseFreeHandleOpenProcess_malloc_memset$AllocateEqualHeapInitialize___sbh_find_block___sbh_free_block__lock
String ID: AIL:GATI:Can't allocate group info.$AIL:GATI:Can't get token(%d) group Information. err=%d$AIL:GATI:Can't get token(%d) session id. err=%d$AIL:GATI:Can't open process(%d) token. err=%d$AIL:GATI:Can't open process(%d). err=%d$AIL:GATI:Id=%d, IsA=%d, T=%x$AIL:GATI:out of memory$AIL:GATI:process not found
API String ID: 3807690529-2577287940
Opcode ID: 1b742c62f2637303afb195bc35016f46e8a18f2190ea6becda22f3ef301f5a7d
Instruction ID: 16c9d925a54ef85128a16314ab34c79784544e3da4e990027c7e41e5eeaa0691
Opcode Fuzzy Hash: 1b742c62f2637303afb195bc35016f46e8a18f2190ea6becda22f3ef301f5a7d
Instruction Fuzzy Hash: 9E818E71A0020AEFEB15DFA8CC85FAEBBF5FF08345F108029F505AA295D775A940DB61

Uniqueness

Uniqueness Score: -1.00%

Function 10013CE8 Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 191libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10013D07
AhnIEx_IsWinNTOrLater2.AHNIEX(00000006,00000000,00000000,00000024), ref: 10013D20

Part of subcall function 10017B98: AhnIEx_GetOS2.AHNIEX(00000024,00000000,?,?,10013D25,00000006,00000000,00000000,00000024), ref: 10017BA2

OpenProcess.KERNEL32(00001000,00000000,?,?,?,00000024), ref: 10013D3C
GetModuleHandleW.KERNEL32(kernel32,QueryFullProcessImageNameW,?,?,00000024), ref: 10013D56
GetProcAddress.KERNEL32(00000000), ref: 10013D5D
GetLastError.KERNEL32(?,?,00000024), ref: 10013D84

Part of subcall function 100092F0: GetModuleHandleW.KERNEL32(ntdll,00000000,00000000,00000000), ref: 10009352
Part of subcall function 100092F0: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 1000936E
Part of subcall function 100092F0: GetProcAddress.KERNEL32(00000000,NtOpenSymbolicLinkObject), ref: 10009379
Part of subcall function 100092F0: GetProcAddress.KERNEL32(00000000,NtQuerySymbolicLinkObject), ref: 10009384
Part of subcall function 100092F0: QueryDosDeviceW.KERNEL32(?,?,00000104), ref: 10009479
Part of subcall function 100092F0: _wcslen.LIBCMT ref: 10009487

Part of subcall function 1000A260: GetProcAddress.KERNEL32(?,101728B8), ref: 1000A267

CloseHandle.KERNEL32(00000000,?,?,00000024), ref: 10013DA1
AhnIEx_IsWinNTOrLater2.AHNIEX(00000005,00000001,00000000,?,?,00000024), ref: 10013DE4
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,?,00000024), ref: 10013E00
GetLastError.KERNEL32(psapi,?,?,?,?,?,00000024), ref: 10013E2C
GetLastError.KERNEL32(?,00000104,GetProcessImageFileNameW,psapi,?,?,?,?,?,00000024), ref: 10013E6B
OpenProcess.KERNEL32(00000410,00000000,?,?,?,?,?,?,00000024), ref: 10013EAB
GetLastError.KERNEL32(psapi,?,?,?,?,?,00000024), ref: 10013EDB
GetLastError.KERNEL32(?,?,?,?,?,00000024), ref: 10013F1E
GetLastError.KERNEL32(?,?,?,?,?,00000024), ref: 10013F4B

Strings

kernel32, xrefs: 10013D51
AIL:GetProcessImageFileName:Load err=%d, xrefs: 10013E33, 10013EE2
AIL:GetProcessImageFileName:GetProc err, xrefs: 10013DAC
GetProcessImageFileNameW, xrefs: 10013E41
AIL:GetProcessImageFileName:OpenProcess(%u) err=%d, xrefs: 10013F58
psapi, xrefs: 10013E18, 10013EC3
AIL:GetProcessImageFileName(%u) err=%d, xrefs: 10013D91, 10013E78, 10013F2B
GetModuleFileNameExW, xrefs: 10013EF3
QueryFullProcessImageNameW, xrefs: 10013D4C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressProc$HandleOpenProcess$Later2Module$CloseDeviceH_prolog3Query_wcslen
String ID: AIL:GetProcessImageFileName(%u) err=%d$AIL:GetProcessImageFileName:GetProc err$AIL:GetProcessImageFileName:Load err=%d$AIL:GetProcessImageFileName:OpenProcess(%u) err=%d$GetModuleFileNameExW$GetProcessImageFileNameW$QueryFullProcessImageNameW$kernel32$psapi
API String ID: 2313736160-2599342747
Opcode ID: d69d385099aef35aaf6c4ec3ea6aaa89a9cadcb4eaec3a6446817bbb30a49515
Instruction ID: dbc4c1e3ef00fe3e4f6e68348deed37a91f19e175b0ccbe4d7289faa16cc68b2
Opcode Fuzzy Hash: d69d385099aef35aaf6c4ec3ea6aaa89a9cadcb4eaec3a6446817bbb30a49515
Instruction Fuzzy Hash: 3A510875A40218AFDB14EBB0DD8AEEE77B8FF68740F108128F906AE1C1EB755981C751

Uniqueness

Uniqueness Score: -1.00%

Function 1000BEE7 Relevance: 42.1, APIs: 2, Strings: 22, Instructions: 149timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000BF2F

Part of subcall function 1000A6FD: _memset.LIBCMT ref: 1000A73A

GetLocalTime.KERNEL32(?), ref: 1000C037

Strings

RegDepartment, xrefs: 1000BFDE
ExeDir, xrefs: 1000BF8B
DisplayIcon, xrefs: 1000BFF1
DisplayName, xrefs: 1000BF57
InstallSource, xrefs: 1000BF93
UserName, xrefs: 1000BF9F
NoRepair, xrefs: 1000C025
NoModify, xrefs: 1000C015
InstDir, xrefs: 1000BF63
UserDepartment, xrefs: 1000BFD6
UninstallString, xrefs: 1000C080
RegOwner, xrefs: 1000BFA7
UserOrganization, xrefs: 1000BFB3
InstallDate, xrefs: 1000C066
%d%02d%02d, xrefs: 1000C04C
RegCompany, xrefs: 1000BFBB
BuildNumber, xrefs: 1000BFFD
DisplayVersion, xrefs: 1000C005
ProductName, xrefs: 1000BF4F
Publisher, xrefs: 1000BF77, 1000BF7C, 1000BF7D
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 1000BF14
InstallLocation, xrefs: 1000BF6B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset$LocalTime
String ID: %d%02d%02d$BuildNumber$DisplayIcon$DisplayName$DisplayVersion$ExeDir$InstDir$InstallDate$InstallLocation$InstallSource$NoModify$NoRepair$ProductName$Publisher$RegCompany$RegDepartment$RegOwner$Software\Microsoft\Windows\CurrentVersion\Uninstall\$UninstallString$UserDepartment$UserName$UserOrganization
API String ID: 2060895748-1478507252
Opcode ID: d2c0c1c2db0100c0196828f10452781cfbf8e0f2181208fec1c397c90a569d5e
Instruction ID: 2196cea0581bb299c436887ccc2a1bce0de63d0bfc3e2243a6d83310c882167a
Opcode Fuzzy Hash: d2c0c1c2db0100c0196828f10452781cfbf8e0f2181208fec1c397c90a569d5e
Instruction Fuzzy Hash: 44414CB690021CBAEB24DBF59C49EEF7BBCEB05244F004535B909EB042EB79A5C5C764

Uniqueness

Uniqueness Score: -1.00%

Function 10008273 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 253stringCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,00000104,?), ref: 10008311
GetLastError.KERNEL32(?,?,?,00000104,?), ref: 10008320
_malloc.LIBCMT ref: 1000834F
GetFileVersionInfoW.VERSION(?,?,?,00000000,?,?,?,00000104,?), ref: 1000838E
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,00000000,?,?,?,00000104,?), ref: 100083AF
VerQueryValueW.VERSION(00000000,?,?,?,?,?,?,00000000,?,?,?,00000104,?), ref: 100083F6
VerQueryValueW.VERSION(00000000,?,?,?,?,00000000,?,?,?,00000104,?), ref: 1000843A
VerQueryValueW.VERSION(00000000,?,?,?,00000000,?,?,?,?,00000000,?,?,?,00000104,?), ref: 1000847A
VerQueryValueW.VERSION(00000000,1011AC94,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000,?,?), ref: 100084C3
lstrcmpiW.KERNEL32(?,?,00000000,1011AC94,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 100084E5

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

lstrcmpiW.KERNEL32(?,?), ref: 10008505
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00000104,?), ref: 10008547

Strings

\VarFileInfo\Translation, xrefs: 100083A9
AIL:GetFileVersionInfo(%s) err=%d, xrefs: 10008574
\StringFileInfo\040904e4\%s, xrefs: 10008454
%d.%d.%d.%d, xrefs: 1000851F
\StringFileInfo\%04hX%04hX\%s, xrefs: 100083D0
AIL:GetFileVersionInfo(%s) malloc err=%d, xrefs: 1000836A
ProductVersion, xrefs: 100082E9
\StringFileInfo\040904b0\%s, xrefs: 10008414
AIL:GetFileVersionInfoSize(%s) err=%d, xrefs: 10008338
FileVersion, xrefs: 100082DC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: QueryValue$ErrorFileInfoLastVersionlstrcmpi$Size_malloc_vswprintf_s
String ID: %d.%d.%d.%d$AIL:GetFileVersionInfo(%s) err=%d$AIL:GetFileVersionInfo(%s) malloc err=%d$AIL:GetFileVersionInfoSize(%s) err=%d$FileVersion$ProductVersion$\StringFileInfo\%04hX%04hX\%s$\StringFileInfo\040904b0\%s$\StringFileInfo\040904e4\%s$\VarFileInfo\Translation
API String ID: 2998653597-1632516867
Opcode ID: 6f6d1d56406995b42b4be5df6e0f8b0b5224162b30bdb934590a760b6e570675
Instruction ID: 7d812860c203f1e993439da119dcceb98e75a69867a0ffbcd9dcb1fa8f745a0a
Opcode Fuzzy Hash: 6f6d1d56406995b42b4be5df6e0f8b0b5224162b30bdb934590a760b6e570675
Instruction Fuzzy Hash: A791847280462CAAEF21DBA48D45EEA73FCFF44781F100196F988E6144E7359F84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100045AB Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 171registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100045CA
RegisterWindowMessageW.USER32(_WM_AIL_Detail_Print,AIL::CreateChildSetup,0000003C), ref: 10004615
GetLastError.KERNEL32 ref: 10004620

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

Part of subcall function 100133BF: _memset.LIBCMT ref: 100133F4
Part of subcall function 100133BF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,?,?), ref: 1001342C
Part of subcall function 100133BF: GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10013436

RegisterWindowMessageW.USER32(_WM_AIL_Command,AIL::CreateChildSetup,0000003C), ref: 1000468A
GetLastError.KERNEL32 ref: 10004695
GetClassInfoExW.USER32(ChildSetupCtrl,?,AIL::CreateChildSetup), ref: 100046B3
RegisterClassExW.USER32(?), ref: 100046F6
GetLastError.KERNEL32 ref: 10004701
CreateWindowExW.USER32(00000000,ChildSetupCtrl,10117AB8,?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 10004737
GetLastError.KERNEL32 ref: 10004743
DestroyWindow.USER32(00000000), ref: 10004797
AhnIEx_SetReboot.AHNIEX ref: 100047DF
AhnIEx_SetError.AHNIEX(32810153), ref: 100047FB

Part of subcall function 10004595: AhnIEx_SetError.AHNIEX(32810153,100047AC), ref: 100045A1

Strings

AIL::CreateChildSetup, xrefs: 100045ED
Create window err=%d, xrefs: 1000474A
ChildSetupCtrl, xrefs: 100046A7, 100046AC, 10004735
Register _PB_SET_RANGE message err=%d, xrefs: 1000469C
_WM_AIL_Detail_Print, xrefs: 10004610
%s /ChildSetup=%d, xrefs: 10004768
Register class err=%d, xrefs: 10004708
Register _DETAIL_PRINT message err=%d, xrefs: 10004627
_WM_AIL_Command, xrefs: 10004685

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Error$Last$Window$Register$ClassCreateMessage$DestroyH_prolog3InfoProcessReboot_memset_vswprintf_s
String ID: %s /ChildSetup=%d$AIL::CreateChildSetup$ChildSetupCtrl$Create window err=%d$Register _DETAIL_PRINT message err=%d$Register _PB_SET_RANGE message err=%d$Register class err=%d$_WM_AIL_Command$_WM_AIL_Detail_Print
API String ID: 2979166346-3408368577
Opcode ID: c77c5914c2f0d0235b312d3d37e2952ae7d3793caa99b4eb91da66eb4b45d9ba
Instruction ID: 86994237ce31b440c02e354a10a8032c02db2dea4e226f36ff447ff1780cfce4
Opcode Fuzzy Hash: c77c5914c2f0d0235b312d3d37e2952ae7d3793caa99b4eb91da66eb4b45d9ba
Instruction Fuzzy Hash: BE61DFB0900258AFEB25DFA4CC84BDE7BF8FF48284F01811AF844AB258DB395981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 10013868 Relevance: 38.7, APIs: 15, Strings: 7, Instructions: 157servicewindowsleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD), ref: 10013872
OpenServiceW.ADVAPI32(00000000,?,00000024), ref: 1001388E
ControlService.ADVAPI32(00000000,00000001,?), ref: 100138C1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?), ref: 100138D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?), ref: 100138DE
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD), ref: 10013916
QueryServiceStatus.ADVAPI32(?,?), ref: 10013925
DispatchMessageW.USER32(?), ref: 1001393D
PeekMessageW.USER32(?,00000000,0000000F,0000000F,00000001), ref: 10013950
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?), ref: 10013988
CloseServiceHandle.ADVAPI32(?), ref: 100139B9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?), ref: 100139C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?), ref: 100139E3
CloseServiceHandle.ADVAPI32(?), ref: 100139FC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10002AAD,?,?,?), ref: 10013A06

Strings

AIL:StopService:Open Service(%s) err=%d, xrefs: 100139E9
AIL:StopService:Pending(%s, %d), xrefs: 10013970
AIL:StopService(%s)=ok, xrefs: 100139A6
AIL:StopService:Open SCM err=%d, xrefs: 10013A0F
AIL:StopService:Quert Status(%s) err=%d, xrefs: 10013992
AIL:StopService(%s) err=%d, xrefs: 100138E4
AIL:StopService:the %s does not exist, xrefs: 100139D2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$Service$CloseHandleMessageOpen$ControlDispatchManagerPeekQuerySleepStatus
String ID: AIL:StopService(%s) err=%d$AIL:StopService(%s)=ok$AIL:StopService:Open SCM err=%d$AIL:StopService:Open Service(%s) err=%d$AIL:StopService:Pending(%s, %d)$AIL:StopService:Quert Status(%s) err=%d$AIL:StopService:the %s does not exist
API String ID: 134338965-507582288
Opcode ID: c30972e5751e9fe7a63479747f0d10c39168243590abc77a1a59b1d3f8d63b17
Instruction ID: 147a5d1c4acf45c3830e70464487e0440c95847ea60a893ddcaf9305b2e4c2c6
Opcode Fuzzy Hash: c30972e5751e9fe7a63479747f0d10c39168243590abc77a1a59b1d3f8d63b17
Instruction Fuzzy Hash: 8F411B70A04351BBE214DB708C8AF5F7BBCFF86790F008518F9499D691E7B5D884C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 10014124 Relevance: 38.6, APIs: 10, Strings: 12, Instructions: 149fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10014143
GetTempPathW.KERNEL32(00000104,?,?,AIL:ExecWebLink,00000008), ref: 1001417F
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,?,AIL:ExecWebLink,00000008), ref: 100141BC
GetLastError.KERNEL32(?,?,?,?,?,AIL:ExecWebLink,00000008), ref: 100141C4
CloseHandle.KERNEL32(00000000,?,?,?,?,?,AIL:ExecWebLink,00000008), ref: 100141D3
FindExecutableW.SHELL32(?,?,?), ref: 100141EB
ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000001), ref: 10014221
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,AIL:ExecWebLink,00000008), ref: 1001425E
GetLastError.KERNEL32(?,AIL:ExecWebLink,00000008), ref: 10014266
ShellExecuteW.SHELL32(00000000,explorer,?,00000000,00000000,00000005), ref: 1001428E

Strings

Exec(explorer)=%d, xrefs: 100142AC
Exec(Open) err=%d, xrefs: 1001422F
FindExecutable err=%d, xrefs: 10014237
open, xrefs: 1001421B
AIL:ExecWebLink, xrefs: 1001414E
Atmphtm.html, xrefs: 1001418E
explorer, xrefs: 10014288
Get temp path err=%d, xrefs: 1001426D
URL=%s, xrefs: 1001415F
Create temp file err=%d, xrefs: 1001423F
Exec(explorer)=ok, xrefs: 1001429B
Browser=%s, xrefs: 100141FF

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorExecuteFileLastShell$CloseCreateDeleteExecutableFindH_prolog3HandlePathTemp
String ID: AIL:ExecWebLink$Atmphtm.html$Browser=%s$Create temp file err=%d$Exec(Open) err=%d$Exec(explorer)=%d$Exec(explorer)=ok$FindExecutable err=%d$Get temp path err=%d$URL=%s$explorer$open
API String ID: 246963507-675224911
Opcode ID: 539d35a701744619fc5851e53cb7cf13c5b8cf2a26cf13eadcab6c85173c0f24
Instruction ID: db3db5e8a8d2b130adbb35f951009b116ef245003e2a7b7d2995caa69903927f
Opcode Fuzzy Hash: 539d35a701744619fc5851e53cb7cf13c5b8cf2a26cf13eadcab6c85173c0f24
Instruction Fuzzy Hash: 6841A4B6500258AFD734DFB08D8AFDE37BCFB59210F014129FE059E291EB79AAC48651

Uniqueness

Uniqueness Score: -1.00%

Function 100113DE Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100113FD
_memset.LIBCMT ref: 10011442
GetWindowsDirectoryW.KERNEL32(00000000,00000208,?,?,00000044), ref: 10011453
PathAppendW.SHLWAPI(00000000,servicing\Packages,?,?,00000044), ref: 10011470
PathAppendW.SHLWAPI(00000000,?,?,?,00000044), ref: 10011484
PathFileExistsW.SHLWAPI(00000000,?,?,00000044), ref: 10011492
GetLastError.KERNEL32(?,?,00000044), ref: 10011538

Part of subcall function 1001B962: __EH_prolog3.LIBCMT ref: 1001B969

GetLastError.KERNEL32(00000000,?,?,00000044), ref: 1001150F

Part of subcall function 1001B71A: __EH_prolog3.LIBCMT ref: 1001B721

GetLastError.KERNEL32(package,00000000,?,?,00000044), ref: 100114FB
GetLastError.KERNEL32(?,?,00000044), ref: 1001154D
GetLastError.KERNEL32(?,?,00000044), ref: 10011561
GetLastError.KERNEL32(?,?,00000044), ref: 10011575

Strings

package, xrefs: 100114BB
servicing\Packages, xrefs: 10011467
AIL::GetKBPatchNumFromMumFile PathAppend(SERVICING_PACKAGES) return FALSE (%s, %u), xrefs: 1001156E
AIL::GetKBPatchNumFromMumFile PathFileExists(%s) return FALSE (%u), xrefs: 10011545
AIL::GetKBPatchNumFromMumFile GetWindowsDirectory fail (%s, %u), xrefs: 10011582
AIL::GetKBPatchNumFromMumFile FindTagName fail (%s, %u), xrefs: 10011508
AIL::GetKBPatchNumFromMumFile PathAppend(InstallName) return FALSE (%s, %u), xrefs: 1001155A
identifier, xrefs: 100114CC
AIL::GetKBPatchNumFromMumFile Load(%s) fail (%u), xrefs: 1001151C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3Path$Append$DirectoryExistsFileWindows_memset
String ID: AIL::GetKBPatchNumFromMumFile FindTagName fail (%s, %u)$AIL::GetKBPatchNumFromMumFile GetWindowsDirectory fail (%s, %u)$AIL::GetKBPatchNumFromMumFile Load(%s) fail (%u)$AIL::GetKBPatchNumFromMumFile PathAppend(InstallName) return FALSE (%s, %u)$AIL::GetKBPatchNumFromMumFile PathAppend(SERVICING_PACKAGES) return FALSE (%s, %u)$AIL::GetKBPatchNumFromMumFile PathFileExists(%s) return FALSE (%u)$identifier$package$servicing\Packages
API String ID: 4057652770-837303772
Opcode ID: fd3caa48383412d5e722dc53759353523b05b074e79ed3d3722dd8a553ff7c84
Instruction ID: a52b0c9a25a24f3fefa675381dd28d94a34366586877e365e7d3ea0b844b4da4
Opcode Fuzzy Hash: fd3caa48383412d5e722dc53759353523b05b074e79ed3d3722dd8a553ff7c84
Instruction Fuzzy Hash: 54515BB9500548EFDB18DFA0CC819FE73B9FB88304F14452AFD16DB245EB34EA858A51

Uniqueness

Uniqueness Score: -1.00%

Function 100176BA Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 304fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,000003FE,?,00000000,?), ref: 1001779F
__wcsnicmp.LIBCMT ref: 100177F6
__wcsnicmp.LIBCMT ref: 1001793F
CharNextW.USER32(?), ref: 100179CF
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:Err=%d,00000000), ref: 10017A12
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:Read err=%d,00000000), ref: 10017A2E
GetLastError.KERNEL32 ref: 10017A56

Strings

AIL:System64:N/A:%s, xrefs: 100179A6
dbg=, xrefs: 10017841, 10017846, 1001784D, 1001785C
AIL:System64:The Var%d contains LF or CR, xrefs: 10017A20
AIL:System64:Err=%d, xrefs: 10017A05
AIL:System64:%s, xrefs: 10017866
AIL:System64()=ok, xrefs: 100179EE
AIL:System64:Read err=%d, xrefs: 10017A5F
AIL:System64:The Var%d is not valid, xrefs: 10017A43
ret=, xrefs: 100177E8, 100177ED, 100177F4, 10017803
AIL:System64(%s, %s, %s), xrefs: 10017701

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Error$__wcsnicmp$CharFileLastNextRead
String ID: AIL:System64(%s, %s, %s)$AIL:System64()=ok$AIL:System64:%s$AIL:System64:Err=%d$AIL:System64:N/A:%s$AIL:System64:Read err=%d$AIL:System64:The Var%d contains LF or CR$AIL:System64:The Var%d is not valid$dbg=$ret=
API String ID: 53849219-1774678166
Opcode ID: 0c2fb703b7808e45c87368195b63b5b8eef4f6db935462ad4b5803c6e51a168d
Instruction ID: 937fc9d18e17fc92040a0e9b14adea6b859b1babadaca7fd3b7081e761e70cba
Opcode Fuzzy Hash: 0c2fb703b7808e45c87368195b63b5b8eef4f6db935462ad4b5803c6e51a168d
Instruction Fuzzy Hash: AB91197590461A6BE721DB749C42E9E32BCFF45394FA00029FD0DAE193EF35EAC085A5

Uniqueness

Uniqueness Score: -1.00%

Function 10013F6C Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10013F73
GetModuleHandleW.KERNEL32(ntdll.dll,0000001C,1001433F,000000FF,00000004,?,00000001,101728B8), ref: 10013F92
GetLastError.KERNEL32 ref: 10013F9C
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 10013FBD
GetLastError.KERNEL32 ref: 10013FCA
GetCurrentProcessId.KERNEL32 ref: 10013FDE

Part of subcall function 1000A291: GetProcessHeap.KERNEL32(00000000,10014030,00000000), ref: 1000A2A2

Part of subcall function 1000A2EC: HeapAlloc.KERNEL32(?,?,00000018,00000000,1001403E,00000018,00000000), ref: 1000A2FE

OpenProcess.KERNEL32(00000410,00000000,000000FF), ref: 10013FF0
GetLastError.KERNEL32 ref: 10013FFC
CloseHandle.KERNEL32(00000000), ref: 1001405E
CloseHandle.KERNEL32(00000000), ref: 100140ED

Strings

AIL:QueryInfoProcess:InvalidParam, xrefs: 10014104, 1001410E
AIL:QueryInfoProcess:QueryInfoProcess(%d) err=%d, xrefs: 100140B4
AIL:QueryInfoProcess:InvalidBufferSize, xrefs: 100140D1
AIL:QueryInfoProcess:OpenProcess(%d) err=%d, xrefs: 10014006
AIL:QueryInfoProcess:OutOfMemory, xrefs: 10014044
AIL:QueryInfoProcess:GetProc err=%d, xrefs: 10013FD1
AIL:QueryInfoProcess:GetModule err=%d, xrefs: 10013FA3
ntdll.dll, xrefs: 10013F8D
NtQueryInformationProcess, xrefs: 10013FB7

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorHandleLastProcess$CloseHeap$AddressAllocCurrentH_prolog3ModuleOpenProc
String ID: AIL:QueryInfoProcess:GetModule err=%d$AIL:QueryInfoProcess:GetProc err=%d$AIL:QueryInfoProcess:InvalidBufferSize$AIL:QueryInfoProcess:InvalidParam$AIL:QueryInfoProcess:OpenProcess(%d) err=%d$AIL:QueryInfoProcess:OutOfMemory$AIL:QueryInfoProcess:QueryInfoProcess(%d) err=%d$NtQueryInformationProcess$ntdll.dll
API String ID: 1127950241-3568440171
Opcode ID: c183e1513790939285605cafd826d609d15741e346808b0e394cdecd350fd5d6
Instruction ID: fb2959bc774de25dbcf51dc88f341d7a67c6c8b1bf61560687d4bd37c887dc16
Opcode Fuzzy Hash: c183e1513790939285605cafd826d609d15741e346808b0e394cdecd350fd5d6
Instruction Fuzzy Hash: AB41F475900219EFDB14DFF08C89AEE7BB8EB19350F11412CFA01AF1A1DB3599C49BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1006B630 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 1006B7AC
_strspn.LIBCMT ref: 1006B7BF
_strspn.LIBCMT ref: 1006B7F3

Strings

IPv4-SAFI, xrefs: 1006B702
IPv6, xrefs: 1006B6ED
..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_addr.c, xrefs: 1006B66B, 1006B803, 1006B823, 1006B889, 1006BA6B, 1006BAB3, 1006BAEA, 1006BB2B, 1006BB4B, 1006BB5C, 1006BB85, 1006BB93, 1006BBA8, 1006BBB6, 1006BBCE
,name:, xrefs: 1006BB0F, 1006BBF0
inherit, xrefs: 1006B83B
section:, xrefs: 1006BB15, 1006BBF6
IPv4, xrefs: 1006B6C2
IPv6-SAFI, xrefs: 1006B72B
,value:, xrefs: 1006BB09, 1006BBEA

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strspn$__wcstoui64
String ID: ,name:$,value:$..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_addr.c$IPv4$IPv4-SAFI$IPv6$IPv6-SAFI$inherit$section:
API String ID: 902092489-3273318102
Opcode ID: 86920c462e71986f0e2e1282ae741bab5a7829316838e8ef27753fc5c584a863
Instruction ID: 1a35d39bf5ec0ed7693e5e5e40735b3ffcdb421e3c5c8e5a1b574914308aec26
Opcode Fuzzy Hash: 86920c462e71986f0e2e1282ae741bab5a7829316838e8ef27753fc5c584a863
Instruction Fuzzy Hash: A5E136F5A087056FE310DE65CC82F6B77EAEF84254F04051DFA459B282EB75EA808793

Uniqueness

Uniqueness Score: -1.00%

Function 10063C50 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 219COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 10063C97
_strspn.LIBCMT ref: 10063CC9
_strspn.LIBCMT ref: 10063CE8
_strncmp.LIBCMT ref: 10063CF7
_strspn.LIBCMT ref: 10063D10
_strspn.LIBCMT ref: 10063D26

Strings

Proc-Type:, xrefs: 10063C91
, xrefs: 10063D0A
ENCRYPTED, xrefs: 10063CF1
..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c, xrefs: 10063CA8, 10063D3E, 10063D6F, 10063DD8, 10063E10, 10063E3B, 10063E82
DEK-Info:, xrefs: 10063D58
, xrefs: 10063D20
,, xrefs: 10063D99

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strspn$_strncmp
String ID: $ $ ,$..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
API String ID: 2057175535-880592320
Opcode ID: e74872bfeed4630585236281bf0f799963565bde35995a608e0a9ea138e66a54
Instruction ID: 29475cc7aef7ad4b2c73ae20e636029a03d6b5ead130b3d82cc2bc6687c22905
Opcode Fuzzy Hash: e74872bfeed4630585236281bf0f799963565bde35995a608e0a9ea138e66a54
Instruction Fuzzy Hash: C55127B7F802103AE211AA642C03FD733C9CB51725F494929FD8DEE1C2F75B955142EA

Uniqueness

Uniqueness Score: -1.00%

Function 10013B41 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 140synchronizationCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,true), ref: 10013B6B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,true), ref: 10013B7E
_memset.LIBCMT ref: 10013BBA
_memset.LIBCMT ref: 10013BD8
AhnIEx_IsWinNT.AHNIEX(?,?,?,?,?,?,?,?,?,?,true), ref: 10013C05

Part of subcall function 10018600: AhnIEx_GetOS.AHNIEX(1000A7FA,InstallInfo:Init,00000018), ref: 10018609

CreateMutexW.KERNEL32(0000000C,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C28
CreateMutexW.KERNEL32(0000000C,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C3A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,true), ref: 10013C3C
OpenMutexW.KERNEL32(00020000,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C6D
OpenMutexW.KERNEL32(00020000,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C79
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,true), ref: 10013C88

Strings

Global\_Mutex_AIL_SingleInstance_, xrefs: 10013B9C
_Mutex_AIL_SingleInstance_, xrefs: 10013BC2
AIL:IsAnotherInstanceRunning(%s) err=%d, xrefs: 10013CC5
true, xrefs: 10013B5A
AIL:Already running. (%s), xrefs: 10013CA5

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Mutex$CreateDescriptorErrorLastOpenSecurity_memset$CloseDaclHandleInitialize
String ID: AIL:Already running. (%s)$AIL:IsAnotherInstanceRunning(%s) err=%d$Global\_Mutex_AIL_SingleInstance_$_Mutex_AIL_SingleInstance_$true
API String ID: 3230021021-707963209
Opcode ID: d6ad8c383efec9222c6d024bc44da397bff398b6592a845cfef56b067a595d9c
Instruction ID: 4ce7d10fcb7f9e26d2487565884f849c5bc85b1488a26e1bb84a43710e55e4ee
Opcode Fuzzy Hash: d6ad8c383efec9222c6d024bc44da397bff398b6592a845cfef56b067a595d9c
Instruction Fuzzy Hash: DF41517290021DABDB14DBA08D85BEE77BCEB08344F1144A5F619FA040EB74DEC98F91

Uniqueness

Uniqueness Score: -1.00%

Function 100133BF Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134windowprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100133F4
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,?,?), ref: 1001342C
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10013436
CloseHandle.KERNEL32(00000400,?,?,?,?,?,?,?), ref: 10013459
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 10013486
DispatchMessageW.USER32(?), ref: 1001349C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 100134AA
PostQuitMessage.USER32(00000000), ref: 100134B8
GetExitCodeProcess.KERNEL32(?,?), ref: 100134D1
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 100134E7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 10013517

Strings

AIL:Exec(%s) err=%d, xrefs: 10013440
AIL:Exec(%s, %s, 0x%x), xrefs: 100133DF
AIL:Exec(%s)=ok, xrefs: 10013505
AIL:Exec(%s)=ok, ExitCode=%d, xrefs: 100134E0
AIL:Exec(%s)=ok, ExitCode=err:%u, xrefs: 100134F1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Message$CloseErrorHandleLastProcess$CodeCreateDispatchExitMultipleObjectsPeekPostQuitWait_memset
String ID: AIL:Exec(%s) err=%d$AIL:Exec(%s)=ok$AIL:Exec(%s)=ok, ExitCode=%d$AIL:Exec(%s)=ok, ExitCode=err:%u$AIL:Exec(%s, %s, 0x%x)
API String ID: 833213656-4106261739
Opcode ID: ce68d27819efba15030762437807a3bad098cfff78c0a51ec638288944b54f07
Instruction ID: 7021495bf34e05a1b6b575a896ef10ec23731379e98ace4c96576a93b35ee0ab
Opcode Fuzzy Hash: ce68d27819efba15030762437807a3bad098cfff78c0a51ec638288944b54f07
Instruction Fuzzy Hash: DF419E76900119BBDB12DFB0CD89EDF7BB9FF04790F008024FA15AA150E375E9949BA1

Uniqueness

Uniqueness Score: -1.00%

Function 100F17F0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 100F1780: _signal.LIBCMT ref: 100F1787
Part of subcall function 100F1780: _signal.LIBCMT ref: 100F1798
Part of subcall function 100F1780: _signal.LIBCMT ref: 100F17A9
Part of subcall function 100F1780: _signal.LIBCMT ref: 100F17BA
Part of subcall function 100F1780: _signal.LIBCMT ref: 100F17CB
Part of subcall function 100F1780: _signal.LIBCMT ref: 100F17DC

GetStdHandle.KERNEL32(000000F6,00000000), ref: 100F1867
SetConsoleMode.KERNEL32(00000000), ref: 100F186E
GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000), ref: 100F1895
GetStdHandle.KERNEL32(000000F6,?,000001FF,?,00000000), ref: 100F18B8
ReadConsoleW.KERNEL32(00000000), ref: 100F18BF
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000200,00000000,00000000), ref: 100F1924
GetStdHandle.KERNEL32(000000F6,?,000001FF,?,00000000), ref: 100F195A
ReadConsoleA.KERNEL32(00000000), ref: 100F1961
_fgets.LIBCMT ref: 100F19A7
_feof.LIBCMT ref: 100F19BC
_ferror.LIBCMT ref: 100F19CF
_fprintf.LIBCMT ref: 100F1A4D
GetStdHandle.KERNEL32(000000F6,00000000), ref: 100F1A77
SetConsoleMode.KERNEL32(00000000), ref: 100F1A7E

Strings

OPENSSL_WIN32_UTF8, xrefs: 100F1890

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _signal$ConsoleHandle$ModeRead$ByteCharEnvironmentMultiVariableWide_feof_ferror_fgets_fprintf
String ID: OPENSSL_WIN32_UTF8
API String ID: 954338062-1166498146
Opcode ID: 0119cabc40f0e207c11a9ad3014ed208b187c54b198bd4fc0251bc654ca50d1b
Instruction ID: cdc6f28e8054a46e6f97b632f5943c9d2dde0578edc0d3d9ad8d0d45e7d258c5
Opcode Fuzzy Hash: 0119cabc40f0e207c11a9ad3014ed208b187c54b198bd4fc0251bc654ca50d1b
Instruction Fuzzy Hash: 3E71E3B25083599FD710CFA4CCC5AAB73E8EB85350F504A2DF550C2194EB79EA84CB93

Uniqueness

Uniqueness Score: -1.00%

Function 100092F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll,00000000,00000000,00000000), ref: 10009352
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 1000936E
GetProcAddress.KERNEL32(00000000,NtOpenSymbolicLinkObject), ref: 10009379
GetProcAddress.KERNEL32(00000000,NtQuerySymbolicLinkObject), ref: 10009384
CloseHandle.KERNEL32(?), ref: 100093DA
_wcslen.LIBCMT ref: 100093EA
__wcsnicmp.LIBCMT ref: 100093FA
QueryDosDeviceW.KERNEL32(?,?,00000104), ref: 10009479
_wcslen.LIBCMT ref: 10009487
__wcsnicmp.LIBCMT ref: 10009494

Strings

ntdll, xrefs: 10009345
NtOpenSymbolicLinkObject, xrefs: 10009370
NtQuerySymbolicLinkObject, xrefs: 1000937B
RtlInitUnicodeString, xrefs: 10009368
\??\X:, xrefs: 10009328

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressProc$Handle__wcsnicmp_wcslen$CloseDeviceModuleQuery
String ID: NtOpenSymbolicLinkObject$NtQuerySymbolicLinkObject$RtlInitUnicodeString$\??\X:$ntdll
API String ID: 1010259872-3052813459
Opcode ID: 904f1577204c769cfa5747cfc162c064d331cc79c297e9b97bee1c67f5e4400b
Instruction ID: daf34f951aec420e279ca138e54a11870be9af68f69f74bbdc3f8a92c023d439
Opcode Fuzzy Hash: 904f1577204c769cfa5747cfc162c064d331cc79c297e9b97bee1c67f5e4400b
Instruction Fuzzy Hash: 0F611971D0024DABDB21DFE4CC84ADEBBB9FF08380F11402AE909EB155EB759A85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10057AA0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 157registryfilewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00000008,00000000,?,00000000,10057CF9,%s:%d: OpenSSL internal error: %s,?,?,00000000,10093B8F,assertion failed: n < (int)sizeof(ctx->enc_data),..\..\Src\openssl-1.1.1n\crypto\evp\encode.c,0000016F,00000000,?), ref: 10057ABC
GetFileType.KERNEL32(00000000), ref: 10057AC9
_vswprintf_s.LIBCMT ref: 10057AE7

Part of subcall function 1010191F: __vsnprintf_l.LIBCMT ref: 10101932

WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000), ref: 10057B0A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?), ref: 10057B4C
_vswprintf_s.LIBCMT ref: 10057BE0
GetVersion.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057BEE
RegisterEventSourceW.ADVAPI32(00000000,OpenSSL), ref: 10057C0B
ReportEventW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 10057C39
DeregisterEventSource.ADVAPI32(00000000), ref: 10057C40
MessageBoxW.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 10057C58

Strings

OpenSSL: FATAL, xrefs: 10057C4A
OpenSSL, xrefs: 10057C04
no stack?, xrefs: 10057B3A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Event$FileSource_vswprintf_s$ByteCharDeregisterHandleMessageMultiRegisterReportTypeVersionWideWrite__vsnprintf_l
String ID: OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 1577032427-278800372
Opcode ID: 27d620426906965e80e0862a14418d0df84b0ece3b8019a654832a6dab99ea89
Instruction ID: 0ff32466d47e60c5a2b4630b752572efba348cbdb791b10a7220c8f9214c286d
Opcode Fuzzy Hash: 27d620426906965e80e0862a14418d0df84b0ece3b8019a654832a6dab99ea89
Instruction Fuzzy Hash: D1514C31500326ABE725CB20CD99F9B3779FF84750F108098FE199B295EB75AE48D790

Uniqueness

Uniqueness Score: -1.00%

Function 10010628 Relevance: 24.3, APIs: 5, Strings: 11, Instructions: 291stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,AIL:VerifyUserInfo), ref: 100107C0
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,AIL:VerifyUserInfo), ref: 100107D8
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,AIL:VerifyUserInfo), ref: 100107F0
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,AIL:VerifyUserInfo), ref: 10010924
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,AIL:VerifyUserInfo), ref: 1001093C

Strings

false, xrefs: 10010668
UserInfoSerialIDList, xrefs: 100106C6
AIL:VerifyUserInfo, xrefs: 10010649
UserInfoTableIndex, xrefs: 100106AD
UserProductNumber, xrefs: 1001069F, 100106A4, 100107AF, 100108EE
UserName, xrefs: 1001067B
EvaluationPeriod, xrefs: 10010825
true, xrefs: 10010951
UserDepartment, xrefs: 10010692
UserInfoVersion, xrefs: 100106B9
UserOrganization, xrefs: 10010685

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: lstrlen$FreeGlobal
String ID: AIL:VerifyUserInfo$EvaluationPeriod$UserDepartment$UserInfoSerialIDList$UserInfoTableIndex$UserInfoVersion$UserName$UserOrganization$UserProductNumber$false$true
API String ID: 507983222-163773917
Opcode ID: a498ce0748b7b64e2a78f2f1b29478918c18da089a4b196d3ec4b96aa5f25bd9
Instruction ID: dd4dc5e07405a459e4bc9a379ac4947772887457758ebcfce1568d8a17cb64ef
Opcode Fuzzy Hash: a498ce0748b7b64e2a78f2f1b29478918c18da089a4b196d3ec4b96aa5f25bd9
Instruction Fuzzy Hash: 6791D875E44209BAEF25DBA18C86ECF37B9EF49750F100116F440BE1D2EAF5E8C08A61

Uniqueness

Uniqueness Score: -1.00%

Function 100117BD Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 141registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00020119,?,000001FC,?,00000000), ref: 10011828
_memset.LIBCMT ref: 1001184E
RegQueryValueExW.ADVAPI32(?,InstallName,00000000,00000000,?,?,?,?,00000000), ref: 10011875
RegQueryValueExW.ADVAPI32(?,CurrentState,00000000,00000000,?,?,?,?,00000000), ref: 1001189A
RegQueryValueExW.ADVAPI32(?,LastError,00000000,00000000,?,?,?,?,00000000), ref: 100118BB
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 10011941

Strings

AIL::GetPatchInfoFromReg RegQueryValueEx(InstallName) fail (%u), xrefs: 10011922
AIL::GetPatchInfoFromReg GetKBPatchNumFromMumFile() fail (%s, %u), xrefs: 10011901
AIL::GetPatchInfoFromReg RegQueryValueEx(CurrentState) fail (%u), xrefs: 1001191A
LastError, xrefs: 100118AC
CurrentState, xrefs: 1001188B
InstallName, xrefs: 10011866
AIL::GetPatchInfoFromReg RegOpenKeyEx() fail (%u), xrefs: 1001192A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen_memset
String ID: AIL::GetPatchInfoFromReg GetKBPatchNumFromMumFile() fail (%s, %u)$AIL::GetPatchInfoFromReg RegOpenKeyEx() fail (%u)$AIL::GetPatchInfoFromReg RegQueryValueEx(CurrentState) fail (%u)$AIL::GetPatchInfoFromReg RegQueryValueEx(InstallName) fail (%u)$CurrentState$InstallName$LastError
API String ID: 4143045829-284169325
Opcode ID: 235c0cbf9ca39ebf5d92b41d8cf1328efcf5187e69777cc26bcdd47d265c06a2
Instruction ID: 91cba860aacfd88e7edceabc98c876017126ea0be04b8e3a9292022dd7dedbc1
Opcode Fuzzy Hash: 235c0cbf9ca39ebf5d92b41d8cf1328efcf5187e69777cc26bcdd47d265c06a2
Instruction Fuzzy Hash: 70414CB5A0025DAFDB28DFA4CC90AEEB7F9FB49344F20403AE519AB141DB3099848B51

Uniqueness

Uniqueness Score: -1.00%

Function 1000421B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1000423A
_memset.LIBCMT ref: 10004262
LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,CAmbass:Init,00000044), ref: 10004291
GetLastError.KERNEL32(?,?,?,?,?,?,?,CAmbass:Init,00000044), ref: 100042A1
GetProcAddress.KERNEL32(00000000,000003F2), ref: 10004300
GetLastError.KERNEL32(?,?,?,?,?,?,?,CAmbass:Init,00000044), ref: 1000430A

Strings

Ambass=%s, xrefs: 1000427E
%PluginDir%\ambassmt.dll, xrefs: 10004267
Load Ambass Err=%d, xrefs: 100042AA
AIL:CAmbass Initialize Failed=%x, xrefs: 10004371
AIL:CAmbass GetProcAddress Failed=%x, xrefs: 10004310
CAmbass:Init, xrefs: 10004241
AIL:CAmbass GetInterface Failed=%x, xrefs: 10004336

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressH_prolog3LibraryLoadProc_memset
String ID: %PluginDir%\ambassmt.dll$AIL:CAmbass GetInterface Failed=%x$AIL:CAmbass GetProcAddress Failed=%x$AIL:CAmbass Initialize Failed=%x$Ambass=%s$CAmbass:Init$Load Ambass Err=%d
API String ID: 1689152997-2762717935
Opcode ID: 4ea01c3f6657cfee3dae44bdf68d94cb4cfe7acf17e757265738f484268ba783
Instruction ID: 25d1d58c639ac7994463575bb26fcdaadbcde0104b3b0df0b3de074ca5a0c891
Opcode Fuzzy Hash: 4ea01c3f6657cfee3dae44bdf68d94cb4cfe7acf17e757265738f484268ba783
Instruction Fuzzy Hash: 3B3116B5600308AFE714DBB48C46B9E77B8FB44390F518129F915DB2C1EF78AA85C704

Uniqueness

Uniqueness Score: -1.00%

Function 10017588 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000000,?,?,?,?,10001313,00000001,AIL:Free), ref: 100175AA
GetLastError.KERNEL32(?,?,?,?,10001313,00000001,AIL:Free), ref: 100175C4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,10001313,00000001,AIL:Free), ref: 100175D5
GetExitCodeProcess.KERNEL32(?), ref: 100175E5
CloseHandle.KERNEL32(10001313,00000001,AIL:Free), ref: 1001762E
CloseHandle.KERNEL32(?,?,?,?,?,10001313,00000001,AIL:Free), ref: 10017640
CloseHandle.KERNEL32(?,?,?,?,?,10001313,00000001,AIL:Free), ref: 1001764C

Strings

AIL:System64:GetExitCode err=%d, xrefs: 10017619
AIL:System64:ExitCode=%d, xrefs: 10017609
AIL:System64:Terminate err=%d, xrefs: 100175CB
AIL:System64 is terminated, xrefs: 100175B4
AIL:System64:System64 is closed, xrefs: 100175F8

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CloseHandle$Process$CodeErrorExitLastObjectSingleTerminateWait
String ID: AIL:System64 is terminated$AIL:System64:ExitCode=%d$AIL:System64:GetExitCode err=%d$AIL:System64:System64 is closed$AIL:System64:Terminate err=%d
API String ID: 541732320-2038357573
Opcode ID: 0888e417db371094cd68367a288fe9932ae1c67320c0d92bc4758973e4726641
Instruction ID: 35300b5a5416c0ba8c071dbc6a6c77bf74b88b156e1d4b7557b88cbed6ebc895
Opcode Fuzzy Hash: 0888e417db371094cd68367a288fe9932ae1c67320c0d92bc4758973e4726641
Instruction Fuzzy Hash: 60112670606529BFCB03DB688D84D5A3BBDF784360F204216F504D69A8DB78E9C0DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10017ED1 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 1000A1C0: GetLastError.KERNEL32(?,?,?,?,80004005,?,?), ref: 1000A234
Part of subcall function 1000A1C0: SetLastError.KERNEL32(00000000,?,?,?,80004005,?,?), ref: 1000A247

GetLastError.KERNEL32(WS2_32.DLL), ref: 10017F0E
SetLastError.KERNEL32(00000000), ref: 10017F27

Strings

WSACleanup, xrefs: 10017F66
WSAStartup, xrefs: 10017F4F
AIL:IsWinsockLater:Get Startup addr err, xrefs: 10018005
AIL:IsWinsockLater:Version=0x%x, HighVersion=0x%x, xrefs: 10017F92
AIL:IsWinsockLater:Get Cleanup addr err, xrefs: 10017FF1
WS2_32.DLL, xrefs: 10017EFD
AIL:IsWinsockLater:WsaStartup err, xrefs: 10017FDA
AIL:IsWinsockLater:err=%d, xrefs: 10017FC4
AIL:IsWinsockLater:Load err=%d, xrefs: 10017F17

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast
String ID: AIL:IsWinsockLater:Get Cleanup addr err$AIL:IsWinsockLater:Get Startup addr err$AIL:IsWinsockLater:Load err=%d$AIL:IsWinsockLater:Version=0x%x, HighVersion=0x%x$AIL:IsWinsockLater:WsaStartup err$AIL:IsWinsockLater:err=%d$WS2_32.DLL$WSACleanup$WSAStartup
API String ID: 1452528299-2702011866
Opcode ID: c5b29ff64f038e84ef1bfbc925ef5882be6caa5a011ffefe88adbce7739fc910
Instruction ID: f573e9ef577c0ead080e12ebec2b66f9d1446bea7f9172f0c71239d03b729d86
Opcode Fuzzy Hash: c5b29ff64f038e84ef1bfbc925ef5882be6caa5a011ffefe88adbce7739fc910
Instruction Fuzzy Hash: A131B675A0126C9BD720EBB4DC819EE77B8FF19380F500139F809AB242EF749E458B90

Uniqueness

Uniqueness Score: -1.00%

Function 100403F0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 249COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 10040427
_feof.LIBCMT ref: 10040437
_ftell.LIBCMT ref: 10040447
__fileno.LIBCMT ref: 10040472
__setmode.LIBCMT ref: 10040485
GetLastError.KERNEL32(..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c,00000120), ref: 1004056A
GetLastError.KERNEL32(..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c,0000013C), ref: 10040630

Strings

fflush(), xrefs: 10040640
',', xrefs: 10040583
..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c, xrefs: 10040565, 1004059A, 100405D3, 1004062B, 10040650
fopen(', xrefs: 10040589

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$__fileno__setmode_feof_fseek_ftell
String ID: ','$..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c$fflush()$fopen('
API String ID: 819642963-216818510
Opcode ID: 6cf66ef1a55e8ad6e9198340b16740d08498983645e4a2c10e525b1599fe8c46
Instruction ID: b62a2c99ff600d1d926bd0520dbb8b323f0185589b7a9e6bbc431fb79bc3080f
Opcode Fuzzy Hash: 6cf66ef1a55e8ad6e9198340b16740d08498983645e4a2c10e525b1599fe8c46
Instruction Fuzzy Hash: CD615BB6B413042FD200DA68BC42FAB73DCDB89722F10457EFB45EA1C2E77AA5084665

Uniqueness

Uniqueness Score: -1.00%

Function 1000978A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

IsCharAlphaW.USER32(00000000,00000104,?,?,?,10018891,?,00000000,?,?,101728B8), ref: 10009796
CreateDirectoryW.KERNEL32(?,00000000,?,?,10018891,?,00000000,?,?,101728B8), ref: 1000984F
GetLastError.KERNEL32(?,?,10018891,?,00000000,?,?,101728B8), ref: 10009859
_wcsrchr.LIBCMT ref: 1000988E
CreateDirectoryW.KERNEL32(?,00000000), ref: 100098BE
GetLastError.KERNEL32 ref: 100098EE
SetLastError.KERNEL32(00000000,?,10018891,?,00000000,?,?,101728B8), ref: 10009904
SetLastError.KERNEL32(00000057,?,10018891,?,00000000,?,?,101728B8), ref: 10009933

Strings

AIL:CreateDir2(%s) err=%d, xrefs: 100098F4
AIL:CreateDir(%s) what???, xrefs: 100097FB
AIL:CreateDir(%s) already exist. skip, xrefs: 10009866
AIL:CreateDir(%s) err=%d, xrefs: 10009918, 10009922

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectory$AlphaChar_wcsrchr
String ID: AIL:CreateDir(%s) already exist. skip$AIL:CreateDir(%s) err=%d$AIL:CreateDir(%s) what???$AIL:CreateDir2(%s) err=%d
API String ID: 3721641845-2030782030
Opcode ID: 2cb87dca7f547257c7693d3596afd3d78f1ec166d026ff8fb04c87c8ac349476
Instruction ID: 80c4334e290e2a231fa5ebe413f8604c6c759f700e163f4e7f36b8cf523cf5f7
Opcode Fuzzy Hash: 2cb87dca7f547257c7693d3596afd3d78f1ec166d026ff8fb04c87c8ac349476
Instruction Fuzzy Hash: D8412625508706AAF320EB749C46F6B37ECEF427D1F10841DF909D51C9FBB0998092A1

Uniqueness

Uniqueness Score: -1.00%

Function 1001259E Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 169registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100125BD
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages,00000000,00020119,?,00000070), ref: 100125EA
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1001260F
_memset.LIBCMT ref: 1001263D
RegEnumKeyExW.ADVAPI32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 1001265E
_memset.LIBCMT ref: 10012681

Part of subcall function 100117BD: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020119,?,000001FC,?,00000000), ref: 10011828
Part of subcall function 100117BD: _memset.LIBCMT ref: 1001184E
Part of subcall function 100117BD: RegQueryValueExW.ADVAPI32(?,InstallName,00000000,00000000,?,?,?,?,00000000), ref: 10011875
Part of subcall function 100117BD: RegQueryValueExW.ADVAPI32(?,CurrentState,00000000,00000000,?,?,?,?,00000000), ref: 1001189A
Part of subcall function 100117BD: RegQueryValueExW.ADVAPI32(?,LastError,00000000,00000000,?,?,?,?,00000000), ref: 100118BB

Part of subcall function 10011028: char_traits.LIBCPMT ref: 1001104D

RegCloseKey.ADVAPI32(?), ref: 10012774

Strings

AIL::MakeInstalledKBPatchList RegOpenKeyEx() fail (%u), xrefs: 1001275D
AIL::MakeInstalledKBPatchList RegEnumKeyEx(%d) fail (%u), xrefs: 10012734
AIL::MakeInstalledKBPatchList RegQueryInfoKey() fail (%u), xrefs: 10012755
SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages, xrefs: 100125E0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Query$Value_memset$Open$CloseEnumH_prolog3Infochar_traits
String ID: AIL::MakeInstalledKBPatchList RegEnumKeyEx(%d) fail (%u)$AIL::MakeInstalledKBPatchList RegOpenKeyEx() fail (%u)$AIL::MakeInstalledKBPatchList RegQueryInfoKey() fail (%u)$SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages
API String ID: 4218394262-547118115
Opcode ID: e963b2ab1ce31a3b6756768c04c61a0dbfc35492c5cf5b48eef62ca312a5964e
Instruction ID: 5d00adf194d66aae2d44b894bac02e0a25eba0a8064d88143f647247460da80f
Opcode Fuzzy Hash: e963b2ab1ce31a3b6756768c04c61a0dbfc35492c5cf5b48eef62ca312a5964e
Instruction Fuzzy Hash: 5E512FB5D0424DAFDB15DFA0CD85AEFB7BCFF08304F10412AF505AA291EB34AA548B61

Uniqueness

Uniqueness Score: -1.00%

Function 1000111B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 139COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00000104,AIL:Init), ref: 1000115A

Part of subcall function 10008273: GetFileVersionInfoSizeW.VERSION(?,?,?,00000104,?), ref: 10008311
Part of subcall function 10008273: GetLastError.KERNEL32(?,?,?,00000104,?), ref: 10008320

SetLastError.KERNEL32(00000000), ref: 10001230

Part of subcall function 1000C148: GetModuleHandleW.KERNEL32(Kernel32.dll,00000104,?,?,?,100011BA), ref: 1000C159
Part of subcall function 1000C148: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000C165

Part of subcall function 10005755: __EH_prolog3.LIBCMT ref: 10005774
Part of subcall function 10005755: _memset.LIBCMT ref: 1000579D
Part of subcall function 10005755: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100057CC
Part of subcall function 10005755: GetLastError.KERNEL32(?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 100057D9

Strings

Ambass Init Failure. err=%d, xrefs: 100012A2
Dll Init Failure. err=%d, xrefs: 1000126F
UserInfoTableIndex, xrefs: 100011F3
InitFlag=0x%x, xrefs: 1000119A
GetInstallInfo() err=%d, xrefs: 100012B5
LangID=%d, xrefs: 100011BB
AhnIEx ver, xrefs: 1000118C
Init Failure. err=%d, xrefs: 10001210
AIL:Init, xrefs: 10001137

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$FileModule$AddressH_prolog3HandleInfoLibraryLoadNameProcSizeVersion_memset
String ID: AIL:Init$AhnIEx ver$Ambass Init Failure. err=%d$Dll Init Failure. err=%d$GetInstallInfo() err=%d$Init Failure. err=%d$InitFlag=0x%x$LangID=%d$UserInfoTableIndex
API String ID: 484499424-746271303
Opcode ID: b8fbf335f0bd26d5ee41d52d3bfab74428ef7357da3b06ff269d6ef32a8c77ca
Instruction ID: 62a8ade9499a4e736e9f95c9b609f0e2c84f7f2332c099750fbed510a0fa5a15
Opcode Fuzzy Hash: b8fbf335f0bd26d5ee41d52d3bfab74428ef7357da3b06ff269d6ef32a8c77ca
Instruction Fuzzy Hash: 9041A775A0021877E714DBB48C86FEF76BDEB49780F000065F905EB286DB79AD9187A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000D056 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_GetOS.AHNIEX ref: 1000D065

Strings

2012, xrefs: 1000D160
Vista, xrefs: 1000D116
2008, xrefs: 1000D159
2003, xrefs: 1000D0F8
8.1, xrefs: 1000D191
Later, xrefs: 1000D183
NT4, xrefs: 1000D0D5
2012R2, xrefs: 1000D18A
NT3, xrefs: 1000D0AD
2008R2, xrefs: 1000D14B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal
String ID: 2003$2008$2008R2$2012$2012R2$8.1$Later$NT3$NT4$Vista
API String ID: 2979337801-1525137950
Opcode ID: 3a268568d565d01d2d8a251b5b34a68be16443c8a1a8cd898c9cf794a3780556
Instruction ID: f5f8cad28ca9cdbca3287a8669f6542df0fc24cc4993f2f5742e28f5df961def
Opcode Fuzzy Hash: 3a268568d565d01d2d8a251b5b34a68be16443c8a1a8cd898c9cf794a3780556
Instruction Fuzzy Hash: 8721D571A08205B1FAB9F8A09CB1BED95E1D7453D1F344923F90AE91ADDE7888C0D573

Uniqueness

Uniqueness Score: -1.00%

Function 100183D3 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000043), ref: 10018357
GetModuleHandleW.KERNEL32(Kernel32.dll,?,?,?,1000D760,00000000,TRUE,1011DDA0,?,00000001), ref: 1001836E
GetProcAddress.KERNEL32(00000000,TermsrvAppInstallMode), ref: 10018386

Strings

CtxGetIniMapping, xrefs: 10018392
Kernel32.dll, xrefs: 10018367
AIL:IsTerminalServerInInstallMode:GetModuleHandle err=%d, xrefs: 100183BE
AIL:IsTerminalServerInInstallMode:GetProcAddress err=%d, xrefs: 100183B0
TermsrvAppInstallMode, xrefs: 10018380

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressHandleMetricsModuleProcSystem
String ID: AIL:IsTerminalServerInInstallMode:GetModuleHandle err=%d$AIL:IsTerminalServerInInstallMode:GetProcAddress err=%d$CtxGetIniMapping$Kernel32.dll$TermsrvAppInstallMode
API String ID: 1717968593-3534110796
Opcode ID: c4bafa3f6cca77c075e7aa25e81f7b93e67134528b01b0506c5c1701a2cd8c6f
Instruction ID: ba9f45704b7ab563445bab8f9cfa30beddc5af1a73cfbcade6748a0fbea0d215
Opcode Fuzzy Hash: c4bafa3f6cca77c075e7aa25e81f7b93e67134528b01b0506c5c1701a2cd8c6f
Instruction Fuzzy Hash: 8801D175304216AFDB50E7B45EC4D6E26A8EB91EC27284025F924DA644EB38CB82A331

Uniqueness

Uniqueness Score: -1.00%

Function 100EBF30 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 268COMMON

Download Yara Rule

Strings

UTF8, xrefs: 100EC161
tag=, xrefs: 100EBFA2
HEX, xrefs: 100EC18B
ASCII, xrefs: 100EC137
BITLIST, xrefs: 100EC1B5
..\..\Src\openssl-1.1.1n\crypto\asn1\asn1_gen.c, xrefs: 100EBF8B, 100EBFDA, 100EC014, 100EC063, 100EC095, 100EC1E2

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\asn1\asn1_gen.c$ASCII$BITLIST$HEX$UTF8$tag=
API String ID: 0-165680441
Opcode ID: 5bf0271a8d95abb5ce8fc2230ca262f64fca9d0ec1c31c714e7b26b664e6fdcf
Instruction ID: 43f211d1df36e68951f22d929326b8f459ed759b258274c1682b0f882cfee5ae
Opcode Fuzzy Hash: 5bf0271a8d95abb5ce8fc2230ca262f64fca9d0ec1c31c714e7b26b664e6fdcf
Instruction Fuzzy Hash: CC718B72344305AFF220D519AC82F967381EB85778F20427AFB55FE2C2E7A6E8464752

Uniqueness

Uniqueness Score: -1.00%

Function 1001C762 Relevance: 16.6, APIs: 11, Instructions: 99COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1001C777
_memset.LIBCMT ref: 1001C78B
_malloc.LIBCMT ref: 1001C794
_memset.LIBCMT ref: 1001C7AA
_malloc.LIBCMT ref: 1001C7BA
_memset.LIBCMT ref: 1001C7CC
_malloc.LIBCMT ref: 1001C7DA
_malloc.LIBCMT ref: 1001C7EF
_memset.LIBCMT ref: 1001C804
_malloc.LIBCMT ref: 1001C811
_memset.LIBCMT ref: 1001C828

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _malloc$_memset
String ID:
API String ID: 1242881360-0
Opcode ID: c87273b4056eb95f44874d83dc2fa83a96277c30a72ef692a6a80857e277cd13
Instruction ID: 03de22d5e1c2bf9b25e1018e761672522befa13a3620c5266ebe5a0004135369
Opcode Fuzzy Hash: c87273b4056eb95f44874d83dc2fa83a96277c30a72ef692a6a80857e277cd13
Instruction Fuzzy Hash: D02192B6900A5C6FD320DF699C85E2BB7DCEB91B94F115829F2049B201EA35EC449BA4

Uniqueness

Uniqueness Score: -1.00%

Function 100190B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143windowCOMMON

Download Yara Rule

APIs

AhnIEx_GetMode.AHNIEX(?,?,?,?,?,00000400,?), ref: 100191B0

Part of subcall function 10018A83: FindResourceExW.KERNEL32(32810112,00000006,?,B2A1A428,?,00000400,?), ref: 10018AB5
Part of subcall function 10018A83: LoadResource.KERNEL32(32810112,00000000), ref: 10018AC1
Part of subcall function 10018A83: FreeResource.KERNEL32(00000000), ref: 10018AF0

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

IsWindow.USER32(?), ref: 10019233
IsWindowVisible.USER32(?), ref: 10019243
MessageBoxW.USER32(00000000,?,00000000,?), ref: 10019263

Strings

(%d), xrefs: 10019177
Caption, xrefs: 1001920F
ProductName, xrefs: 10019220
AIL:MsgBox(0x%x, %s), xrefs: 1001918E
(0x%x), xrefs: 10019170

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Resource$Window$FindFreeLoadMessageModeVisible_vswprintf_s
String ID: (%d)$ (0x%x)$AIL:MsgBox(0x%x, %s)$Caption$ProductName
API String ID: 4254788591-4087405492
Opcode ID: dd52600ab2044ac755a39bdc42445b1c8949fb97e15242bfb9e7feaeda54f46a
Instruction ID: 65f06fd41bd9aba4028b3214631e1ad691a582773bbaf041fa5470b031939309
Opcode Fuzzy Hash: dd52600ab2044ac755a39bdc42445b1c8949fb97e15242bfb9e7feaeda54f46a
Instruction Fuzzy Hash: 5941D876E0021ABBEB24DA64CC85FDA77F8FB05290F9580A5FD14EA185DE34DDC09790

Uniqueness

Uniqueness Score: -1.00%

Function 10009529 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 132fileCOMMON

Download Yara Rule

APIs

Part of subcall function 10007633: IsCharAlphaW.USER32(B2A1A428,00000104), ref: 1000764E
Part of subcall function 10007633: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?), ref: 1000769D
Part of subcall function 10007633: GetLastError.KERNEL32(?,?,?,?,?), ref: 100076B9

Part of subcall function 1000776E: IsCharAlphaW.USER32(B2A1A428,?), ref: 10007789
Part of subcall function 1000776E: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 100077D8
Part of subcall function 1000776E: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100077F4

_wcsrchr.LIBCMT ref: 100095B2
_wcslen.LIBCMT ref: 100095C1
MoveFileW.KERNEL32(?,?), ref: 1000965A
GetLastError.KERNEL32(?,?,?,?), ref: 10009665

Strings

AIL:RTCWSN(%s,%s) err=%u, xrefs: 10009671
AIL:RTCWSN(%s)=%s, xrefs: 1000958F, 1000968B
file, xrefs: 10009581
_bk%d, xrefs: 10009609
dir, xrefs: 10009588, 1000958D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorFileLast$AlphaCharFindFirst$Move_wcslen_wcsrchr
String ID: AIL:RTCWSN(%s)=%s$AIL:RTCWSN(%s,%s) err=%u$_bk%d$dir$file
API String ID: 3676545945-733045370
Opcode ID: 5731303bb5d1c54795f01a47809e1231eae8f993b0e9c3e35caf861b4ac8e75e
Instruction ID: 917f83351dd8c91e8035417db32a8c31b6795a6c586834a847504782819bb595
Opcode Fuzzy Hash: 5731303bb5d1c54795f01a47809e1231eae8f993b0e9c3e35caf861b4ac8e75e
Instruction Fuzzy Hash: BD4173B190060DAEEB20DBB5CC81AEE77BCFB08344F200129F515E6146EB769A448F60

Uniqueness

Uniqueness Score: -1.00%

Function 10017CC7 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 62libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.DLL,?,?), ref: 10017CE5
GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017D0A
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 10017D14
GetCurrentProcess.KERNEL32(00000018,?), ref: 10017D24
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 10017D41
GetCurrentProcess.KERNEL32(00000000), ref: 10017D51

Strings

Kernel32.DLL, xrefs: 10017CE0
IsWow64Process2, xrefs: 10017D04
IsWow64Process, xrefs: 10017D0C, 10017D3B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressProc$CurrentProcess$HandleModule
String ID: IsWow64Process$IsWow64Process2$Kernel32.DLL
API String ID: 2830680254-615841352
Opcode ID: 2592cebcab7cfbb5ad695ba55610ddf00bb0501f714b3be29e98f2dfdb6802bc
Instruction ID: ce0d960a15876aebda7f4e77823aac96dda03f568632fe2ebc2957b0517174f2
Opcode Fuzzy Hash: 2592cebcab7cfbb5ad695ba55610ddf00bb0501f714b3be29e98f2dfdb6802bc
Instruction Fuzzy Hash: 8C11A33AD00229EBC711DBF49C88A9E7BF8FB44251F118665F505D7224EB3CCA808B50

Uniqueness

Uniqueness Score: -1.00%

Function 100183EA Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 100183F5
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 10018405
GetLastError.KERNEL32 ref: 10018433
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 10018457
GetLastError.KERNEL32 ref: 10018471

Strings

GetDiskFreeSpaceExW, xrefs: 100183FF
AIL:GetDiskFreeSpace(%s) err=%d, xrefs: 1001847B
AIL:GetDiskFreeSpaceEx(%s) err=%d, xrefs: 1001843D
kernel32.dll, xrefs: 100183F0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressDiskFreeHandleModuleProcSpace
String ID: AIL:GetDiskFreeSpace(%s) err=%d$AIL:GetDiskFreeSpaceEx(%s) err=%d$GetDiskFreeSpaceExW$kernel32.dll
API String ID: 3160920872-415761632
Opcode ID: 8aa55c29d8ec7f51ff0e90be54c12dc1d8762bf72c9c6d73d786f4183be8a77c
Instruction ID: a5cfce441fd360cf6aa9b0bcbfbaf5c40f4ab962b941c3481ae733f9f50aff4f
Opcode Fuzzy Hash: 8aa55c29d8ec7f51ff0e90be54c12dc1d8762bf72c9c6d73d786f4183be8a77c
Instruction Fuzzy Hash: 2A113A76A0001ABFDF05DBA0CD85EEE7BBCFB14284B404115F902E6550EB34D784CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10013525 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,?,?,?,?,100028A5,?,?,00000040,?), ref: 10013535
OpenServiceW.ADVAPI32(00000000,?,00000001,?,?,?,?,100028A5,?,?,00000040,?), ref: 10013547
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,100028A5,?,?,00000040,?), ref: 1001355C
GetLastError.KERNEL32(?,?,?,?,?,100028A5,?,?,00000040,?), ref: 10013567
GetLastError.KERNEL32(?,?,?,?,?,100028A5,?,?,00000040,?), ref: 10013570
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,100028A5,?,?,00000040,?), ref: 10013587
GetLastError.KERNEL32(?,?,?,?,100028A5,?,?,00000040,?), ref: 1001358B

Strings

AIL:IsServiceInstalled:Open SCM err=%d, xrefs: 10013592
AIL:IsServiceInstalled:Open Service(%s) err=%d, xrefs: 10013577

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLastService$CloseHandleOpen$Manager
String ID: AIL:IsServiceInstalled:Open SCM err=%d$AIL:IsServiceInstalled:Open Service(%s) err=%d
API String ID: 467640263-3320107873
Opcode ID: b5c9e55e1ad1ebc76e591601fa0ba331c1a0015f514f1d7f943a12aed9f52514
Instruction ID: 5587874c771aaeb8042b7e1d7712163c7ca8678253c45fc2dba301143d393c28
Opcode Fuzzy Hash: b5c9e55e1ad1ebc76e591601fa0ba331c1a0015f514f1d7f943a12aed9f52514
Instruction Fuzzy Hash: AB0121F2004A18BFD301EF358CC1C6FBBBDFBC2290B208929F55686611D738AD8586B5

Uniqueness

Uniqueness Score: -1.00%

Function 1000C148 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,00000104,?,?,?,100011BA), ref: 1000C159
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000C165
AhnIEx_IsWinNT.AHNIEX(?,?,?,100011BA), ref: 1000C176
_memset.LIBCMT ref: 1000C187
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,100011BA), ref: 1000C194
EnumResourceLanguagesW.KERNEL32(00000000,00000010,00000001,1000C133,?), ref: 1000C1A8

Strings

GetUserDefaultUILanguage, xrefs: 1000C15F
Kernel32.dll, xrefs: 1000C154
ntdll.dll, xrefs: 1000C18F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: HandleModule$AddressEnumLanguagesProcResource_memset
String ID: GetUserDefaultUILanguage$Kernel32.dll$ntdll.dll
API String ID: 2350421612-3046320470
Opcode ID: f09d52ce819c2ae6f1dd0bc5fec5933b828c7bb18428c86ee74afae3437e9347
Instruction ID: 504062b994e9cc36bc183885a7ead170b06a72f9e72aa0b3f82801b463a57b44
Opcode Fuzzy Hash: f09d52ce819c2ae6f1dd0bc5fec5933b828c7bb18428c86ee74afae3437e9347
Instruction Fuzzy Hash: 59018471B4031DB6FA04E7B19D45FEA76ACDB027C0F004411B900E618AF674EA408665

Uniqueness

Uniqueness Score: -1.00%

Function 10017E3A Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

AhnIEx_IsWow64Process.AHNIEX(1000A1E4,00000001,00000000,80004005,?,?), ref: 10017E3A

Part of subcall function 10017CC7: GetModuleHandleW.KERNEL32(Kernel32.DLL,?,?), ref: 10017CE5
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017D0A
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 10017D14
Part of subcall function 10017CC7: GetCurrentProcess.KERNEL32(00000018,?), ref: 10017D24

GetModuleHandleW.KERNEL32(Kernel32,Wow64EnableWow64FsRedirection,?,1000A1E4,00000001,00000000,80004005,?,?), ref: 10017E55
GetProcAddress.KERNEL32(00000000), ref: 10017E5C
GetLastError.KERNEL32 ref: 10017E66

Strings

AIL:EnableWow64FsRedirection(%d)=err, xrefs: 10017E8F
AIL:EnableWow64FsRedirection(%d)=ok, OldValue=%d, xrefs: 10017EAF
AIL:EnableWow64FsRedirection(%d) Get addr err=%d, xrefs: 10017E71
Wow64EnableWow64FsRedirection, xrefs: 10017E4B
Kernel32, xrefs: 10017E50

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressProc$HandleModuleProcess$CurrentErrorLastWow64
String ID: AIL:EnableWow64FsRedirection(%d) Get addr err=%d$AIL:EnableWow64FsRedirection(%d)=err$AIL:EnableWow64FsRedirection(%d)=ok, OldValue=%d$Kernel32$Wow64EnableWow64FsRedirection
API String ID: 3748807388-1235632267
Opcode ID: 3f44edb28eddc773f4ac05ba5787f30ebbc57d6937f3f59c2dbffc669d1b1cce
Instruction ID: 4a6eeda6813abb83dd4d31c054415adb913a686194f8a3067c5acc8d512c7786
Opcode Fuzzy Hash: 3f44edb28eddc773f4ac05ba5787f30ebbc57d6937f3f59c2dbffc669d1b1cce
Instruction Fuzzy Hash: 57F0F47A6002217BD601D7A45D05B8B3BFCFB99391F504095F80C9A545E379998082E2

Uniqueness

Uniqueness Score: -1.00%

Function 10015912 Relevance: 15.1, APIs: 10, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,10015B91,?,00000004,?,?,00000000), ref: 10015930
GetLastError.KERNEL32(?,10015B91,?,00000004,?,?,00000000,?), ref: 10015938
GetProcessHeap.KERNEL32(00000000,?,?,10015B91,?,00000004,?,?,00000000,?), ref: 10015947
HeapAlloc.KERNEL32(00000000,?,10015B91,?,00000004,?,?,00000000,?), ref: 1001594E
SetLastError.KERNEL32(0000000E,?,10015B91,?,00000004,?,?,00000000,?), ref: 1001595F
GetFileSecurityW.ADVAPI32(00000000,?,00000000,?,?,?,10015B91,?,00000004,?,?,00000000,?), ref: 10015975
GetLastError.KERNEL32(?,10015B91,?,00000004,?,?,00000000,?), ref: 1001597D
GetProcessHeap.KERNEL32(00000000,00000000,?,10015B91,?,00000004,?,?,00000000,?), ref: 10015989
HeapFree.KERNEL32(00000000,?,10015B91,?,00000004,?,?,00000000,?), ref: 10015990
SetLastError.KERNEL32(00000000,?,10015B91,?,00000004,?,?,00000000,?), ref: 10015999

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorHeapLast$FileProcessSecurity$AllocFree
String ID:
API String ID: 528160337-0
Opcode ID: a04fcad75488b13aa2a3605249fcb12fdb6687491730484f0c86cda54d6e4202
Instruction ID: 258d5409ed418d85ca9f56045516bd713096e19de13c715628710340193ce7a7
Opcode Fuzzy Hash: a04fcad75488b13aa2a3605249fcb12fdb6687491730484f0c86cda54d6e4202
Instruction Fuzzy Hash: F3113376500266FFCB159BB5CE8889E7BBCFB492A2B108015F905DA220D735DE419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C407 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 144registryCOMMON

Download Yara Rule

APIs

AhnIEx_IsWow64Process.AHNIEX(?,00000000,?,?,?,?,1000C5BA,00000000,00000000,SavePendingFileList,00000064,1000130C,AIL:Free), ref: 1000C42D
RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000000,00000001,?,?,00000000,?,?,?,?,1000C5BA,00000000,00000000,SavePendingFileList,00000064), ref: 1000C449

Strings

AIL:MoveFileOnReboot:Query err=%d, xrefs: 1000C4E6
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 1000C43F
PendingFileRenameOperations, xrefs: 1000C474, 1000C479, 1000C4C9
AIL:MoveFileOnReboot:Open err=%d, xrefs: 1000C466

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: OpenProcessWow64
String ID: AIL:MoveFileOnReboot:Open err=%d$AIL:MoveFileOnReboot:Query err=%d$PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 2977075372-3653026304
Opcode ID: 3a93f7a19b490a8c0594a7d46da396ed7c9e7da67ebfe3fc116e3e53df0ced48
Instruction ID: 9465e70e58ca412d8d6e55dbb17911666c8f8fb20ce9431067a67fbac964d038
Opcode Fuzzy Hash: 3a93f7a19b490a8c0594a7d46da396ed7c9e7da67ebfe3fc116e3e53df0ced48
Instruction Fuzzy Hash: 2A41737560070DABEB14CF65CC91EAAB7EAFF852C4F10C029E846DA158E770E981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001A6B7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 100FF102: __wfsopen.LIBCMT ref: 100FF10F

_strerror.LIBCMT ref: 1001A703

Part of subcall function 100FEEE4: __getptd_noexit.LIBCMT ref: 100FEEEB

Part of subcall function 1001A4C8: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,?,00000000,00000000,1001A712,00000000,00000000,?,00000001), ref: 1001A4F7

_fseek.LIBCMT ref: 1001A743
_ftell.LIBCMT ref: 1001A749
_fseek.LIBCMT ref: 1001A754
__fread_nolock.LIBCMT ref: 1001A77D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 1001A79D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1001A7B5

Part of subcall function 100FEFF3: __getptd_noexit.LIBCMT ref: 100FEFF3

Strings

%s%d bytes to %d wide chars, xrefs: 1001A7DD

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ByteCharMultiWide$__getptd_noexit_fseek$__fread_nolock__wfsopen_ftell_strerror
String ID: %s%d bytes to %d wide chars
API String ID: 224267593-3229567857
Opcode ID: 2f460f9a4f361287decf1effb23991693e94526e3911f97e8ab0a666c0038544
Instruction ID: 8157987604a49ed5f071c8ab1962bfbd5f674b2ad3b575bb460f2ded5258bcb0
Opcode Fuzzy Hash: 2f460f9a4f361287decf1effb23991693e94526e3911f97e8ab0a666c0038544
Instruction Fuzzy Hash: B6414876D0511CBFCF05DFA4EC81CAEBBBAFF49750B14002AF504A7251DA31AD829B61

Uniqueness

Uniqueness Score: -1.00%

Function 10005B3C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 108COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,00000000), ref: 10005BC9
GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,?), ref: 10005BFA
GetPrivateProfileStringW.KERNEL32(?,?,10117AB8,?,?,?), ref: 10005C10

Strings

%s_%d, xrefs: 10005B9E
IniFile, xrefs: 10005B68
%s_1033, xrefs: 10005BDB
SecFile, xrefs: 10005C18
Main, xrefs: 10005B54

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: PrivateProfileString
String ID: %s_%d$%s_1033$IniFile$Main$SecFile
API String ID: 1096422788-666282893
Opcode ID: 1d0fb75df33c09ff27312182fa85c42c25ba8d939e94f9cac8544ea9adf4742a
Instruction ID: 157608d854fbaaf1186db0ebfa221027625baf486713a2ce64dffa17af371fea
Opcode Fuzzy Hash: 1d0fb75df33c09ff27312182fa85c42c25ba8d939e94f9cac8544ea9adf4742a
Instruction Fuzzy Hash: 2D313876D0020DAEEF21DFA4DC40DEE7BF9FF08290F144415FA20A6161E736A890DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10057960 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,10057C00), ref: 10057988
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 10057998
GetProcessWindowStation.USER32(?,?,?,?,10057C00), ref: 100579B0
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,?,?,10057C00), ref: 100579CB
GetLastError.KERNEL32(?,?,?,10057C00,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100579D9
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,?,?,10057C00), ref: 10057A12

Strings

Service-0x, xrefs: 10057A2A
_OPENSSL_isservice, xrefs: 10057992

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1944374717-1672312481
Opcode ID: a49f404c94c84005c6d648582736c78a5fc8f0c4d771ac87460608f3cace5262
Instruction ID: 7329ec034df64e4fabd69b0967891a2ce66e02dc0840a5511f181ec02f35a696
Opcode Fuzzy Hash: a49f404c94c84005c6d648582736c78a5fc8f0c4d771ac87460608f3cace5262
Instruction Fuzzy Hash: 2A312731A00109ABCB10CFB8DC85B9EB7B8FF84361F504225F829D32D0EF349A058791

Uniqueness

Uniqueness Score: -1.00%

Function 1000445F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32(00000000,?,00000100), ref: 1000449E
GlobalDeleteAtom.KERNEL32(00000000), ref: 100044C2
GetLastError.KERNEL32 ref: 100044CA
DefWindowProcW.USER32(?,?,?,?), ref: 10004581

Strings

AIL:GlobalGetAtomName err=%d, xrefs: 100044D1
AIL:SetRange err! Value <= 0, xrefs: 10004566
AIL:SetCloseStatus(0x%x), xrefs: 1000451B
AIL:Unknown CS message! (%d), xrefs: 10004505

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AtomGlobal$DeleteErrorLastNameProcWindow
String ID: AIL:GlobalGetAtomName err=%d$AIL:SetCloseStatus(0x%x)$AIL:SetRange err! Value <= 0$AIL:Unknown CS message! (%d)
API String ID: 4216289527-3728385300
Opcode ID: 03960d9e454cc36311a7933d660b0ec914c92628270a48c46b74bf19206cb4ea
Instruction ID: 89ea5552a64107bc2a61bc7bc0b77b682d316ca4232e3ef5741d033c0897cf98
Opcode Fuzzy Hash: 03960d9e454cc36311a7933d660b0ec914c92628270a48c46b74bf19206cb4ea
Instruction Fuzzy Hash: 6D31E4B5500219AFEB14DF64DDC6F9A33A8FB083C1F114025FD01A65A9DF34E990DB65

Uniqueness

Uniqueness Score: -1.00%

Function 10018253 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 90COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10018278

Part of subcall function 100149E0: RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,?,?,00000104,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A0D
Part of subcall function 100149E0: RegQueryValueExW.ADVAPI32(?,00000020,00000000,00000000,?,0000003E,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A2E
Part of subcall function 100149E0: RegCloseKey.ADVAPI32(?,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A39

Part of subcall function 100FB77E: __wcstoi64.LIBCMT ref: 100FB774

Strings

3.02, xrefs: 100182D4
Build, xrefs: 100182A9
3.01, xrefs: 100182E5
Version, xrefs: 10018283
Software\Microsoft\Internet Explorer, xrefs: 10018288, 1001828D, 100182AE
AIL:IEVer=%s, xrefs: 10018311
AIL:IE is not installed, xrefs: 10018343

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CloseOpenQueryValue__wcstoi64_memset
String ID: 3.01$3.02$AIL:IE is not installed$AIL:IEVer=%s$Build$Software\Microsoft\Internet Explorer$Version
API String ID: 3134606865-3052296871
Opcode ID: 843b883747ad517dc6e3f4e5a5903b44fc8aa2e471b1989037ca2656daff1475
Instruction ID: 6c0696885d9af558cae00f7949054e10006b8c93fdbf3f82cec661d7231e541c
Opcode Fuzzy Hash: 843b883747ad517dc6e3f4e5a5903b44fc8aa2e471b1989037ca2656daff1475
Instruction Fuzzy Hash: 3721A479A0020CABDB11DAA4DD46EDF73BCDF54740F604026F905FA181EB78EB859751

Uniqueness

Uniqueness Score: -1.00%

Function 1001806F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10018076

Part of subcall function 100149E0: RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,?,?,00000104,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A0D
Part of subcall function 100149E0: RegQueryValueExW.ADVAPI32(?,00000020,00000000,00000000,?,0000003E,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A2E
Part of subcall function 100149E0: RegCloseKey.ADVAPI32(?,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A39

IsCharAlphaW.USER32(00000000,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 100180D6
SetLastError.KERNEL32(00000000,?,?,?,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 1001810C
SetLastError.KERNEL32(0000000D,?,?,?,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir,?,?,WinSysDir,?), ref: 1001814B

Strings

AIL:GetProgramFilesDir err=%d, xrefs: 100180FC, 1001813A
ProgramFilesDir, xrefs: 10018098
Program Files, xrefs: 100180E0
Software\Microsoft\Windows\CurrentVersion, xrefs: 1001809D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AlphaCharCloseH_prolog3OpenQueryValue
String ID: AIL:GetProgramFilesDir err=%d$Program Files$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 524507275-3091199278
Opcode ID: 5833f969153387496ec8b1fed1bc502ffa515a2af07ff8c46ac57aeaa9e2261a
Instruction ID: 1662e45635a4ef41b43d37741047bbf934be98de843756ece8b89a11ba6511db
Opcode Fuzzy Hash: 5833f969153387496ec8b1fed1bc502ffa515a2af07ff8c46ac57aeaa9e2261a
Instruction Fuzzy Hash: D221387A90065977C755D7B04C46E9F36A8EF052A0F214205F864AF1C1EB34DBC197A1

Uniqueness

Uniqueness Score: -1.00%

Function 100159A6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,?,?,?,?,10015B04,?,?,?,?,?,?,77134670), ref: 100159B2
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,?,?,?,?,?,?,10015B04,?,?,?,?), ref: 100159CC
GetModuleHandleW.KERNEL32(advapi32.dll,SetSecurityDescriptorControl,00000000,?,?,?,?,?,10015B04,?,?,?,?,?,?,77134670), ref: 100159E1
GetProcAddress.KERNEL32(00000000), ref: 100159E8
GetSecurityDescriptorControl.ADVAPI32(?,00000000,00000000,?,?,?,?,?), ref: 10015A07
SetFileSecurityW.ADVAPI32(10015B04,00000004,?,?,?,?,?,?,10015B04,?,?,?,?,?,?,77134670), ref: 10015A3A

Strings

SetSecurityDescriptorControl, xrefs: 100159D7
advapi32.dll, xrefs: 100159DC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Security$Descriptor$AddressControlDaclFileHandleInitializeModuleProc
String ID: SetSecurityDescriptorControl$advapi32.dll
API String ID: 2675953346-2156841575
Opcode ID: 636bd81d11abb9ba134a25b58b77cb9838a8fcb42c7d6564535f5128c0b1f861
Instruction ID: 7ff75402f60d19cdd5d123ee571b383784fb82eb2a2e6c05b90484275e7d58f3
Opcode Fuzzy Hash: 636bd81d11abb9ba134a25b58b77cb9838a8fcb42c7d6564535f5128c0b1f861
Instruction Fuzzy Hash: A4112872A40219EBDB01DBA0CD88BEF7BBCEB04346F048151F901EA194E779CA44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1001875C Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

AhnIEx_IsWinNTOrLater.AHNIEX(00080000,00000000,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 10018763

Part of subcall function 1001866F: AhnIEx_GetOS.AHNIEX(10018768,00080000,00000000,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 10018678
Part of subcall function 1001866F: AhnIEx_IsWinNT.AHNIEX(10018768,00080000,00000000,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 1001867D

GetModuleHandleW.KERNEL32(Kernel32,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 10018773
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 10018783
GetLastError.KERNEL32(101728B8), ref: 100187A5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,InstallInfo:Init), ref: 100187AC

Strings

AIL:GetSysWow64Dir err=%d, xrefs: 100187AF
GetSystemWow64DirectoryW, xrefs: 1001877D
Kernel32, xrefs: 1001876E

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressHandleLaterModuleProc
String ID: AIL:GetSysWow64Dir err=%d$GetSystemWow64DirectoryW$Kernel32
API String ID: 1297769102-1074070451
Opcode ID: faa71b39481cb33608ada5a4b095bd1b02273988e3dc57b75b79fca88c8460d9
Instruction ID: ef9a331cea53cd6064b37bf0713ff386c9d3525303807d71fdc33325aab28f1c
Opcode Fuzzy Hash: faa71b39481cb33608ada5a4b095bd1b02273988e3dc57b75b79fca88c8460d9
Instruction Fuzzy Hash: 3EF0AF357082126AEB45A774AC81F1B26E8EF80AD1F35442AF408DA5E0EB34CBC0C762

Uniqueness

Uniqueness Score: -1.00%

Function 1001DA38 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001DAA2
__fread_nolock.LIBCMT ref: 1001DAB5
_memcmp.LIBCMT ref: 1001DAD9
_fseek.LIBCMT ref: 1001DB1A
__fread_nolock.LIBCMT ref: 1001DB2E
_memcmp.LIBCMT ref: 1001DB45
__fread_nolock.LIBCMT ref: 1001DB5D
__fread_nolock.LIBCMT ref: 1001DB75
__fread_nolock.LIBCMT ref: 1001DBAB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __fread_nolock$_memcmp$_fseek_memset
String ID:
API String ID: 504473203-0
Opcode ID: c8c83b19fa988cc94b8e434f71b78ae1e364e7bb14764b3f254604807adba21f
Instruction ID: 9f629933e790ebf18ea0063997cff10bf0f77cbfbcdfd84cde5d1ea2e72cfaea
Opcode Fuzzy Hash: c8c83b19fa988cc94b8e434f71b78ae1e364e7bb14764b3f254604807adba21f
Instruction Fuzzy Hash: 8A412771A08259A7EF30F6A48C81FEE36ACDF44791F400427FD56DA142E630DE80DB62

Uniqueness

Uniqueness Score: -1.00%

Function 10015756 Relevance: 13.5, APIs: 9, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,10015732), ref: 10015767
HeapFree.KERNEL32(00000000), ref: 1001576E
FreeSid.ADVAPI32(00000000,10015732), ref: 10015776
GetProcessHeap.KERNEL32(00000000,00000000,10015732), ref: 10015787
HeapFree.KERNEL32(00000000), ref: 1001578E
GetProcessHeap.KERNEL32(00000000,00000000,10015732), ref: 1001579F
HeapFree.KERNEL32(00000000), ref: 100157A6
GetProcessHeap.KERNEL32(00000000,00000000,10015732), ref: 100157B7
HeapFree.KERNEL32(00000000), ref: 100157BE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Heap$Free$Process
String ID:
API String ID: 2719409998-0
Opcode ID: 7308d1678358b9e02739ee9b6d21200867185911eea38af0232a0ea2c1057401
Instruction ID: 6210b0a3023f2a81668cb8d6a272dac950c9e227d1b8bd734d2b6ec1e30565b3
Opcode Fuzzy Hash: 7308d1678358b9e02739ee9b6d21200867185911eea38af0232a0ea2c1057401
Instruction Fuzzy Hash: 55010D31844354EFDB459BF0DE8DB9D7A76BB0D747F148014F206A95E887794484DB21

Uniqueness

Uniqueness Score: -1.00%

Function 10063120 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 203COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1006321C
_strncmp.LIBCMT ref: 10063275
_strncmp.LIBCMT ref: 10063304
_strncmp.LIBCMT ref: 1006331A

Strings

-----END , xrefs: 10063216, 1006326F
-----, xrefs: 10063312
..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c, xrefs: 10063156, 1006316C, 10063189, 10063354, 10063378, 1006339A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strncmp
String ID: -----$-----END $..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c
API String ID: 909875538-2631736234
Opcode ID: ebc85554f926964614321c80216839d5fd5765af1a713c095aa9891e634db8e7
Instruction ID: 628499d495a1d8adb71dcea5b7e2dcefaa31cf6a3e10c473100776d145883268
Opcode Fuzzy Hash: ebc85554f926964614321c80216839d5fd5765af1a713c095aa9891e634db8e7
Instruction Fuzzy Hash: 0D5116B1A44342ABE310CE148C42B1B73D6EB81759F45852DFD846F3C2EBB9DA4886D3

Uniqueness

Uniqueness Score: -1.00%

Function 100F1AC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_fputs.LIBCMT ref: 100F1AF6
_fputs.LIBCMT ref: 100F1B0F

Part of subcall function 10102DF1: __fileno.LIBCMT ref: 10102E40
Part of subcall function 10102DF1: _strlen.LIBCMT ref: 10102EA1
Part of subcall function 10102DF1: __lock_file.LIBCMT ref: 10102EAA
Part of subcall function 10102DF1: __stbuf.LIBCMT ref: 10102EB5
Part of subcall function 10102DF1: __ftbuf.LIBCMT ref: 10102ECF

Part of subcall function 10101027: _flsall.LIBCMT ref: 1010103B

Part of subcall function 100F17F0: GetStdHandle.KERNEL32(000000F6,00000000), ref: 100F1867
Part of subcall function 100F17F0: SetConsoleMode.KERNEL32(00000000), ref: 100F186E
Part of subcall function 100F17F0: GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000), ref: 100F1895
Part of subcall function 100F17F0: GetStdHandle.KERNEL32(000000F6,?,000001FF,?,00000000), ref: 100F18B8
Part of subcall function 100F17F0: ReadConsoleW.KERNEL32(00000000), ref: 100F18BF
Part of subcall function 100F17F0: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000200,00000000,00000000), ref: 100F1924
Part of subcall function 100F17F0: _feof.LIBCMT ref: 100F19BC
Part of subcall function 100F17F0: _ferror.LIBCMT ref: 100F19CF

_fprintf.LIBCMT ref: 100F1B57
_fprintf.LIBCMT ref: 100F1BD7
_fputs.LIBCMT ref: 100F1C08

Strings

Verifying - %s, xrefs: 100F1B51
Verify failure, xrefs: 100F1BD1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _fputs$ConsoleHandle_fprintf$ByteCharEnvironmentModeMultiReadVariableWide__fileno__ftbuf__lock_file__stbuf_feof_ferror_flsall_strlen
String ID: Verify failure$Verifying - %s
API String ID: 462626250-2434124770
Opcode ID: 5357ae43ec2d6e4283b1a9e506f356da9e3b9fe3e1a37904625bef24c364d03c
Instruction ID: b8b6d3889208fc6ccc9673625c8cc9827a26787c2f0379f4b4e2278ed0d36c95
Opcode Fuzzy Hash: 5357ae43ec2d6e4283b1a9e506f356da9e3b9fe3e1a37904625bef24c364d03c
Instruction Fuzzy Hash: 6031F8BBA0016067C200D7B4AC52EDF3399CFE2155F444564F8448720AFA2FFA9693E2

Uniqueness

Uniqueness Score: -1.00%

Function 10003BED Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 112timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10003C0C
_memset.LIBCMT ref: 10003C3C

Part of subcall function 10014D08: RegOpenKeyExW.ADVAPI32(?,00000400,00000000,?,?,?,?,?,10001F07,?,?,?,00000400,?), ref: 10014D22
Part of subcall function 10014D08: RegCloseKey.ADVAPI32(?,?,?,?,10001F07,?,?,?,00000400,?), ref: 10014D31

GetLocalTime.KERNEL32(?,00000001,?,?,0000001C), ref: 10003CAA

Part of subcall function 10014C86: RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000400,?,?,10001EBC,?,?,?,?,00000400,?,?), ref: 10014CA0
Part of subcall function 10014C86: RegDeleteValueW.ADVAPI32(?,?,?,?,10001EBC,?,?,?,?,00000400,?,?,00000400,?), ref: 10014CB2
Part of subcall function 10014C86: RegCloseKey.ADVAPI32(?,?,?,10001EBC,?,?,?,?,00000400,?,?,00000400,?), ref: 10014CBD

Strings

\RebootRequest, xrefs: 10003CEF
\RebootPredict, xrefs: 10003D1B
Software\Ahnlab\APC2\Policy Agent, xrefs: 10003C20
%02d-%02d-%04d/%02d:%02d:%02d.%02d;%s, xrefs: 10003CD4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CloseOpen$DeleteH_prolog3LocalTimeValue_memset
String ID: %02d-%02d-%04d/%02d:%02d:%02d.%02d;%s$Software\Ahnlab\APC2\Policy Agent$\RebootPredict$\RebootRequest
API String ID: 833895815-1391522046
Opcode ID: fc2cd8ab3d4b026fab6c4468a578fb0a8eebb4edbdc224e91280cd2afd78e78b
Instruction ID: bb270d04078f9333466fe86e6edaf3fdfb7f88f1a0a9be1c8e0676045eb6f066
Opcode Fuzzy Hash: fc2cd8ab3d4b026fab6c4468a578fb0a8eebb4edbdc224e91280cd2afd78e78b
Instruction Fuzzy Hash: 36415F76900159AADB64DFA49C41FFE77FCFB08740F548016FA44EB180EB78AA44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10018168 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1001816F

Part of subcall function 100149E0: RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,?,?,00000104,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A0D
Part of subcall function 100149E0: RegQueryValueExW.ADVAPI32(?,00000020,00000000,00000000,?,0000003E,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A2E
Part of subcall function 100149E0: RegCloseKey.ADVAPI32(?,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A39

SetLastError.KERNEL32(00000000,?,?,?,?,?,?,00000001,ProgramFilesDir,?,ProgramFilesDir,?,?,ProgramFilesx86Dir,?), ref: 100181F7
SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,00000001,ProgramFilesDir,?,ProgramFilesDir,?,?,ProgramFilesx86Dir,?), ref: 10018236

Strings

AIL:GetCommonFilesDir err=%d, xrefs: 100181E7, 10018225
CommonFilesDir, xrefs: 10018190
Common Files, xrefs: 100181D2
Software\Microsoft\Windows\CurrentVersion, xrefs: 10018195

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$CloseH_prolog3OpenQueryValue
String ID: AIL:GetCommonFilesDir err=%d$Common Files$CommonFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3141320994-1275476746
Opcode ID: 7874f3857aafadf00a46a2020b5f2fa3f6aaadb4c3241211d6f64db952945bcf
Instruction ID: e095338553f506aa6d3d69f3e3a1bf4d997c6e8c3df556f22708447cf9afd1e7
Opcode Fuzzy Hash: 7874f3857aafadf00a46a2020b5f2fa3f6aaadb4c3241211d6f64db952945bcf
Instruction Fuzzy Hash: FB21D03A900219B7CB12DAB04C46F9E3B64EB056A0F154214FC247E192DB74DB9197A1

Uniqueness

Uniqueness Score: -1.00%

Function 10017A6E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 33libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 10017A7D
GetModuleHandleW.KERNEL32(ntdll,1000A7FA,InstallInfo:Init,00000018), ref: 10017A8C
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 10017A9C
GetVersionExW.KERNEL32(?), ref: 10017AB2
GetVersionExW.KERNEL32(?), ref: 10017ABF

Strings

ntdll, xrefs: 10017A85
RtlGetVersion, xrefs: 10017A96

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Version$AddressHandleModuleProc_memset
String ID: RtlGetVersion$ntdll
API String ID: 3011030232-2582309562
Opcode ID: 12e1eb270409238823f72cf7cac6e30849e62cdf8999d9b4f281580b8f22c50d
Instruction ID: 1f53c8f4ac39faac9195749a067b468c759f092ceab95e8b8c2ce4de143c510e
Opcode Fuzzy Hash: 12e1eb270409238823f72cf7cac6e30849e62cdf8999d9b4f281580b8f22c50d
Instruction Fuzzy Hash: FFF0A0753001227AD600AB219C40ECF2ABCEFC1780B154824F504E7240E778D9828BB2

Uniqueness

Uniqueness Score: -1.00%

Function 1001801D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.DLL,1000A8A9,?,00000400,00000003,Tick=%d:%02d:%02d,00000000,00000000,00000000), ref: 10018022
GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 10018032
GetLastError.KERNEL32(?,?,?,?,?,?,?,InstallInfo:Init,00000018), ref: 1001804A
GetWindowsDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,InstallInfo:Init,00000018), ref: 10018068

Strings

AIL:GetSystemWindowsDirectory err=%d, xrefs: 10018051
GetSystemWindowsDirectoryW, xrefs: 1001802C
Kernel32.DLL, xrefs: 1001801D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressDirectoryErrorHandleLastModuleProcWindows
String ID: AIL:GetSystemWindowsDirectory err=%d$GetSystemWindowsDirectoryW$Kernel32.DLL
API String ID: 1879384420-2719261695
Opcode ID: 6c4469efc5ba792932af6c2926dd1c727878a3bdb51e12a66916fe9bccf1d32c
Instruction ID: d5bb36c4b59004b60100621f55d41d258090941d7035d910d1df70405a67550d
Opcode Fuzzy Hash: 6c4469efc5ba792932af6c2926dd1c727878a3bdb51e12a66916fe9bccf1d32c
Instruction Fuzzy Hash: 6DE09A78344216BFDA16ABB0CD48B5E7EB9FF882C0F008028F409D4531EB38C6A4DB12

Uniqueness

Uniqueness Score: -1.00%

Function 1007E1C0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1007E214

Strings

localhost/, xrefs: 1007E225
..\..\Src\openssl-1.1.1n\crypto\store\loader_file.c, xrefs: 1007E2CC, 1007E2F6, 1007E320, 1007E356, 1007E370, 1007E3A3, 1007E3EF
-----BEGIN , xrefs: 1007E4BF
file:, xrefs: 1007E1EA

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strncmp
String ID: -----BEGIN $..\..\Src\openssl-1.1.1n\crypto\store\loader_file.c$file:$localhost/
API String ID: 909875538-3418085491
Opcode ID: 248672f47b4783eff9d7ca35028e3b34aaa6f60740916453d7ff87a509fe3bcd
Instruction ID: 86f61c42b1e283c44bfea6e98d6284a3f18699f5d17aa2765274c6f0f2147cd2
Opcode Fuzzy Hash: 248672f47b4783eff9d7ca35028e3b34aaa6f60740916453d7ff87a509fe3bcd
Instruction Fuzzy Hash: 5F811B75A457C1ABE330DB609C06B6B73D9DB88740F108928F9849A1C3F7B9BD0487A7

Uniqueness

Uniqueness Score: -1.00%

Function 100090AC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 182stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100090CB
lstrcmpiW.KERNEL32(00000020,101700B8,?,?,?,?,?,?,?,?,?,?,?,?,AIL:VerifyStartMenu,00000008), ref: 10009246

Strings

AIL:VerifyStartMenu, xrefs: 100090DC
Dir=%s, xrefs: 1000912C
%*?|<>/":, xrefs: 100091A2
StartMenuDir, xrefs: 1000911E

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3lstrcmpi
String ID: %*?|<>/":$AIL:VerifyStartMenu$Dir=%s$StartMenuDir
API String ID: 3784267105-888691891
Opcode ID: e25c87b5eff9515188f7ea1bebfc47011454fbde23763ff07b23f46d442c5c15
Instruction ID: 84c69d12f89e94579c5c2a3175cdd01cfa2c18cfba6d3f7d9fb1f0d097ddece8
Opcode Fuzzy Hash: e25c87b5eff9515188f7ea1bebfc47011454fbde23763ff07b23f46d442c5c15
Instruction Fuzzy Hash: B25170B6A00249BBEB30EFA08C85ADE33B9EB053D0F114115F914AB1C5EB74AEC4C751

Uniqueness

Uniqueness Score: -1.00%

Function 10015A43 Relevance: 10.6, APIs: 7, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10015A73
_wcsrchr.LIBCMT ref: 10015A99

Part of subcall function 10015B47: GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,?,00000000,?), ref: 10015BB1
Part of subcall function 10015B47: GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 10015BDB
Part of subcall function 10015B47: GetLastError.KERNEL32 ref: 10015BFA
Part of subcall function 10015B47: GetLastError.KERNEL32(?,00000000,?), ref: 10015DE7
Part of subcall function 10015B47: GetProcessHeap.KERNEL32(00000000,?), ref: 10015DF4
Part of subcall function 10015B47: HeapFree.KERNEL32(00000000), ref: 10015DFB
Part of subcall function 10015B47: FreeSid.ADVAPI32(?), ref: 10015E09
Part of subcall function 10015B47: SetLastError.KERNEL32(00000000), ref: 10015E10

Part of subcall function 10015912: GetFileSecurityW.ADVAPI32(00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,10015B91,?,00000004,?,?,00000000), ref: 10015930
Part of subcall function 10015912: GetLastError.KERNEL32(?,10015B91,?,00000004,?,?,00000000,?), ref: 10015938

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,?,00000104,?,?,?,77134670), ref: 10015AE4

Part of subcall function 100159A6: InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,?,?,?,?,10015B04,?,?,?,?,?,?,77134670), ref: 100159B2

GetLastError.KERNEL32(?,00000104,?,?,?,77134670), ref: 10015B0A
GetProcessHeap.KERNEL32(00000000,?,?,?,77134670), ref: 10015B19
HeapFree.KERNEL32(00000000,?,?,77134670), ref: 10015B20
SetLastError.KERNEL32(00000000,?,?,77134670), ref: 10015B27

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$HeapSecurity$DescriptorFree$DaclProcess$FileInformationInitialize_memset_wcsrchr
String ID:
API String ID: 760667562-0
Opcode ID: 6f54c6add25898f4cc12ee2933237bfd857ba718472a73614caf3075dd56b246
Instruction ID: 0166962a9db9888b2df21836bb96f1736e4e23415e67fb95d7c790978ea4bf7a
Opcode Fuzzy Hash: 6f54c6add25898f4cc12ee2933237bfd857ba718472a73614caf3075dd56b246
Instruction Fuzzy Hash: 9C315876D00609ABEB21DBB4CC85EDEB7BCEF08711F14452AF914EB181EB35A5448B61

Uniqueness

Uniqueness Score: -1.00%

Function 1000F8A5 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

_memset.LIBCMT ref: 1000F8D8

Strings

false, xrefs: 1000F94D
UserName, xrefs: 1000F8DD
UserDepartment, xrefs: 1000F912
true, xrefs: 1000F946
UserOrganization, xrefs: 1000F8FA

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal_memset
String ID: UserDepartment$UserName$UserOrganization$false$true
API String ID: 3311673658-1157669350
Opcode ID: fe4d14cc125492b3f3b9f60e22b549df0a5db456c8f88b01585e486e75bb6de0
Instruction ID: 450da50942bba9f2b45c6f92ae01b64aefe219b1f65ebfea38a26b746fd9ea54
Opcode Fuzzy Hash: fe4d14cc125492b3f3b9f60e22b549df0a5db456c8f88b01585e486e75bb6de0
Instruction Fuzzy Hash: 2C119876B012187BDB10EBB48C46FCB77ACDF8A250F408465B904F7145DE39FA948B62

Uniqueness

Uniqueness Score: -1.00%

Function 10006729 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10006730
AhnIEx_SetError.AHNIEX(32810102,00000001,AIL:CreateArchivedFileList err=out of memory,?,00000008,1000342A,?,?,00000040,?), ref: 10006759
AhnIEx_SetError.AHNIEX(32810102,00000001,AIL:CreateArchivedFileList err=out of memory,?,?,00000004,?,00000008,1000342A,?,?,00000040,?), ref: 100067C9

Strings

AIL:CreateArchivedFileList(%s)=ok, xrefs: 100067E6
AIL:Cannot create a ArchivedFileList when that list already exists., xrefs: 10006748
AIL:CreateArchivedFileList err=out of memory, xrefs: 10006791, 100067B8

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Error$H_prolog3
String ID: AIL:Cannot create a ArchivedFileList when that list already exists.$AIL:CreateArchivedFileList err=out of memory$AIL:CreateArchivedFileList(%s)=ok
API String ID: 3129165583-3504704905
Opcode ID: 1482033aa728bb684f61374741ae0f7118e2e5b4a9d6ee1190c0825d0e6ceb9d
Instruction ID: ea4e33b31d7701127590437a0d9fe5fa71322d70dc3d6abb1b2f99ad37302cc3
Opcode Fuzzy Hash: 1482033aa728bb684f61374741ae0f7118e2e5b4a9d6ee1190c0825d0e6ceb9d
Instruction Fuzzy Hash: FF11B978744206BBFF04EBB48D46B9D36A6EF083C4F200064FD19EE1CADF79A9415A91

Uniqueness

Uniqueness Score: -1.00%

Function 10016242 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Shell32.dll,101728B8,00000000,?,1000AE8C,10167FFC,?,00000400,CommonAppData,?,TempDir,?,?,CommonFilesx86Dir,?), ref: 1001624C
GetLastError.KERNEL32(?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?,?,ProgramFilesx86Dir,?,?,ProgramFiles64Dir), ref: 10016256
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 10016274
CoTaskMemFree.OLE32(?,?,?,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?), ref: 100162A8

Strings

SHGetKnownFolderPath, xrefs: 1001626E
Shell32.dll, xrefs: 10016247

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressErrorFreeHandleLastModuleProcTask
String ID: SHGetKnownFolderPath$Shell32.dll
API String ID: 3421084371-677601484
Opcode ID: ffc08e5046b064abc539a1d7f4a79a37d48a05ebae3d0a39991b95b2784bb5fe
Instruction ID: 156fd4f2f8da7d04dce3bb1abc790e3575a0186519cff32bc7c0b335c694a5dd
Opcode Fuzzy Hash: ffc08e5046b064abc539a1d7f4a79a37d48a05ebae3d0a39991b95b2784bb5fe
Instruction Fuzzy Hash: CCF02832A00527BBDB219FA0DD05B8E3BA9FF082D0F114124FD01F9260E779DD50A780

Uniqueness

Uniqueness Score: -1.00%

Function 10003D5E Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 38COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,100042C0,?,?,?,?,?,?,?,?,?,?,CAmbass:Init,00000044), ref: 10003DB3
GetLastError.KERNEL32(?,100042C0,?,?,?,?,?,?,?,?,?,?,CAmbass:Init,00000044), ref: 10003DBD

Part of subcall function 100FAADF: CreateFileW.KERNEL32(1017A5D8,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 100FAB67
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 100FAB91
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000036,?,00000000), ref: 100FABB5
Part of subcall function 100FAADF: __wcsnicmp.LIBCMT ref: 100FABD7
Part of subcall function 100FAADF: SetFilePointer.KERNEL32(00000000,0000006E,00000000,00000000), ref: 100FAC8E

Strings

AIL:CAmbass:Free, xrefs: 10003D9F
AIL:CAmbass Finalize, xrefs: 10003D73
AIL:CAmbass Free err=%d, xrefs: 10003DC4
AIL:CAmbass Finalize Failed=%x, xrefs: 10003D89

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: File$Read$CreateErrorFreeLastLibraryPointer__wcsnicmp
String ID: AIL:CAmbass Finalize$AIL:CAmbass Finalize Failed=%x$AIL:CAmbass Free err=%d$AIL:CAmbass:Free
API String ID: 3078990119-2529516173
Opcode ID: 58a80eacbdce030567a176bdceb7f740a6ee8ef978d2d79e494d7980494ce9d1
Instruction ID: 39faf78b9e4ee36d57642ccce970184db52674649be65f9605abd11c63fb4ce8
Opcode Fuzzy Hash: 58a80eacbdce030567a176bdceb7f740a6ee8ef978d2d79e494d7980494ce9d1
Instruction Fuzzy Hash: E2F09671600312AFF2559730AD4BB9773ECFB10692F14842EF18A985D5EFB468C8A751

Uniqueness

Uniqueness Score: -1.00%

Function 1001D2C5 Relevance: 9.2, APIs: 6, Instructions: 224fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001D34D
_memset.LIBCMT ref: 1001D35C
_wcslen.LIBCMT ref: 1001D394
_memset.LIBCMT ref: 1001D3E4
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,00000104,?,?,?,?,10177A78,?,00000000), ref: 1001D42F
CloseHandle.KERNEL32(?,?,00000104,?,?,?,?,10177A78,?,00000000), ref: 1001D4B7

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset$CloseCreateFileHandle_wcslen
String ID:
API String ID: 2252355207-0
Opcode ID: 53accfca37d82fafc13dff5d147b56890baa827b7e806287a420e2791a1e7c57
Instruction ID: 972151490c85736d1d713119fc9a7f0c97b59db6975b4f522d02f31b8e1e4247
Opcode Fuzzy Hash: 53accfca37d82fafc13dff5d147b56890baa827b7e806287a420e2791a1e7c57
Instruction Fuzzy Hash: BE8160B1D0060E9FDF14EF98C885ADEBBB5EB08304F20056BE515FB251E770AA849B55

Uniqueness

Uniqueness Score: -1.00%

Function 1001F14E Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

__localtime64.LIBCMT ref: 1001F182

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __localtime64
String ID:
API String ID: 194189394-0
Opcode ID: d26aaac669a73044ee2c7664c3013eb7f6e971d1da547f84b3fb11d846a1baf8
Instruction ID: 3d77d8119b0f60664f4565768c7fd6ba888242ca6e708f6b15d1ca29b7eb1c28
Opcode Fuzzy Hash: d26aaac669a73044ee2c7664c3013eb7f6e971d1da547f84b3fb11d846a1baf8
Instruction Fuzzy Hash: C7417376E00219EBCB51DAA8C8405EDB7F5EF65770F21839EE420EA195E770DEC18B50

Uniqueness

Uniqueness Score: -1.00%

Function 1000FE1C Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,true), ref: 1000FE9B

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

Strings

false, xrefs: 1000FECF
UserInfoTableIndex, xrefs: 1000FE78
TRUE, xrefs: 1000FE43, 1000FE4F
true, xrefs: 1000FE90, 1000FE95, 1000FEBD
%s_UserInfoTableIndex, xrefs: 1000FE54

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal_vswprintf_slstrcmpi
String ID: %s_UserInfoTableIndex$TRUE$UserInfoTableIndex$false$true
API String ID: 2231903529-3043465440
Opcode ID: 23cb2bf4d02cd2167028d851e68e50a1cc2059d12eae536722a91c3ab470c2d2
Instruction ID: 19e9bb8a68753450438d19c26e2e03a55cda54c0563791393054afd23e15eff9
Opcode Fuzzy Hash: 23cb2bf4d02cd2167028d851e68e50a1cc2059d12eae536722a91c3ab470c2d2
Instruction Fuzzy Hash: FF110D7BA00209B7EF14DA74DC46EBB33ECEB59290F10406AF904E7586EE79E9805661

Uniqueness

Uniqueness Score: -1.00%

Function 1010444B Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10104473

Part of subcall function 100FB3DC: __getptd.LIBCMT ref: 100FB3EA
Part of subcall function 100FB3DC: __getptd.LIBCMT ref: 100FB3F8

__getptd.LIBCMT ref: 1010447D

Part of subcall function 1010506B: __getptd_noexit.LIBCMT ref: 1010506E
Part of subcall function 1010506B: __amsg_exit.LIBCMT ref: 1010507B

__getptd.LIBCMT ref: 1010448B
__getptd.LIBCMT ref: 10104499
__getptd.LIBCMT ref: 101044A4
_CallCatchBlock2.LIBCMT ref: 101044CA

Part of subcall function 100FB481: __CallSettingFrame@12.LIBCMT ref: 100FB4CD

Part of subcall function 10104571: __getptd.LIBCMT ref: 10104580
Part of subcall function 10104571: __getptd.LIBCMT ref: 1010458E

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: d6297adb63e55b53a9156c03d1fc3120ad6ad359a218d2a8836a87d6040aff67
Instruction ID: ec9197ad1554037a9485f916df8296cc22b7bd5858103babbc56cad846cbd21a
Opcode Fuzzy Hash: d6297adb63e55b53a9156c03d1fc3120ad6ad359a218d2a8836a87d6040aff67
Instruction Fuzzy Hash: 1011F8B5D00609DFDF00DFA4D986AEE7BB0FF08314F14806AF854AB255DB39AA119F60

Uniqueness

Uniqueness Score: -1.00%

Function 100F1700 Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

_signal.LIBCMT ref: 100F1708

Part of subcall function 10101D4C: __getptd_noexit.LIBCMT ref: 10101DB6
Part of subcall function 10101D4C: __malloc_crt.LIBCMT ref: 10101DD5
Part of subcall function 10101D4C: _siglookup.LIBCMT ref: 10101DFB

_signal.LIBCMT ref: 100F1716

Part of subcall function 10101D4C: __lock.LIBCMT ref: 10101E40
Part of subcall function 10101D4C: SetConsoleCtrlHandler.KERNEL32(10101C6D,00000001,?,?,?,?,1016B5D0,00000010,100F170D,00000016,00000000), ref: 10101E63
Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101EAF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EBD

_signal.LIBCMT ref: 100F1724

Part of subcall function 10101D4C: GetLastError.KERNEL32(?,?,?,?,1016B5D0,00000010,100F170D,00000016,00000000), ref: 10101E7F
Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101ECF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EDD

_signal.LIBCMT ref: 100F1731

Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101EEF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EFD

_signal.LIBCMT ref: 100F173F

Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101F0F
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101F1D

_signal.LIBCMT ref: 100F174D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _signal$__decode_pointer__encode_pointer$ConsoleCtrlErrorHandlerLast__getptd_noexit__lock__malloc_crt_siglookup
String ID:
API String ID: 1354346430-0
Opcode ID: 25fae7e05a5a5ad36f43c72e6c99fc2702bf74be755e0f97a7d36ae7e7e723ff
Instruction ID: cc06bd711814f0d4239d699898c3229acaa56c87a50699aaed33d7284cb55cf8
Opcode Fuzzy Hash: 25fae7e05a5a5ad36f43c72e6c99fc2702bf74be755e0f97a7d36ae7e7e723ff
Instruction Fuzzy Hash: 48E052BA2A12206FE304A7D4CD8BFB63339E7D4B00F904208B6844E598DDAC68848765

Uniqueness

Uniqueness Score: -1.00%

Function 100F1780 Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

_signal.LIBCMT ref: 100F1787

Part of subcall function 10101D4C: __getptd_noexit.LIBCMT ref: 10101DB6
Part of subcall function 10101D4C: __malloc_crt.LIBCMT ref: 10101DD5
Part of subcall function 10101D4C: _siglookup.LIBCMT ref: 10101DFB

_signal.LIBCMT ref: 100F1798

Part of subcall function 10101D4C: __lock.LIBCMT ref: 10101E40
Part of subcall function 10101D4C: SetConsoleCtrlHandler.KERNEL32(10101C6D,00000001,?,?,?,?,1016B5D0,00000010,100F170D,00000016,00000000), ref: 10101E63
Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101EAF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EBD

_signal.LIBCMT ref: 100F17A9

Part of subcall function 10101D4C: GetLastError.KERNEL32(?,?,?,?,1016B5D0,00000010,100F170D,00000016,00000000), ref: 10101E7F
Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101ECF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EDD

_signal.LIBCMT ref: 100F17BA

Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101EEF
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101EFD

_signal.LIBCMT ref: 100F17CB

Part of subcall function 10101D4C: __decode_pointer.LIBCMT ref: 10101F0F
Part of subcall function 10101D4C: __encode_pointer.LIBCMT ref: 10101F1D

_signal.LIBCMT ref: 100F17DC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _signal$__decode_pointer__encode_pointer$ConsoleCtrlErrorHandlerLast__getptd_noexit__lock__malloc_crt_siglookup
String ID:
API String ID: 1354346430-0
Opcode ID: 3d24de704e2ad7b4024c970820e73b841fedb811ddf9dc22677b739320d74ba0
Instruction ID: d4c4313dd54d94af4d2fe801670d90436fdb324e9da3065feddf7976359c8de2
Opcode Fuzzy Hash: 3d24de704e2ad7b4024c970820e73b841fedb811ddf9dc22677b739320d74ba0
Instruction Fuzzy Hash: F9F059BDAA671867D700BBF04ECABC52A70E791740F500515F284EE599EB7E7080A704

Uniqueness

Uniqueness Score: -1.00%

Function 10098680 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 10098718

Strings

,name:, xrefs: 100987EC
section:, xrefs: 100987F2
..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_tlsf.c, xrefs: 1009869C, 100987AD, 100987C7
,value:, xrefs: 100987E6

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __wcstoi64
String ID: ,name:$,value:$..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_tlsf.c$section:
API String ID: 398114495-4192011146
Opcode ID: 6186e1045d58d129e6ed6ed16df7f90cde33be745fabff9f24826c7c97cf4257
Instruction ID: 73bb72b093157d62f2b2b5ffa46cba9ed6a42ffc872dfb41168ff28ffed095e6
Opcode Fuzzy Hash: 6186e1045d58d129e6ed6ed16df7f90cde33be745fabff9f24826c7c97cf4257
Instruction Fuzzy Hash: 70411D7AB04300ABE610D6649C82F6F72D9DB85659F550178FD4CEF382FA25ED0493E2

Uniqueness

Uniqueness Score: -1.00%

Function 100682F0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1006834A
_strncmp.LIBCMT ref: 1006836F

Strings

..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_ncons.c, xrefs: 10068423, 10068440
excluded, xrefs: 10068369
permitted, xrefs: 10068344

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_ncons.c$excluded$permitted
API String ID: 909875538-2689347365
Opcode ID: bb02a6f5da15f7c42d0448bf2ec20f6044180ca568e7e9225d1a1017adc5462e
Instruction ID: e5b481a9c01d8f14ee5d88d4ec662d449166e502a8a90b0fa7b2cfe2312f7504
Opcode Fuzzy Hash: bb02a6f5da15f7c42d0448bf2ec20f6044180ca568e7e9225d1a1017adc5462e
Instruction Fuzzy Hash: 374129F6A00305ABE310DA65DC82F6B33C5EB84654F054938FA49DB243FB69FA448763

Uniqueness

Uniqueness Score: -1.00%

Function 1001B79D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1001B7A4
_memset.LIBCMT ref: 1001B80A

Part of subcall function 1001A56B: __EH_prolog3.LIBCMT ref: 1001A572

Part of subcall function 1001A514: __EH_prolog3.LIBCMT ref: 1001A51B

Strings

No root element, xrefs: 1001B86A
Empty document, xrefs: 1001B871
Root element has sibling, xrefs: 1001B863

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3$_memset
String ID: Empty document$No root element$Root element has sibling
API String ID: 1193784468-3062692564
Opcode ID: e67fb678aeaa50fc5c6d19236aaadbcf0791f4646218e5fe574728cabf0af37d
Instruction ID: 181b4cb066472cc14598aa503b44376fe9ea90ab5b9abd83ac957d7b083c0184
Opcode Fuzzy Hash: e67fb678aeaa50fc5c6d19236aaadbcf0791f4646218e5fe574728cabf0af37d
Instruction Fuzzy Hash: 2D418974A00B049FC724DF69C88196AF7F9FF95700B108A1EE0A29B7A1DB74F984CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1003B92B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1003B965

Part of subcall function 100FF5B0: __calloc_impl.LIBCMT ref: 100FF5C5

Part of subcall function 10100AC9: __strupr_s_l.LIBCMT ref: 10100AD6

Strings

USERTRUST RSA, xrefs: 1003B9B1
SECTIGO, xrefs: 1003B9A0
GLOBALSIGN, xrefs: 1003B9C2
DIGICERT, xrefs: 1003B98E

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __calloc_impl__strupr_s_l_calloc
String ID: DIGICERT$GLOBALSIGN$SECTIGO$USERTRUST RSA
API String ID: 1771830616-3062817062
Opcode ID: 077a9c66e440efce97a994e8319890ebddf403273a691906bab985065b87212b
Instruction ID: 6d13747e70cb1a8cde36d92c852586c53bfccdbc00ba8075d928688e43c3f284
Opcode Fuzzy Hash: 077a9c66e440efce97a994e8319890ebddf403273a691906bab985065b87212b
Instruction Fuzzy Hash: B9112635A04A05BED723D626AC46FDF3AECEFC16A9F20001BF704AA544FA31DE4146A4

Uniqueness

Uniqueness Score: -1.00%

Function 1000A620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(10117588,UserProductNumber,00000104,?,?,?,?,?,?,?,?,?,?,?,?,100011FD), ref: 1000A641
_memset.LIBCMT ref: 1000A669

Strings

AIL:StrAdd(%s=%s), xrefs: 1000A6BC
CS_ERR, xrefs: 1000A655
UserProductNumber, xrefs: 1000A638

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memsetlstrcmp
String ID: AIL:StrAdd(%s=%s)$CS_ERR$UserProductNumber
API String ID: 668565496-1111360846
Opcode ID: a7885519659444351615378a821645b4a2b5d77d982e9fd8dc23e770f80df2f1
Instruction ID: e2887db3a38f85fd85d0e08b437bfbc04e76b8efa8eec46c36ab0f33bc84c604
Opcode Fuzzy Hash: a7885519659444351615378a821645b4a2b5d77d982e9fd8dc23e770f80df2f1
Instruction Fuzzy Hash: 1D11E776900308ABEB05DFA49D82EDF73BCEF05380F144126F804FA145EB76AE858765

Uniqueness

Uniqueness Score: -1.00%

Function 1003BADC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1003BB2D
__fread_nolock.LIBCMT ref: 1003BB3B
_memcmp.LIBCMT ref: 1003BB5A

Strings

<, xrefs: 1003BB19
MSCF, xrefs: 1003BB54

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __fread_nolock_memcmp_memset
String ID: <$MSCF
API String ID: 4049083821-3042183131
Opcode ID: a5b6d4ea115b6cfafa99f281ad0e8d15d76eb9a9d8a1362e71e14a6ac36bb6a6
Instruction ID: 3a16ffd7bdc122a9d2b7f8162f3efc1e7171e52e05024895800f7f4af0d37bc6
Opcode Fuzzy Hash: a5b6d4ea115b6cfafa99f281ad0e8d15d76eb9a9d8a1362e71e14a6ac36bb6a6
Instruction Fuzzy Hash: A921A871E00A4DEEDB12EA608C41F9EB7A8DB4439AF004415EB01EE146FFF49E44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1000C579 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 1000C580
AhnIEx_IsWinNT.AHNIEX(SavePendingFileList,00000064,1000130C,AIL:Free), ref: 1000C597

Part of subcall function 10018600: AhnIEx_GetOS.AHNIEX(1000A7FA,InstallInfo:Init,00000018), ref: 10018609

Strings

%s=%s, xrefs: 1000C5D2, 1000C605
SavePendingFileList, xrefs: 1000C585
NUL, xrefs: 1000C5CD, 1000C604

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: %s=%s$NUL$SavePendingFileList
API String ID: 2427045233-2327932201
Opcode ID: b3fafffcc4bd63fa0bb6dcd99b66b291abddde9d76b8d08a982152c9d7eda405
Instruction ID: c0e4701f0fb35e420a08a4101147152a3f6ab6f9e83f1f6e4d27f5b0e7a332ec
Opcode Fuzzy Hash: b3fafffcc4bd63fa0bb6dcd99b66b291abddde9d76b8d08a982152c9d7eda405
Instruction Fuzzy Hash: 5E216D3480078DDAEB24CBE4CC41ADDB7B4EF15390F60421DA461BB2D9DB756A82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10005D0B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10005D37
_memset.LIBCMT ref: 10005D5E

Part of subcall function 100149E0: RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,?,?,00000104,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A0D
Part of subcall function 100149E0: RegQueryValueExW.ADVAPI32(?,00000020,00000000,00000000,?,0000003E,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A2E
Part of subcall function 100149E0: RegCloseKey.ADVAPI32(?,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A39

Strings

Explorer.exe, xrefs: 10005D3F
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 10005D71
Shell, xrefs: 10005D6C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset$CloseOpenQueryValue
String ID: Explorer.exe$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$Shell
API String ID: 2226188099-3270232249
Opcode ID: 703e76f146f20b0c419f5e9cf333782c273f2769ff3a83fd41cea01a60bb59b7
Instruction ID: 2f9c87d39a0d7e5a08a4e03d6bac374fd2b22a121a5825e93bae483bb0277da1
Opcode Fuzzy Hash: 703e76f146f20b0c419f5e9cf333782c273f2769ff3a83fd41cea01a60bb59b7
Instruction Fuzzy Hash: 7A113D7194021C9BEB70DFB8CC85FEE77E8EB08700F54052AFA19EB182EB7466448B51

Uniqueness

Uniqueness Score: -1.00%

Function 1000F2F1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

_memset.LIBCMT ref: 1000F30C
lstrcmpiW.KERNEL32(101738F8,true), ref: 1000F330

Strings

false, xrefs: 1000F359
TRUE, xrefs: 1000F322
true, xrefs: 1000F317, 1000F31C, 1000F356

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal_memsetlstrcmpi
String ID: TRUE$false$true
API String ID: 2447223741-3801493375
Opcode ID: 89fa4fc2299e35414121f0e1f7f2e50cbef4ccbdecb0690ebb3134f1a3ede2ea
Instruction ID: 121dbc1710110b4241465391d9aa32584bc2bd4e8c003510bcdcb2bbd9df6eb7
Opcode Fuzzy Hash: 89fa4fc2299e35414121f0e1f7f2e50cbef4ccbdecb0690ebb3134f1a3ede2ea
Instruction Fuzzy Hash: 14018FB6E402187BCB10DFA88D06ACE7BECEB4D650F008065F601FB280E775DA408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000F278 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

_memset.LIBCMT ref: 1000F293
lstrcmpiW.KERNEL32(101738F8,true), ref: 1000F2B7

Strings

false, xrefs: 1000F2D9
TRUE, xrefs: 1000F2A9
true, xrefs: 1000F29E, 1000F2A3, 1000F2D6

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal_memsetlstrcmpi
String ID: TRUE$false$true
API String ID: 2447223741-3801493375
Opcode ID: 0051d2d145c9e1e6a096789875097854831fba36dcef3813d1b6a73c7e639d7f
Instruction ID: 741c86f3d39130b487b48f977aff4d9724406601a6b69bbae84eebfd0eecf9c5
Opcode Fuzzy Hash: 0051d2d145c9e1e6a096789875097854831fba36dcef3813d1b6a73c7e639d7f
Instruction Fuzzy Hash: D0016DB6E402187ADF10DFB49D06ACF7BECEB0D250F408065F901FB285E675DA408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 10017C02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10017A6E: _memset.LIBCMT ref: 10017A7D
Part of subcall function 10017A6E: GetModuleHandleW.KERNEL32(ntdll,1000A7FA,InstallInfo:Init,00000018), ref: 10017A8C
Part of subcall function 10017A6E: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 10017A9C

_memset.LIBCMT ref: 10017C4C

Part of subcall function 100149E0: RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,?,?,00000104,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A0D
Part of subcall function 100149E0: RegQueryValueExW.ADVAPI32(?,00000020,00000000,00000000,?,0000003E,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A2E
Part of subcall function 100149E0: RegCloseKey.ADVAPI32(?,?,?,10017C6B,80000002,SYSTEM\CurrentControlSet\Control\ProductOptions), ref: 10014A39

lstrcmpiW.KERNEL32(WINNT,?), ref: 10017C77

Strings

ProductType, xrefs: 10017C57
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 10017C5C
WINNT, xrefs: 10017C72

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset$AddressCloseHandleModuleOpenProcQueryValuelstrcmpi
String ID: ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 3771028345-3632669639
Opcode ID: 7358947d34e519dffac8e85356a04e56e365784c0418dcffdad938ee592284f2
Instruction ID: 4423a012e38d895543c8902c976f4400b8b780412274d493c036cf23735643d3
Opcode Fuzzy Hash: 7358947d34e519dffac8e85356a04e56e365784c0418dcffdad938ee592284f2
Instruction Fuzzy Hash: 3F014438A00218EBDB00DBB0DD46F9D73B8FB08344F700928F601E6181EB78BB848755

Uniqueness

Uniqueness Score: -1.00%

Function 1000D618 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(TRUE,true), ref: 1000D633
AhnIEx_EnableWow64FsRedirection.AHNIEX(00000001), ref: 1000D63F

Strings

false, xrefs: 1000D64F
TRUE, xrefs: 1000D62E
true, xrefs: 1000D628, 1000D62D, 1000D64C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: EnableFreeGlobalRedirectionWow64lstrcmpi
String ID: TRUE$false$true
API String ID: 4244963425-3801493375
Opcode ID: 0311ab70dd389f86becec5a6cc50dc70ffcc42c97d072218a1b0ae5009e510ff
Instruction ID: 23bcc2a3dbb830c136419313649751a37523d1185d4af5f63ca6f2f41a015dc5
Opcode Fuzzy Hash: 0311ab70dd389f86becec5a6cc50dc70ffcc42c97d072218a1b0ae5009e510ff
Instruction Fuzzy Hash: 5CE022376402143BEB14EAB4AC06DDB77CCEF0E261F008022F908EA284DA72E8C041A2

Uniqueness

Uniqueness Score: -1.00%

Function 10017DED Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.DLL,?,00000000,00000000,?,1000D5F3), ref: 10017DF8
GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017E08
GetCurrentProcess.KERNEL32(?,?,?,00000000,00000000,?,1000D5F3), ref: 10017E1C

Strings

Kernel32.DLL, xrefs: 10017DF3
IsWow64Process2, xrefs: 10017E02

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process2$Kernel32.DLL
API String ID: 4190356694-386423339
Opcode ID: 4fecff3c989c687a61c52b9296baa46cc2e03e7e43a02544088713dbc0a10925
Instruction ID: 228f147c1bbdd1f7ef81c551c07d388e4767aba579137b047b44cb8c74c8b5cb
Opcode Fuzzy Hash: 4fecff3c989c687a61c52b9296baa46cc2e03e7e43a02544088713dbc0a10925
Instruction Fuzzy Hash: 57E06D76A14229BBDB14E7F48D4888B36FCFB0818075005A2F806D7604F678DE8086E0

Uniqueness

Uniqueness Score: -1.00%

Function 1010419A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 101041B4

Part of subcall function 1010506B: __getptd_noexit.LIBCMT ref: 1010506E
Part of subcall function 1010506B: __amsg_exit.LIBCMT ref: 1010507B

__getptd.LIBCMT ref: 101041C5
__getptd.LIBCMT ref: 101041D3

Strings

MOC, xrefs: 101041A6
csm, xrefs: 101041AD

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: b62b947c62f35557d1b5dac32280287c7c7da8ba04fc4f4f61fd6ddd60f2fe6d
Instruction ID: 372c7b7fc521e20fee6fdcdf5f8b35d5cff975da7fec4355f91b729ed94ebfe4
Opcode Fuzzy Hash: b62b947c62f35557d1b5dac32280287c7c7da8ba04fc4f4f61fd6ddd60f2fe6d
Instruction Fuzzy Hash: A8E04FB95006448FC340AB64C186B5A33A4FB68354F2A00A1F89DCB329CB3CFD909592

Uniqueness

Uniqueness Score: -1.00%

Function 1005BED0 Relevance: 7.7, APIs: 6, Instructions: 155COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000), ref: 1005BF26
GetLastError.KERNEL32 ref: 1005BF2E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 1005BF52
GetLastError.KERNEL32 ref: 1005BF5A
MultiByteToWideChar.KERNEL32(0000FDE9,?,?,?,?,00000000), ref: 1005BFAC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000), ref: 1005BFD9

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 8208666e0ab7163980a7f51d1fa55c504f195a5e54ca514129376dee2bab448c
Instruction ID: 1927e0f6c96fbced2d3882135886c3cff30e16abfb967d8ee2caf68ac2e2d650
Opcode Fuzzy Hash: 8208666e0ab7163980a7f51d1fa55c504f195a5e54ca514129376dee2bab448c
Instruction Fuzzy Hash: 5041EA35A0011DAFDB10DBA4DC56BEEB7B5EF88750F004166F905EB280DA75BD098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 101076C1 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 101076CD

Part of subcall function 1010506B: __getptd_noexit.LIBCMT ref: 1010506E
Part of subcall function 1010506B: __amsg_exit.LIBCMT ref: 1010507B

__amsg_exit.LIBCMT ref: 101076ED
__lock.LIBCMT ref: 101076FD
InterlockedDecrement.KERNEL32(?), ref: 1010771A
InterlockedIncrement.KERNEL32(031B1618), ref: 10107745

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 17cf94e2ee75e4aeefe7aff7648259d00aaf026783e2a2afbb0c48c78e51416c
Instruction ID: d2db793fac60b5315e8beeb48097c10818bdc4eb893605b2525c1cebd8a89fb9
Opcode Fuzzy Hash: 17cf94e2ee75e4aeefe7aff7648259d00aaf026783e2a2afbb0c48c78e51416c
Instruction Fuzzy Hash: 70018039D01A229BD7519B79898674E77A1FF04794F018105F8C167698CB3C6982DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 100FB7DB Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 100FB7F9

Part of subcall function 10105A91: __mtinitlocknum.LIBCMT ref: 10105AA7
Part of subcall function 10105A91: __amsg_exit.LIBCMT ref: 10105AB3
Part of subcall function 10105A91: EnterCriticalSection.KERNEL32(100FAE08,100FAE08,?,1010B1F2,00000004,1016BA20,0000000C,1010569C,?,100FAE17,00000000,00000000,00000000,?,1010501D,00000001), ref: 10105ABB

___sbh_find_block.LIBCMT ref: 100FB804
___sbh_free_block.LIBCMT ref: 100FB813
HeapFree.KERNEL32(00000000,?,1016B308,0000000C,10105A72,00000000,1016B8C0,0000000C,10105AAC,?,100FAE08,?,1010B1F2,00000004,1016BA20,0000000C), ref: 100FB843
GetLastError.KERNEL32(?,1010B1F2,00000004,1016BA20,0000000C,1010569C,?,100FAE17,00000000,00000000,00000000,?,1010501D,00000001,00000214), ref: 100FB854

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 35658a47328ebdc436b246339cd77aee65f620f92ad8437ddb205d541ba428e3
Instruction ID: 2e21e0db5d07e21c5e26e115d4a691068e9742dfc4bd9d8fe131fa4f5f41e119
Opcode Fuzzy Hash: 35658a47328ebdc436b246339cd77aee65f620f92ad8437ddb205d541ba428e3
Instruction Fuzzy Hash: CD014F3590171AABDB20DBB58C4674E3BA8FF51BA1F148119F4806B194CF3CAD42EF54

Uniqueness

Uniqueness Score: -1.00%

Function 1000E625 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,INFINITE), ref: 1000E640

Strings

false, xrefs: 1000E672
TRUE, xrefs: 1000E657
true, xrefs: 1000E66B
INFINITE, xrefs: 1000E635

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGloballstrcmpi
String ID: INFINITE$TRUE$false$true
API String ID: 207235745-3079933150
Opcode ID: 5c903d4e73ab310dc598c6b53790ad62e5c51b6f2eca8387a91a760d71fc4d8c
Instruction ID: 1f7a6d8db5ded9d1979a8bceb1e8aa7df622e92fd7017c52c512ef954833947d
Opcode Fuzzy Hash: 5c903d4e73ab310dc598c6b53790ad62e5c51b6f2eca8387a91a760d71fc4d8c
Instruction Fuzzy Hash: C9F0E2723046413AE628DA70AC07DCB73CCEB193F0B10C016F914BE2D5EB76EC80406A

Uniqueness

Uniqueness Score: -1.00%

Function 1000E689 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,INFINITE), ref: 1000E6A4

Strings

false, xrefs: 1000E6D6
TRUE, xrefs: 1000E6BB
true, xrefs: 1000E6CF
INFINITE, xrefs: 1000E699

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGloballstrcmpi
String ID: INFINITE$TRUE$false$true
API String ID: 207235745-3079933150
Opcode ID: 481a7f4bb2d7a3688b8ae2e19ea4feebf6fb757cf1054ab2b2a0b78c82378654
Instruction ID: c5edd7924c56e6d251252f2e089bed30d0270606812e1be5f8ad48b7b19414da
Opcode Fuzzy Hash: 481a7f4bb2d7a3688b8ae2e19ea4feebf6fb757cf1054ab2b2a0b78c82378654
Instruction Fuzzy Hash: CEF0BE726442457AE628DA75AC07D8B278CEB293F0B108026F814BE2D5EB76E8804066

Uniqueness

Uniqueness Score: -1.00%

Function 1001B217 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 403COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1001B21E

Strings

Element '%s' at offset %d not ended, xrefs: 1001B6BB
No start tag for end tag '%s' at offset %d, xrefs: 1001B483
End tag '%s' at offset %d does not match start tag '%s' at offset %d, xrefs: 1001B687

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3
String ID: Element '%s' at offset %d not ended$End tag '%s' at offset %d does not match start tag '%s' at offset %d$No start tag for end tag '%s' at offset %d
API String ID: 431132790-1432514889
Opcode ID: 7180f72cfee867a5a66a1dd1113c1e5217a05cd7e23b1deeb7a000fef13a16da
Instruction ID: 975f1c575f2af09394835f3990722b6d5ba914d3ca832722e6ef253566adac3c
Opcode Fuzzy Hash: 7180f72cfee867a5a66a1dd1113c1e5217a05cd7e23b1deeb7a000fef13a16da
Instruction Fuzzy Hash: E902E374A00A098FCB54CF98C8C0AAEB7F1FF48314F558569E8159B396CB31E952CF90

Uniqueness

Uniqueness Score: -1.00%

Function 100503F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 100504D9

Strings

, xrefs: 10050484
0123456789ABCDEF, xrefs: 100504C5
0123456789abcdef, xrefs: 100504CC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __aulldvrm
String ID: $0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-30751140
Opcode ID: 8c9cc666d16527c729b47a2b86dc512866062aa4d44004ded4d5dd08246f4530
Instruction ID: 5f4e8b07aa69db182d6be82356c91ec88aa38da1929626ca7213492c1c1b30b1
Opcode Fuzzy Hash: 8c9cc666d16527c729b47a2b86dc512866062aa4d44004ded4d5dd08246f4530
Instruction Fuzzy Hash: 2E9148B5A087468BD700CE24C48161FB7E1FFC8298F59492DF984A7312E775ED498F92

Uniqueness

Uniqueness Score: -1.00%

Function 10011E93 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10011E9A
std::runtime_error::runtime_error.LIBCPMT ref: 10011EC3

Part of subcall function 10011D1A: __EH_prolog3.LIBCMT ref: 10011D21

__CxxThrowException@8.LIBCMT ref: 10011ED8

Part of subcall function 100FDAE8: RaiseException.KERNEL32(?,?,100FBD6D,101728B8,?,?,?,?,100FBD6D,101728B8,1016AAA4,1017A7F4,101728B8,1000A8CB), ref: 100FDB2A

Strings

invalid map/set<T> iterator, xrefs: 10011EAB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrowstd::runtime_error::runtime_error
String ID: invalid map/set<T> iterator
API String ID: 1048600877-152884079
Opcode ID: 30395ef3109096f5cc05473601536b1585fc8977dffb722e577c0c5a12d5c707
Instruction ID: 06b5b5b99b5e0265be71201b426d77c7361f3c64d8de277c43531ed95e096cb6
Opcode Fuzzy Hash: 30395ef3109096f5cc05473601536b1585fc8977dffb722e577c0c5a12d5c707
Instruction Fuzzy Hash: 82A17DB0A042819FD705CF24C080B99BBE2EF49354F25859CE4894F2A3C7B1ECD6CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1001BB3F Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 1001BB7C

Strings

@, xrefs: 1001BC91
AhnLab, Inc., xrefs: 1001BC54

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _wcslen
String ID: @$AhnLab, Inc.
API String ID: 176396367-3523753201
Opcode ID: ad59cbbd93930738f222363706cdda47d7b956a5863e1c668386126d370d08da
Instruction ID: c81744d8fe61bb21c2dd0610d11bf3f47dcc16c8f2acd10beb4734cbe52238aa
Opcode Fuzzy Hash: ad59cbbd93930738f222363706cdda47d7b956a5863e1c668386126d370d08da
Instruction Fuzzy Hash: DD615B76C0055AAFDF15EFA8E8C18EEBBB5EB04255F21406AF910BA111E731DEC09B91

Uniqueness

Uniqueness Score: -1.00%

Function 10067520 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 10067545

Strings

fullname, xrefs: 10067535
..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_crld.c, xrefs: 100675C5, 10067637, 10067685
relativename, xrefs: 1006756F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\Src\openssl-1.1.1n\crypto\x509v3\v3_crld.c$fullname$relativename
API String ID: 909875538-3750181844
Opcode ID: 1d86b73b670f0e9a885d5a3ee589f32e944232877a0ed9fe7ee9c6c9150af58a
Instruction ID: 404ae996d8f5fed215e3000b2c7c8245e79e6233d219519770c3faa5a0fefdec
Opcode Fuzzy Hash: 1d86b73b670f0e9a885d5a3ee589f32e944232877a0ed9fe7ee9c6c9150af58a
Instruction Fuzzy Hash: 2B4139766047056EE310CE28EC42B57B3D6EF84265F2505A9FA4D9B2C3FBA6F8448391

Uniqueness

Uniqueness Score: -1.00%

Function 1001B0B1 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1001B0B8

Strings

#comment, xrefs: 1001B1A9
#text, xrefs: 1001B1B7
#cdata-section, xrefs: 1001B1B0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3
String ID: #cdata-section$#comment$#text
API String ID: 431132790-709292869
Opcode ID: 92e30f0c9fd6cca227dfc3f6934af23257c4a285020415ad329c2fbf1cc570bd
Instruction ID: e93ccee101b16e3a302e305a5ff85ef0cf2a4339aadc536879de5ee8e9e54c4f
Opcode Fuzzy Hash: 92e30f0c9fd6cca227dfc3f6934af23257c4a285020415ad329c2fbf1cc570bd
Instruction Fuzzy Hash: 8941DF36804A09BBCB14DBA4C995AEEB7F9EF05254F61051AF452AF181DF34FAC8CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10012205 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 1001220C
std::runtime_error::runtime_error.LIBCPMT ref: 10012234

Part of subcall function 10011D1A: __EH_prolog3.LIBCMT ref: 10011D21

__CxxThrowException@8.LIBCMT ref: 10012249

Part of subcall function 100FDAE8: RaiseException.KERNEL32(?,?,100FBD6D,101728B8,?,?,?,?,100FBD6D,101728B8,1016AAA4,1017A7F4,101728B8,1000A8CB), ref: 100FDB2A

Strings

map/set<T> too long, xrefs: 1001221C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrowstd::runtime_error::runtime_error
String ID: map/set<T> too long
API String ID: 1048600877-1285458680
Opcode ID: 348a54d1a99853e856fdb0adce6303b37f8157fed21471b883c590f9dceddc5c
Instruction ID: 7cc709638f9d54524dd82fa778c7a660deb4a008fbb016c60548879aef98925e
Opcode Fuzzy Hash: 348a54d1a99853e856fdb0adce6303b37f8157fed21471b883c590f9dceddc5c
Instruction Fuzzy Hash: 4D5154B4600281AFD715CF58C584B99BBE1FF09314F198188E84A9F6A2C7B5FCE1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 100085A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100085E2
_memset.LIBCMT ref: 100085F4

Part of subcall function 10008273: GetFileVersionInfoSizeW.VERSION(?,?,?,00000104,?), ref: 10008311
Part of subcall function 10008273: GetLastError.KERNEL32(?,?,?,00000104,?), ref: 10008320

Part of subcall function 10008273: _malloc.LIBCMT ref: 1000834F

CompareFileTime.KERNEL32(?,?), ref: 10008697

Strings

CompareFileVersion(%s, %s)=%d, xrefs: 1000865B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: File_memset$CompareErrorInfoLastSizeTimeVersion_malloc
String ID: CompareFileVersion(%s, %s)=%d
API String ID: 836775562-600400590
Opcode ID: 6d29169bc327abfbebf1009ba3c1c89a47fc535e4c1db2a29ffa7f5603c1c871
Instruction ID: 9a3a5105ba35671ad3ea74947966e4214ae25aa13d5be8d67c25263ccb563b00
Opcode Fuzzy Hash: 6d29169bc327abfbebf1009ba3c1c89a47fc535e4c1db2a29ffa7f5603c1c871
Instruction Fuzzy Hash: 3A318376D0024C9FEB20DEA4CC81EDE77BCFB45280F110426F649D7255EA75AA84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1005F0B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1005F0CF
_memset.LIBCMT ref: 1005F0F2

Strings

..\..\Src\openssl-1.1.1n\crypto\buffer\buffer.c, xrefs: 1005F10E, 1005F152, 1005F16B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID: ..\..\Src\openssl-1.1.1n\crypto\buffer\buffer.c
API String ID: 2102423945-699722557
Opcode ID: 19ada96537bb1003e71c3401a0edafc3bab105424a5c7235cf3130f3483a4254
Instruction ID: 81bdba340fe04f0151f6221aaf131569d1d022472e26384e746174746741c19d
Opcode Fuzzy Hash: 19ada96537bb1003e71c3401a0edafc3bab105424a5c7235cf3130f3483a4254
Instruction Fuzzy Hash: 0E213ABAB007006BD624CA29FC42B6673D6DBC4720F18853DF689C76C1E67DAC494250

Uniqueness

Uniqueness Score: -1.00%

Function 1003B862 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1003B89D
_calloc.LIBCMT ref: 1003B8C4
GetLastError.KERNEL32 ref: 1003B8E6

Strings

1.3.6.1.5.5.7.3.3, xrefs: 1003B914

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$_calloc
String ID: 1.3.6.1.5.5.7.3.3
API String ID: 109609943-4219401174
Opcode ID: 61bffe9fb064c9ce5e6f3e41acff30aa1fbef29a1c1b06a25bab579153be5b2b
Instruction ID: 8661d2ae9ea744f4a800e8fad41fdbb789126862324b4ec39daa78f71137807a
Opcode Fuzzy Hash: 61bffe9fb064c9ce5e6f3e41acff30aa1fbef29a1c1b06a25bab579153be5b2b
Instruction Fuzzy Hash: EB21C735B04B19AFEB12EBA58C44BAEB7FCEF00B9AF114059FB01DA180DB70E905C650

Uniqueness

Uniqueness Score: -1.00%

Function 100ED7E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 100ED821
__aulldiv.LIBCMT ref: 100ED837
__aullrem.LIBCMT ref: 100ED858

Strings

%.14s.%03dZ, xrefs: 100ED868

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __aulldiv__aulldvrm__aullrem
String ID: %.14s.%03dZ
API String ID: 1415644573-1077646249
Opcode ID: 5b7b95de0d5a6e4d41b783a43a7590b8798a679ba36e9cd9b44fa1f23777edd8
Instruction ID: 03d23c5ebe91040c31fbe8892a1d25fa7b49ec55cf268404832e966a703e8723
Opcode Fuzzy Hash: 5b7b95de0d5a6e4d41b783a43a7590b8798a679ba36e9cd9b44fa1f23777edd8
Instruction Fuzzy Hash: 0911D3B9A043047BE240EB649C42F6F72EDDF98B44F400529F549A6181EA79FD0086BA

Uniqueness

Uniqueness Score: -1.00%

Function 10014772 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000400,?,?,1001482F,?,?), ref: 10014799
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?,?,?,1001482F,?,?,00000000,?,?,10001A8E,?), ref: 100147C5
RegCloseKey.ADVAPI32(?,?,?,1001482F,?,?,00000000,?,?,10001A8E,?,?,?,?,?,00000400), ref: 100147D0

Strings

AIL:RegSetStr(%x, %s, %d, %s)=%d, xrefs: 100147F7

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CloseCreateValue
String ID: AIL:RegSetStr(%x, %s, %d, %s)=%d
API String ID: 1818849710-4197376890
Opcode ID: 912cc43af742ae37af7ff1e64fc7af42f6e093e6e81e0417a9bde257ebd80148
Instruction ID: baf9da000d7498e03519b17402061990d49eb9f4bfee0c02d337c95c004027d7
Opcode Fuzzy Hash: 912cc43af742ae37af7ff1e64fc7af42f6e093e6e81e0417a9bde257ebd80148
Instruction Fuzzy Hash: 63115E36500118BFCB129F95DC45CDB3BB9EB8A791F114115F918AA5A0DB319EA0DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000E478 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 100109F1: lstrcmpiW.KERNEL32(?,?,?,00000000,?), ref: 10010A92

Part of subcall function 100133BF: _memset.LIBCMT ref: 100133F4
Part of subcall function 100133BF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,?,?), ref: 1001342C
Part of subcall function 100133BF: GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10013436

AhnIEx_snprintf.AHNIEX(?,?,101196DC,?), ref: 1000E4C6

Strings

false, xrefs: 1000E4F4
TRUE, xrefs: 1000E4A0
true, xrefs: 1000E4CB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CreateErrorEx_snprintfFreeGlobalLastProcess_memsetlstrcmpi
String ID: TRUE$false$true
API String ID: 4268677585-3801493375
Opcode ID: d21420be1b5d5d574c794fa126eb769ee306fc395256dfb10d96a1053fa485d7
Instruction ID: a27f25595aaa4b7274525fac11831e7562a99b72d7b12afd51ea970f32f2cade
Opcode Fuzzy Hash: d21420be1b5d5d574c794fa126eb769ee306fc395256dfb10d96a1053fa485d7
Instruction Fuzzy Hash: C301BC63A0012977DB18EAA48C43DCF7A9CEF1A240F048011FD10BF20AE734EB9046E2

Uniqueness

Uniqueness Score: -1.00%

Function 1000F371 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

_memset.LIBCMT ref: 1000F38D

Strings

false, xrefs: 1000F3DA
TRUE, xrefs: 1000F3B3
true, xrefs: 1000F3D3

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal_memset
String ID: TRUE$false$true
API String ID: 3311673658-3801493375
Opcode ID: 2ea1a39079823686d581fbe5bd51a00cf9a88dfa8081ae902384386141c0ddb1
Instruction ID: cdf27f3b2a79d71cb697f263f75bfe4847554d426b49355465eb21664aeaa8e3
Opcode Fuzzy Hash: 2ea1a39079823686d581fbe5bd51a00cf9a88dfa8081ae902384386141c0ddb1
Instruction Fuzzy Hash: CE0156B2E002186BDB14DE949D42ACEB7E8EB0D750F004066F904F7245E2B5DF4487E1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E3F2 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 100133BF: _memset.LIBCMT ref: 100133F4
Part of subcall function 100133BF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,?,?), ref: 1001342C
Part of subcall function 100133BF: GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10013436

AhnIEx_snprintf.AHNIEX(?,?,101196DC,?), ref: 1000E432

Strings

false, xrefs: 1000E460
TRUE, xrefs: 1000E40C
true, xrefs: 1000E437

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CreateErrorEx_snprintfFreeGlobalLastProcess_memset
String ID: TRUE$false$true
API String ID: 423487718-3801493375
Opcode ID: bd80377871551f56a1d10070b1a9e676ad3a7032b5d069375725fecad7f8041b
Instruction ID: 86d3186f534fc728c905487fbc5f09931e6f38a8603b021146fdd1231e2436ea
Opcode Fuzzy Hash: bd80377871551f56a1d10070b1a9e676ad3a7032b5d069375725fecad7f8041b
Instruction Fuzzy Hash: 64017863A001287BDB14EE648D03ECF7A9CEF1A240F488011FD14BB14AE735EB9086E2

Uniqueness

Uniqueness Score: -1.00%

Function 10040340 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 10040361
_ferror.LIBCMT ref: 1004036C
GetLastError.KERNEL32(..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c,00000095), ref: 10040382

Strings

..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c, xrefs: 1004037D, 10040397

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast__fread_nolock_ferror
String ID: ..\..\Src\openssl-1.1.1n\crypto\bio\bss_file.c
API String ID: 460735022-1896902835
Opcode ID: 13c6008bf4f4f80e980b191df5c3967dfc693f042147f62933a3819d722b3e2e
Instruction ID: 950198b93c0e6088958b6a1a0269d21a9befb0f973f65c37fe9f0674eec2d3ca
Opcode Fuzzy Hash: 13c6008bf4f4f80e980b191df5c3967dfc693f042147f62933a3819d722b3e2e
Instruction Fuzzy Hash: 2DF0C8757403007BE560DA75AC46F2B37ECDB88B61F014A2CB645EA2C3DB75ED414661

Uniqueness

Uniqueness Score: -1.00%

Function 1000FB96 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

FindWindowExW.USER32(?,00000000,TRUE,00000000), ref: 1000FBD8
GetDlgItem.USER32(?,00000000), ref: 1000FBF6
GetWindowTextW.USER32(00000000,?,?), ref: 1000FC05

Strings

TRUE, xrefs: 1000FBC2, 1000FBCE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Window$FindFreeGlobalItemText
String ID: TRUE
API String ID: 182404152-3412697401
Opcode ID: b9eab1cf02c5bb51467ae7ae48618e710b478386c7462438df0b8939e7937011
Instruction ID: ba099e8c4abd025184ed453fd1b6e72645f79a44a4f4f5d5890fd6165981ff30
Opcode Fuzzy Hash: b9eab1cf02c5bb51467ae7ae48618e710b478386c7462438df0b8939e7937011
Instruction Fuzzy Hash: 0D01F935600109BBDB119F24CD46EEA3B78FF84390F00C019FD18AF2A4DB35E941E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 10107472 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,100FBDDD), ref: 10107477
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 10107487

Strings

IsProcessorFeaturePresent, xrefs: 10107481
KERNEL32, xrefs: 10107472

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: f2ffc9c5e6520b6629d3380eca00429177d38fad3d74b62a4e166d62df7097d7
Instruction ID: 561a9c155e55267e69f0bcbf94cf74ff54d74dcda7e591ed939351ee927d0fc2
Opcode Fuzzy Hash: f2ffc9c5e6520b6629d3380eca00429177d38fad3d74b62a4e166d62df7097d7
Instruction Fuzzy Hash: E0F03070E00A1AE2EB101BA1AD496BF7E78FBC078AF934590E5D6F0088DF788071C253

Uniqueness

Uniqueness Score: -1.00%

Function 1001765E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(1001772A,?,00000000,?,00000000,?,?,?,1001772A,?,?,?,?,?,?), ref: 10017683
GetLastError.KERNEL32(?,?,1001772A,?,?,?,?,?,?), ref: 10017697
AhnIEx_SetError.AHNIEX(00000000,00000001,AIL:System64:Write err=%d,00000000,?,?,1001772A,?,?,?,?,?,?), ref: 100176AD

Strings

AIL:System64:Write err=%d, xrefs: 100176A0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Error$FileLastWrite
String ID: AIL:System64:Write err=%d
API String ID: 3469270004-2693861452
Opcode ID: 78b7e727e78c932a9ae3460139f30d291cf398631a4b6f1968ead5e3ad0136d2
Instruction ID: 06b9ce1d720a523e40d37b657f31ff2488bd53fc7adda26552c0d9c32d3f53fb
Opcode Fuzzy Hash: 78b7e727e78c932a9ae3460139f30d291cf398631a4b6f1968ead5e3ad0136d2
Instruction Fuzzy Hash: F3F0B4325000247FDB10A7608C069CB3FBCEF012B0F114211FD19AA190EA76EA8085E0

Uniqueness

Uniqueness Score: -1.00%

Function 10003A69 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 10003A6D

Strings

AIL:CheckSystemRebootFlag=1, xrefs: 10003A83
AIL:ASE_CheckSystemRebootFlag()=%d, xrefs: 10003BC3
AIL:CheckSystemRebootFlag:Completed=%d, xrefs: 10003A74

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: PrivateProfile
String ID: AIL:ASE_CheckSystemRebootFlag()=%d$AIL:CheckSystemRebootFlag:Completed=%d$AIL:CheckSystemRebootFlag=1
API String ID: 1469295129-3402982088
Opcode ID: b4a7afcf31aed79be22e7e89d276069a482b3203d82a1aec023fb47e4d8dab02
Instruction ID: f25867fbddf3917002a28ca0a2846ab40735935b139089dd478f875b8dfa1694
Opcode Fuzzy Hash: b4a7afcf31aed79be22e7e89d276069a482b3203d82a1aec023fb47e4d8dab02
Instruction Fuzzy Hash: D5F059B4B443089FE221BF348C0772FB3B8FB92201F40443AF0465D192DF7599459193

Uniqueness

Uniqueness Score: -1.00%

Function 100F1620 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 100540A0: EnterCriticalSection.KERNEL32(00000000,1003DF0A,?,00000000,?,?,?,00000000,?,?,?,?,?,?,100464F7,00040000), ref: 100540A5

Part of subcall function 101023D9: __fsopen.LIBCMT ref: 101023E6

GetStdHandle.KERNEL32(000000F6,1017A5A8), ref: 100F1666
GetConsoleMode.KERNEL32(00000000), ref: 100F166D

Strings

conin$, xrefs: 100F167C
conout$, xrefs: 100F1632

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ConsoleCriticalEnterHandleModeSection__fsopen
String ID: conin$$conout$
API String ID: 2201108008-2896197411
Opcode ID: ecd78e9f6de761248035911b7ef74b7ced46a42ab5f5ce74fb4ff0cf48ac94ef
Instruction ID: a1c6467433eee45d42e5c8d0bb8278edcb785daaabd3cb8d7819594da5a5824a
Opcode Fuzzy Hash: ecd78e9f6de761248035911b7ef74b7ced46a42ab5f5ce74fb4ff0cf48ac94ef
Instruction Fuzzy Hash: 6EF0B4F6A003125FD3009FF0DC95B963AB4FB55255B844228F444DA658FB7DEA808F91

Uniqueness

Uniqueness Score: -1.00%

Function 1000D2DE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWin3.AHNIEX(00000000,00000000,00000000), ref: 1000D311

Strings

false, xrefs: 1000D327
TRUE, xrefs: 1000D305
true, xrefs: 1000D320

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalWin3
String ID: TRUE$false$true
API String ID: 986778279-3801493375
Opcode ID: 82ee2691e0ad3b4c12c485b586e69d287f82935945932337b19935ec45e986c6
Instruction ID: ad0472e54f0bc999d65a813824c539ac7fbf194436637fa5d95fdb86b36b91f0
Opcode Fuzzy Hash: 82ee2691e0ad3b4c12c485b586e69d287f82935945932337b19935ec45e986c6
Instruction Fuzzy Hash: 07E0E5B6A002053AE704EAA5AC07DAB379CEB5C150F048011FD18AD256E676F6D44573

Uniqueness

Uniqueness Score: -1.00%

Function 1000D33E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 1000CEBD: lstrcmpiW.KERNEL32(?,None,?,?,1000D25D,TRUE,?,00000001), ref: 1000CEDA

AhnIEx_IsWinOrLater.AHNIEX(00000000,00000000,00000000), ref: 1000D371

Part of subcall function 1001863B: AhnIEx_GetOS.AHNIEX(1000D376,00000000,00000000,00000000), ref: 10018644
Part of subcall function 1001863B: AhnIEx_IsWinNT.AHNIEX(1000D376,00000000,00000000,00000000), ref: 10018649

Strings

false, xrefs: 1000D387
TRUE, xrefs: 1000D365
true, xrefs: 1000D380

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalLaterlstrcmpi
String ID: TRUE$false$true
API String ID: 389350979-3801493375
Opcode ID: 16c87a0279c9ff169047a0ddeb202a161962ab441961512da0d132aaec81f21a
Instruction ID: 5da185fd854927c3095f091af0a3198ed8f4c732ee1b4843fb769be305c5bfe7
Opcode Fuzzy Hash: 16c87a0279c9ff169047a0ddeb202a161962ab441961512da0d132aaec81f21a
Instruction Fuzzy Hash: 89E0E5A6A003493AE704EAA49D07DAB378CDB58190F048412FD18AD25AEB75FB945573

Uniqueness

Uniqueness Score: -1.00%

Function 1000D3F1 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWinNTOrLater2.AHNIEX(00000000,00000000,00000000), ref: 1000D424

Part of subcall function 10017B98: AhnIEx_GetOS2.AHNIEX(00000024,00000000,?,?,10013D25,00000006,00000000,00000000,00000024), ref: 10017BA2

Strings

false, xrefs: 1000D43A
TRUE, xrefs: 1000D418
true, xrefs: 1000D433

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalLater2
String ID: TRUE$false$true
API String ID: 2606824842-3801493375
Opcode ID: f016fa0af19de85dce18829337f70f2c01b3de608d991990f3875686abd9049c
Instruction ID: fef763557669f84e764c0d8b208fb8e17fe117273c8ffc782444f75678fc9200
Opcode Fuzzy Hash: f016fa0af19de85dce18829337f70f2c01b3de608d991990f3875686abd9049c
Instruction Fuzzy Hash: A0E0E5E6A402057BE604EAA59C07EAB338CEB58150F04C011FE18AD25AE676F6D44573

Uniqueness

Uniqueness Score: -1.00%

Function 1000D451 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWinNTOrLater3.AHNIEX(00000000,00000000,00000000), ref: 1000D484

Part of subcall function 10017BCD: AhnIEx_GetOS2.AHNIEX(00000000,00000024,?,?,10015E76,0000000A,00000000,0000585D,00000024), ref: 10017BD7

Strings

false, xrefs: 1000D49A
TRUE, xrefs: 1000D478
true, xrefs: 1000D493

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalLater3
String ID: TRUE$false$true
API String ID: 3966225692-3801493375
Opcode ID: 4ba3e0b7a754ab5197b0c2a4b6aa40518d7d843c641f0396c194b280b8b6ffac
Instruction ID: 41b7eaffd51ff2427c2b604aae0d8736ca908ac3ccbff2088a3f0cd0bcad95a8
Opcode Fuzzy Hash: 4ba3e0b7a754ab5197b0c2a4b6aa40518d7d843c641f0396c194b280b8b6ffac
Instruction Fuzzy Hash: 6DE0E5A6A402053BE604EAA59C17E9B738CEB58150F04C011FD1CAD25AE676F5D44573

Uniqueness

Uniqueness Score: -1.00%

Function 1000D28B Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWin2.AHNIEX(00000000,00000000), ref: 1000D2B2

Strings

false, xrefs: 1000D2C7
TRUE, xrefs: 1000D2A6
true, xrefs: 1000D2C0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalWin2
String ID: TRUE$false$true
API String ID: 1305885233-3801493375
Opcode ID: b196893305f26ba1d1d33a92a160c2c421c13a95697875be8a92475d4ecd40d0
Instruction ID: d5c247a95853d8c8cf772797cb587329d57ed0c617739ce5c9a6fb971e4f0fd3
Opcode Fuzzy Hash: b196893305f26ba1d1d33a92a160c2c421c13a95697875be8a92475d4ecd40d0
Instruction Fuzzy Hash: 6DE048AA6002057ADA04FAA5DC47D9F779CEB5D160F008012F908AE297EB76F9D44563

Uniqueness

Uniqueness Score: -1.00%

Function 1000D39E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWinNTOrLater.AHNIEX(00000000,00000000), ref: 1000D3C5

Part of subcall function 1001866F: AhnIEx_GetOS.AHNIEX(10018768,00080000,00000000,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 10018678
Part of subcall function 1001866F: AhnIEx_IsWinNT.AHNIEX(10018768,00080000,00000000,1000A954,?,00000400,WinSysDir,?,WinSysDir,?), ref: 1001867D

Strings

false, xrefs: 1000D3DA
TRUE, xrefs: 1000D3B9
true, xrefs: 1000D3D3

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalLater
String ID: TRUE$false$true
API String ID: 190139092-3801493375
Opcode ID: 2b9fb10be95065d7f430ea89356eff34683f44f280b6dad7be04c23d4dffaacb
Instruction ID: 50c740ea96dda3e7d28281287d23a8bc22236cb229fbeb023899e5bcf413f142
Opcode Fuzzy Hash: 2b9fb10be95065d7f430ea89356eff34683f44f280b6dad7be04c23d4dffaacb
Instruction Fuzzy Hash: 6EE0486AA002457AEA04EAA4BD07D9B738CDF59160F108012F914AD59AEB75EAD40563

Uniqueness

Uniqueness Score: -1.00%

Function 1000D667 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWinsockLater.AHNIEX(00000000,00000000), ref: 1000D68E

Part of subcall function 10017ED1: GetLastError.KERNEL32(WS2_32.DLL), ref: 10017F0E
Part of subcall function 10017ED1: SetLastError.KERNEL32(00000000), ref: 10017F27

Strings

false, xrefs: 1000D6A3
TRUE, xrefs: 1000D682
true, xrefs: 1000D69C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$FreeGlobalLaterWinsock
String ID: TRUE$false$true
API String ID: 4238758667-3801493375
Opcode ID: a9e1838b2b00286fcf68756014091e77eb9aedab660639432b5ee93fa05ae4fd
Instruction ID: 62ffe79c4fcb3a1b6adf3ca26301e0ee1f6d16c48780e1d34eab14ff9c896a18
Opcode Fuzzy Hash: a9e1838b2b00286fcf68756014091e77eb9aedab660639432b5ee93fa05ae4fd
Instruction Fuzzy Hash: 07E0D8AA6002053ADA04FAA4EC03D9F33CCEF1C160F008012F90CBE296EA76E9D00423

Uniqueness

Uniqueness Score: -1.00%

Function 1000D4EA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 100109F1: lstrcmpiW.KERNEL32(?,?,?,00000000,?), ref: 10010A92

AhnIEx_VerifyWinSuite.AHNIEX(00000000,TRUE,1011DD30,?,00000001), ref: 1000D507

Strings

false, xrefs: 1000D51D
TRUE, xrefs: 1000D4FC
true, xrefs: 1000D516

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalSuiteVerifylstrcmpi
String ID: TRUE$false$true
API String ID: 536727614-3801493375
Opcode ID: b91e9010a8b72f0bef612ebf63b4427f048c8d24066f32518a8765948778c43e
Instruction ID: faebaf705378cefdaddaa5667c5b937ba8f05f03be78860e48b8c60fc210c002
Opcode Fuzzy Hash: b91e9010a8b72f0bef612ebf63b4427f048c8d24066f32518a8765948778c43e
Instruction Fuzzy Hash: 3DE04FB6B4020536DB04EAB49C43E9B329CDB19240F408021FD08AE192E6B6E6D00563

Uniqueness

Uniqueness Score: -1.00%

Function 1000D73E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 100109F1: lstrcmpiW.KERNEL32(?,?,?,00000000,?), ref: 10010A92

AhnIEx_Is.AHNIEX(00000000,TRUE,1011DDA0,?,00000001), ref: 1000D75B

Strings

false, xrefs: 1000D771
TRUE, xrefs: 1000D750
true, xrefs: 1000D76A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGloballstrcmpi
String ID: TRUE$false$true
API String ID: 207235745-3801493375
Opcode ID: 00ba67c9a4e5e3f854b2f250a88d13c287c1a219e8cfe71d9c6859a1a6e4f018
Instruction ID: 7a5a444c3dcb15d7266939d8db48c38158240dc1acfa39ce5c3b6c0283b1413f
Opcode Fuzzy Hash: 00ba67c9a4e5e3f854b2f250a88d13c287c1a219e8cfe71d9c6859a1a6e4f018
Instruction Fuzzy Hash: 40E04FB6B4420536EE54FAB49C83E9F328CDB19290F448421F908EE196E6B6F6900163

Uniqueness

Uniqueness Score: -1.00%

Function 1000D246 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWin.AHNIEX(00000000,TRUE,?,00000001), ref: 1000D25E

Part of subcall function 10018619: AhnIEx_GetOS.AHNIEX(100189D7,00000400,101728B8), ref: 10018622

Strings

false, xrefs: 1000D274
TRUE, xrefs: 1000D253
true, xrefs: 1000D26D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal
String ID: TRUE$false$true
API String ID: 2979337801-3801493375
Opcode ID: 7f8570279585e65ecd0ebf25b04631101fa5d38e689cb18b7283f7679f369c07
Instruction ID: 9455b610b5b5600fcecd147735de99b559bf562087d88df8a96b3bcf0ca0f865
Opcode Fuzzy Hash: 7f8570279585e65ecd0ebf25b04631101fa5d38e689cb18b7283f7679f369c07
Instruction Fuzzy Hash: 8BE086B6A0030837EF14EAB48C03D9B338CDB58240F048411FD04AE156E676E6900563

Uniqueness

Uniqueness Score: -1.00%

Function 10017D77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.DLL), ref: 10017D82
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 10017D92

Strings

GetNativeSystemInfo, xrefs: 10017D8C
Kernel32.DLL, xrefs: 10017D7D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNativeSystemInfo$Kernel32.DLL
API String ID: 1646373207-2246904209
Opcode ID: 52ed58ea1d10a08bc1d82adc399edf16c597fb3394dc77d6ae99f7a13e94fd0a
Instruction ID: 71700123414a68d8d22c6bf72b21e81fb787cc313a1ddafb733fa524e562e99e
Opcode Fuzzy Hash: 52ed58ea1d10a08bc1d82adc399edf16c597fb3394dc77d6ae99f7a13e94fd0a
Instruction Fuzzy Hash: D3E0C210B1021856CB44EBB19E4A8AB33FCFF4C1887200568F40BE6180FF78D9C1C2A0

Uniqueness

Uniqueness Score: -1.00%

Function 10017DB2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.DLL), ref: 10017DBD
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 10017DCD

Strings

GetNativeSystemInfo, xrefs: 10017DC7
Kernel32.DLL, xrefs: 10017DB8

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNativeSystemInfo$Kernel32.DLL
API String ID: 1646373207-2246904209
Opcode ID: b5023725b69f4c87cee9cec3ef8235a3f734619f656a43c8278fcd18aeed9edd
Instruction ID: 46f15b214d7dc978f3ac308c98b3dcdc9419eecd79506a469ee0c039a0e9daa3
Opcode Fuzzy Hash: b5023725b69f4c87cee9cec3ef8235a3f734619f656a43c8278fcd18aeed9edd
Instruction Fuzzy Hash: DAE0C228B0020A56CB05EBB16E498AB32FCFF481897000564F40BE9180FF78D9C481A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000DF3C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,true), ref: 1000DF53

Part of subcall function 1000791E: SetLastError.KERNEL32(00000000), ref: 100079EB

AhnIEx_snprintf.AHNIEX(?,?,101196DC,00000000,TRUE,00000001), ref: 1000DF7C

Strings

TRUE, xrefs: 1000DF5F
true, xrefs: 1000DF49

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorEx_snprintfFreeGlobalLastlstrcmpi
String ID: TRUE$true
API String ID: 2713979109-406173685
Opcode ID: d50a60a618382063a6b3c29198348a7edb725d661face60388c495d376b1a59e
Instruction ID: 56b2a80a1f200c10c6370d12608c0c03dc97e830853c77ac40d8fb5ee2aaa16f
Opcode Fuzzy Hash: d50a60a618382063a6b3c29198348a7edb725d661face60388c495d376b1a59e
Instruction Fuzzy Hash: B0E086627442017EE604EB748D07D6A76DCE78C201F408414F150EA196D728D9844123

Uniqueness

Uniqueness Score: -1.00%

Function 10005105 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 100FAADF: CreateFileW.KERNEL32(1017A5D8,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 100FAB67
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 100FAB91
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000036,?,00000000), ref: 100FABB5
Part of subcall function 100FAADF: __wcsnicmp.LIBCMT ref: 100FABD7
Part of subcall function 100FAADF: SetFilePointer.KERNEL32(00000000,0000006E,00000000,00000000), ref: 100FAC8E

FreeLibrary.KERNEL32(00000000,?,10005A0E,?,?,?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 1000511F
GetLastError.KERNEL32(?,10005A0E,?,?,?,?,?,?,?,?,?,?,DllImport:Init,00000004), ref: 10005129

Strings

AIL:DllImport:Free AhnInst, xrefs: 1000510E
AIL:Free AhnInst err=%d, xrefs: 10005130

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: File$Read$CreateErrorFreeLastLibraryPointer__wcsnicmp
String ID: AIL:DllImport:Free AhnInst$AIL:Free AhnInst err=%d
API String ID: 3078990119-4131085733
Opcode ID: a7813259d04f25b2f223f686c0600c97f1be410ea87909a3ef971c61da6cbed8
Instruction ID: 29963b7e360b1b77e927aeb2650ee374158a1194fa1df9b476ffe07082ae5ff1
Opcode Fuzzy Hash: a7813259d04f25b2f223f686c0600c97f1be410ea87909a3ef971c61da6cbed8
Instruction Fuzzy Hash: 75E08C72510320AFF3589730AC4AB9633A8FB0469AF05002DF44648CA4EBF9A9C59661

Uniqueness

Uniqueness Score: -1.00%

Function 10007360 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 100FAADF: CreateFileW.KERNEL32(1017A5D8,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 100FAB67
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 100FAB91
Part of subcall function 100FAADF: ReadFile.KERNEL32(00000000,?,00000036,?,00000000), ref: 100FABB5
Part of subcall function 100FAADF: __wcsnicmp.LIBCMT ref: 100FABD7
Part of subcall function 100FAADF: SetFilePointer.KERNEL32(00000000,0000006E,00000000,00000000), ref: 100FAC8E

FreeLibrary.KERNEL32(10001332,AIL:Free), ref: 1000737D
GetLastError.KERNEL32 ref: 10007387

Strings

AIL:Free AI7z err=%d, xrefs: 1000738E
AIL:Free AI7z, xrefs: 10007369

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: File$Read$CreateErrorFreeLastLibraryPointer__wcsnicmp
String ID: AIL:Free AI7z$AIL:Free AI7z err=%d
API String ID: 3078990119-2950209584
Opcode ID: b168c3b531dcf2644bf675c949040a59556d87f17bcebe1f44b9bf9f36ceaa74
Instruction ID: 2e259428f1ac50bdd5c9366b014abaa2102f874708bf53bc91af3eac85fe7e6f
Opcode Fuzzy Hash: b168c3b531dcf2644bf675c949040a59556d87f17bcebe1f44b9bf9f36ceaa74
Instruction Fuzzy Hash: 0CE01D75540210AFF3095770CD8B77537BCF710645F440114F545449E6E7BD15C5E511

Uniqueness

Uniqueness Score: -1.00%

Function 1001DE71 Relevance: 6.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 1001DE94

Part of subcall function 1003A675: _wcslen.LIBCMT ref: 1003A67F
Part of subcall function 1003A675: __waccess_s.LIBCMT ref: 1003A68C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _wcslen$__waccess_s
String ID:
API String ID: 1291433773-0
Opcode ID: 800bb1847b7d9c4fd149af6423706b64aa6371053d8e86182d5ef30d47f59643
Instruction ID: 3b9366c80a3de4ee416dc4a64138cf57cdfa6efc425b3bf9ba07de5a04a20a94
Opcode Fuzzy Hash: 800bb1847b7d9c4fd149af6423706b64aa6371053d8e86182d5ef30d47f59643
Instruction Fuzzy Hash: 3D513B76D0019EABEB12FA988881ADE77F5DF08391F114027ED50AF141E6B4DFC59BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001D601 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001D66A
_memset.LIBCMT ref: 1001D6BB
_wcslen.LIBCMT ref: 1001D6E3

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset$_wcslen
String ID:
API String ID: 2220268819-0
Opcode ID: 792b76c173e61eed62e83a7f09477d1d1adadfdfc69177135a4c69ba093af54e
Instruction ID: 22ab3ebd398c13d8e029e253b1d3cfa727dc0e4ba6f0e5168b8ca802c0283895
Opcode Fuzzy Hash: 792b76c173e61eed62e83a7f09477d1d1adadfdfc69177135a4c69ba093af54e
Instruction Fuzzy Hash: 3051807590424D9BDB14EFA8DC84ADEBBF8EF04310F10821AF825EB291E774DA41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1001D851 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 1001D86E
_calloc.LIBCMT ref: 1001D89A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _calloc_wcslen
String ID:
API String ID: 2075057734-0
Opcode ID: a3165a322e9cf454d067e2e9fb51a1568b5d9541ec2360a5f41516ca8b9f2719
Instruction ID: c15d5205ffc0240b7f8f8b7d887fc79c7d78210f0b30222fba7d409f9b0af060
Opcode Fuzzy Hash: a3165a322e9cf454d067e2e9fb51a1568b5d9541ec2360a5f41516ca8b9f2719
Instruction Fuzzy Hash: F0417EB190424AEBDF20FF94898199EB7E9EB41384F22496FE955AF140D731DEC0DB81

Uniqueness

Uniqueness Score: -1.00%

Function 100FF119 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 100FF1DD
__fileno.LIBCMT ref: 100FF1FD
__locking.LIBCMT ref: 100FF204
__flsbuf.LIBCMT ref: 100FF22F

Part of subcall function 100FEFF3: __getptd_noexit.LIBCMT ref: 100FEFF3

Part of subcall function 100FDAB2: __decode_pointer.LIBCMT ref: 100FDABD

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: a0cf87f7565d385f845cdfd8ff2e652b3a399b067c6affa953e106e56e1ac583
Instruction ID: b0218bb704cf5e92440cac7d8f861240f649ed8db193d56a97feaa9bb76660cf
Opcode Fuzzy Hash: a0cf87f7565d385f845cdfd8ff2e652b3a399b067c6affa953e106e56e1ac583
Instruction Fuzzy Hash: 26419235A0060DDBDB55DFA5C8849AEB7F5FF803A0F25862DE86597240D770EE41ABC0

Uniqueness

Uniqueness Score: -1.00%

Function 1003BD29 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 1003BD45

Part of subcall function 1003A675: _wcslen.LIBCMT ref: 1003A67F
Part of subcall function 1003A675: __waccess_s.LIBCMT ref: 1003A68C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _wcslen$__waccess_s
String ID:
API String ID: 1291433773-0
Opcode ID: 95e64e38ac6d15cce35c04ea6f6bf783c93314aac21d4e49c4173b8e368adba7
Instruction ID: c30b653319062482d2b96f1da521ef1de9ca7445720eed379d57abde29ef8377
Opcode Fuzzy Hash: 95e64e38ac6d15cce35c04ea6f6bf783c93314aac21d4e49c4173b8e368adba7
Instruction Fuzzy Hash: AA31F87A900E557FE713DA599C82DDF36AEDF807AAF210016FF059F201EA30DE415690

Uniqueness

Uniqueness Score: -1.00%

Function 1010FDA1 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1010FDD5
__isleadbyte_l.LIBCMT ref: 1010FE09
MultiByteToWideChar.KERNEL32(FF50FFFF,00000009,00000002,FC16E800,00000000,00000000,?,?,?,100FAE17,00000002,00000000), ref: 1010FE3A
MultiByteToWideChar.KERNEL32(FF50FFFF,00000009,00000002,00000001,00000000,00000000,?,?,?,100FAE17,00000002,00000000), ref: 1010FEA8

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8fe2b2742ce9837069a601e573b0bb6f8243e5db27c09c571476430fa46c65cc
Instruction ID: 0722962224e5d4e9d36b49b91dbaa83330eb899853e1f7cf83000096e3ba99db
Opcode Fuzzy Hash: 8fe2b2742ce9837069a601e573b0bb6f8243e5db27c09c571476430fa46c65cc
Instruction Fuzzy Hash: 1931D63190029AEFDB10DFA4C986AAE3BB5FF01350F12856EE4948B5AAD734DD40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000791E Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 10014B78: RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000400), ref: 10014B94
Part of subcall function 10014B78: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?), ref: 10014BB7
Part of subcall function 10014B78: RegCloseKey.ADVAPI32(?), ref: 10014BC2

SetLastError.KERNEL32(00000000), ref: 100079EB

Strings

AIL:SetSharedCount(%s, %d)=%d->%d, xrefs: 10007A01
Software\Microsoft\Windows\CurrentVersion\SharedDlls, xrefs: 10007952, 10007957, 10007996, 100079B3
AIL:SetSharedCount(%s, %d) err=%d, xrefs: 100079CE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CloseErrorLastOpenQueryValue
String ID: AIL:SetSharedCount(%s, %d) err=%d$AIL:SetSharedCount(%s, %d)=%d->%d$Software\Microsoft\Windows\CurrentVersion\SharedDlls
API String ID: 75635995-970988422
Opcode ID: d541dee9dea073034e6f584586b364d75c7b2278a28e8ced8d5f20204cc32613
Instruction ID: c6433b22a3bf91d591245852cc83a98746f8be63a9a207d7cb218defbc7bb77c
Opcode Fuzzy Hash: d541dee9dea073034e6f584586b364d75c7b2278a28e8ced8d5f20204cc32613
Instruction Fuzzy Hash: 07210AB6E01228BBE711DAA54CC5FDF77ACFF053A0F510265F91CA6181DA789E8087A1

Uniqueness

Uniqueness Score: -1.00%

Function 100055BE Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F,00000000), ref: 100055EE

Strings

AIL:SetUserInfoEx(%d, %d, %d)=%llu, xrefs: 10005644
%CommonAppData%\AhnLab, xrefs: 100055F9
AIL:SetUserInfoEx() not found, xrefs: 100055DE

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast
String ID: %CommonAppData%\AhnLab$AIL:SetUserInfoEx(%d, %d, %d)=%llu$AIL:SetUserInfoEx() not found
API String ID: 1452528299-456679135
Opcode ID: e729a5ee09d2bef724abab94d1395070859a36e9b2717f6aaa1132f263732066
Instruction ID: b176e435291acdef62e8e6d84ca52dec157cd2e9a0e9179a91f6cdc9a9f79b7c
Opcode Fuzzy Hash: e729a5ee09d2bef724abab94d1395070859a36e9b2717f6aaa1132f263732066
Instruction Fuzzy Hash: 8D112375600218BBE710DF64CC09FAB37ECEB48791F510460F824DB181EA79AA418760

Uniqueness

Uniqueness Score: -1.00%

Function 1010733D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10107363

Part of subcall function 10107188: __fltout2.LIBCMT ref: 101071B4

__cftog_l.LIBCMT ref: 10107389
__cftoe_l.LIBCMT ref: 101073BB

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: cf29bba74f6592771dd0336cbea99a5c70194d8750ed63a8cf3c873458a00e1b
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: C6114B3680018EFBDF125E84CD02DEE3F22FF18294B558815FE9859134C63AD9B1BB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001615B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 10016165
SHGetSpecialFolderLocation.SHELL32(00000000,101728B8,101728B8,101728B8,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?), ref: 10016181
SHGetSpecialFolderLocation.SHELL32(00000000,?,?,?,CommonFilesx86Dir,?,?,CommonFiles64Dir,?,?,?,?,ProgramFilesDir,?,?,ProgramFilesx86Dir), ref: 10016196
SHGetPathFromIDListW.SHELL32(?,?), ref: 100161A5

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FolderLocationSpecial$FromListMallocPath
String ID:
API String ID: 2730999478-0
Opcode ID: 8c25be7f88dda7a4957f3eff9d406e84fb6c30a4ad4ac7526c451c3982f34478
Instruction ID: d759f8fa05029d4eaa0f0866be91b886f04480f798b6475b519e3689cb93cb90
Opcode Fuzzy Hash: 8c25be7f88dda7a4957f3eff9d406e84fb6c30a4ad4ac7526c451c3982f34478
Instruction Fuzzy Hash: 7A015E7A610109BFCF04CBA4CD44E9E7BBEEB88250F1540A5F905DB210D631DE419BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000D1AB Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_GetOS2.AHNIEX(?,?,?,00000000), ref: 1000D1C4
AhnIEx_snprintf.AHNIEX(?,?,10117588,00000000,?,?,?,00000000), ref: 1000D1DD
AhnIEx_snprintf.AHNIEX(?,?,10117588,?,?,?,10117588,00000000,?,?,?,00000000), ref: 1000D1F0
AhnIEx_snprintf.AHNIEX(?,?,10117588,?,?,?,10117588,?,?,?,10117588,00000000,?,?,?,00000000), ref: 1000D201

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Ex_snprintf$FreeGlobal
String ID:
API String ID: 1041112508-0
Opcode ID: af69fc651061e80262ab04ac93d9ac60507b722caf9f4dc8abd062fa9b18a0ac
Instruction ID: 84d0653c431a5433a32e7c55765d6b0de753a5207128258f212e49cbdfc6a73e
Opcode Fuzzy Hash: af69fc651061e80262ab04ac93d9ac60507b722caf9f4dc8abd062fa9b18a0ac
Instruction Fuzzy Hash: 72F037BB9002687BDB15DE928C0ADCFBFBCEB9A650B040055B904AB251E230EB5086A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E355 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,true), ref: 1000E370

Part of subcall function 1001330D: GetShortPathNameW.KERNEL32(00000104,?,00000104), ref: 10013333

Strings

false, xrefs: 1000E392
TRUE, xrefs: 1000E37C
true, xrefs: 1000E365, 1000E36A, 1000E38F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalNamePathShortlstrcmpi
String ID: TRUE$false$true
API String ID: 252038734-3801493375
Opcode ID: c41b067cb38fc48f7254490a77dc3df1049580f933552913332f5d8bf7bdf415
Instruction ID: 26cbe88caae2a06a428118dc904fcf3bf8949f213c588995f1387a4d524b197d
Opcode Fuzzy Hash: c41b067cb38fc48f7254490a77dc3df1049580f933552913332f5d8bf7bdf415
Instruction Fuzzy Hash: 75E0E5372402153ADB189A74AC0BCEB7FCCDB0E361F00C021F818FE191DA70D99041A2

Uniqueness

Uniqueness Score: -1.00%

Function 1000E765 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(101730F8,true), ref: 1000E780

Part of subcall function 10013B41: InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,true), ref: 10013B6B
Part of subcall function 10013B41: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,true), ref: 10013B7E
Part of subcall function 10013B41: _memset.LIBCMT ref: 10013BBA
Part of subcall function 10013B41: _memset.LIBCMT ref: 10013BD8
Part of subcall function 10013B41: AhnIEx_IsWinNT.AHNIEX(?,?,?,?,?,?,?,?,?,?,true), ref: 10013C05
Part of subcall function 10013B41: CreateMutexW.KERNEL32(0000000C,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C28
Part of subcall function 10013B41: CreateMutexW.KERNEL32(0000000C,00000000,?,?,?,?,?,?,?,?,?,?,?,true), ref: 10013C3A
Part of subcall function 10013B41: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,true), ref: 10013C3C

Strings

false, xrefs: 1000E7A2
TRUE, xrefs: 1000E78C
true, xrefs: 1000E775, 1000E77A, 1000E79F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CreateDescriptorMutexSecurity_memset$DaclErrorFreeGlobalInitializeLastlstrcmpi
String ID: TRUE$false$true
API String ID: 1345330975-3801493375
Opcode ID: 70dee1a979e72b340bcb55aec23027a60695c1923781f24fcdc9498e503e71c2
Instruction ID: eba19d764f7f2750ebdc2a5d9b5b7147b6d53d8f9479b5e3432787d3bb8ef7b9
Opcode Fuzzy Hash: 70dee1a979e72b340bcb55aec23027a60695c1923781f24fcdc9498e503e71c2
Instruction Fuzzy Hash: 19E0E5377442153ADB189A74AC47CEB778CDB4E361F00C031F908FE191D630D8804162

Uniqueness

Uniqueness Score: -1.00%

Function 1000D8FF Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 33stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

lstrcmpiW.KERNEL32(TRUE,true), ref: 1000D91A

Part of subcall function 1001472D: AhnIEx_IsWow64Process.AHNIEX(?,1000361E,00000000,101728B8,1001808C,00000000,00000008,1000A98C,?,00000400,00000001,WinSysWow64Dir,00000000,WinSysDir), ref: 1001473B

Strings

false, xrefs: 1000D936
TRUE, xrefs: 1000D915
true, xrefs: 1000D90F, 1000D914, 1000D933

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalProcessWow64lstrcmpi
String ID: TRUE$false$true
API String ID: 3538151831-3801493375
Opcode ID: ed79dc45efa4ba134eedc11f27679348ab87d94981f8cd3703a9ce841ee3880a
Instruction ID: 1bfeb20344e22515568b1188968c2cc6ea9ef43ef7bd5b74b0fe7ceec7e5e96e
Opcode Fuzzy Hash: ed79dc45efa4ba134eedc11f27679348ab87d94981f8cd3703a9ce841ee3880a
Instruction Fuzzy Hash: F6E022376442183BDB24EAB4AC06CDB77CCDF1E2A2F008022F808EA290DA71D98041A2

Uniqueness

Uniqueness Score: -1.00%

Function 10107E2D Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10107E39

Part of subcall function 1010506B: __getptd_noexit.LIBCMT ref: 1010506E
Part of subcall function 1010506B: __amsg_exit.LIBCMT ref: 1010507B

__getptd.LIBCMT ref: 10107E50
__amsg_exit.LIBCMT ref: 10107E5E
__lock.LIBCMT ref: 10107E6E

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c731a2702504c35d969e08f3a9755c63ca11cdebd87bb03a45a35c6fc94fba95
Instruction ID: 06107dcab6a89083e509c09d05fc0aa7f03ad50a7592cb75bc6c0399ece7d615
Opcode Fuzzy Hash: c731a2702504c35d969e08f3a9755c63ca11cdebd87bb03a45a35c6fc94fba95
Instruction Fuzzy Hash: 92F06D3AD127108AD710AB64C84274E73A0FB14754F118699E4C197298DB3C7D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 100CF470 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100CF4E4
_memset.LIBCMT ref: 100CF824

Strings

..\..\Src\openssl-1.1.1n\crypto\sm2\sm2_crypt.c, xrefs: 100CF50E, 100CF526, 100CF556, 100CF5A7, 100CF5B8, 100CF5CE, 100CF5E2, 100CF7BB, 100CF7D9, 100CF7E7, 100CF7F5, 100CF803, 100CF831, 100CF845, 100CF859

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID: ..\..\Src\openssl-1.1.1n\crypto\sm2\sm2_crypt.c
API String ID: 2102423945-2983719936
Opcode ID: 993365f92687c7eb9d4018b4d661811a6c99fd5f0ce8ef543be0f23f111cc8a3
Instruction ID: 66050ab3a128b250b7e4f8c52af87fbe77e76c128138842f2e833313d09f54c8
Opcode Fuzzy Hash: 993365f92687c7eb9d4018b4d661811a6c99fd5f0ce8ef543be0f23f111cc8a3
Instruction Fuzzy Hash: FEB1B1B5608340ABE200DB60DD81F6FB7E9EF85744F11496CFA449B282EB75E904C767

Uniqueness

Uniqueness Score: -1.00%

Function 1005FD60 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 305COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1005FE13

Part of subcall function 1005EFD0: _memset.LIBCMT ref: 1005EFF6

Strings

NO X509_NAME, xrefs: 1005FE0D
..\..\Src\openssl-1.1.1n\crypto\x509\x509_obj.c, xrefs: 1005FDF6, 1005FE54, 1006009A, 100600BF, 100600D0

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset_strncpy
String ID: ..\..\Src\openssl-1.1.1n\crypto\x509\x509_obj.c$NO X509_NAME
API String ID: 3140232205-3647245351
Opcode ID: fdc9aa142fb43f07df88759c1f02703795a04ceba4154b4b1baf6ade14fd853b
Instruction ID: 27b261d7ac6a0baa42115541dce5fba629b2dacfd0d3b37a35223001646d2304
Opcode Fuzzy Hash: fdc9aa142fb43f07df88759c1f02703795a04ceba4154b4b1baf6ade14fd853b
Instruction Fuzzy Hash: 54B1B071A083419FD710CF28C841B2BB7E1EF89344F15492DF8C99B242EB79E9498B92

Uniqueness

Uniqueness Score: -1.00%

Function 100E76A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

..\..\Src\openssl-1.1.1n\crypto\ec\ecp_oct.c, xrefs: 100E76CE, 100E7722, 100E7799, 100E7929

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID:
String ID: ..\..\Src\openssl-1.1.1n\crypto\ec\ecp_oct.c
API String ID: 0-4062898738
Opcode ID: 4d2e61212e9871f377a088f0597bad8dbf18d746380c01f09d3c8571e35e14f0
Instruction ID: ab9cf487f57c33855a359852b885b3dc2af88be852c1c12abed553675ae1380b
Opcode Fuzzy Hash: 4d2e61212e9871f377a088f0597bad8dbf18d746380c01f09d3c8571e35e14f0
Instruction Fuzzy Hash: B17134B6E443016FD610DA64EC42B5F73D4EF94654F080A39FD8CB7242E626EA19C6E3

Uniqueness

Uniqueness Score: -1.00%

Function 10043E60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10043F8B
_memset.LIBCMT ref: 10043F05

Part of subcall function 1004F8E0: _memset.LIBCMT ref: 1004F93B

Strings

..\..\Src\openssl-1.1.1n\crypto\asn1\tasn_new.c, xrefs: 10043F14, 10043F9A, 10043FD0, 10044045, 10044074

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID: ..\..\Src\openssl-1.1.1n\crypto\asn1\tasn_new.c
API String ID: 2102423945-2477436553
Opcode ID: 9b5cccf48b67184bdeced9e19fe19179993eea806fe2161b2ae1bce5e46ad0d0
Instruction ID: d0b15ee2664d41f7c04887370abf88b4370a3cff467be06370ef2b4744592749
Opcode Fuzzy Hash: 9b5cccf48b67184bdeced9e19fe19179993eea806fe2161b2ae1bce5e46ad0d0
Instruction Fuzzy Hash: 275138756003057BD230DAA5ACC2E3F77A8DF81694F31443DF905C6682EB25F85892BA

Uniqueness

Uniqueness Score: -1.00%

Function 100F2470 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100F24CA

Strings

%02x%s, xrefs: 100F2597

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _memset
String ID: %02x%s
API String ID: 2102423945-1723692035
Opcode ID: 7a85524d3c1a380dd098880764a91648b53c7716e365a63e3d664e2d821ab0fc
Instruction ID: 0e2c4bc40c60f7e42078e3b317aae44d9fdbe993a4e9f2cf12e076a5b97d489d
Opcode Fuzzy Hash: 7a85524d3c1a380dd098880764a91648b53c7716e365a63e3d664e2d821ab0fc
Instruction Fuzzy Hash: F231E9356047099BE724DB64CC52BBB73E9EBD4640F41842DFC89CA142FE74B90897A2

Uniqueness

Uniqueness Score: -1.00%

Function 100EBB80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 100EBB9C

Part of subcall function 1010264A: strtoxl.LIBCMT ref: 1010266C

Strings

Char=, xrefs: 100EBC71
..\..\Src\openssl-1.1.1n\crypto\asn1\asn1_gen.c, xrefs: 100EBBC1, 100EBC4D

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __wcstoui64strtoxl
String ID: ..\..\Src\openssl-1.1.1n\crypto\asn1\asn1_gen.c$Char=
API String ID: 2058942787-526901025
Opcode ID: 0f2234b1cef4129416090d518e5df311fd48c4c9a1a1020554ded434a58eb086
Instruction ID: aa4b3e377770a82b741eef742819121152b4e05d9e0eaa00a38a3c2358af2b27
Opcode Fuzzy Hash: 0f2234b1cef4129416090d518e5df311fd48c4c9a1a1020554ded434a58eb086
Instruction Fuzzy Hash: 142138316047105BF711EA1DECA2BDB77C0DF81715F94006AF984AA2C1FBE9990987A3

Uniqueness

Uniqueness Score: -1.00%

Function 100F1C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100F1C69

Strings

%lu:%s:%s:%d:%s, xrefs: 100F1CC8
processing, xrefs: 100F1C58

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: CurrentThread
String ID: %lu:%s:%s:%d:%s$processing
API String ID: 2882836952-2734553931
Opcode ID: a66f543eada95a068f42390055a041bb5e70d88055d749d8c4cc1686099a8dbb
Instruction ID: 895e0873ba5e754ac15bd73dd08eb43161c52271a24438431de5ea8fc2b5b667
Opcode Fuzzy Hash: a66f543eada95a068f42390055a041bb5e70d88055d749d8c4cc1686099a8dbb
Instruction Fuzzy Hash: 40217E76508345ABC315CB54CC42EEBB7ECEFD8384F00492DFA8583142FA74EA0887A2

Uniqueness

Uniqueness Score: -1.00%

Function 100631CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1006321C
_strncmp.LIBCMT ref: 10063275

Strings

-----END , xrefs: 10063216
..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c, xrefs: 10063354, 10063378

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: _strncmp
String ID: -----END $..\..\Src\openssl-1.1.1n\crypto\pem\pem_lib.c
API String ID: 909875538-4223702497
Opcode ID: e7dedce7c281d8f2664b04a44788560c7ddaf6e6ef76482f2c1baf87785a40d8
Instruction ID: 56c6234fd718cc18324af626ea2ae18678e747b327e4417f43ac06b0579a8565
Opcode Fuzzy Hash: e7dedce7c281d8f2664b04a44788560c7ddaf6e6ef76482f2c1baf87785a40d8
Instruction Fuzzy Hash: 162125B1E443435BE720CA108C0271A73D6DF517A8F054529FD941E2C2E7B9DA4886E3

Uniqueness

Uniqueness Score: -1.00%

Function 1001930C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

AhnIEx_SetError.AHNIEX(?,00000400), ref: 10019326

Part of subcall function 10018A83: FindResourceExW.KERNEL32(32810112,00000006,?,B2A1A428,?,00000400,?), ref: 10018AB5
Part of subcall function 10018A83: LoadResource.KERNEL32(32810112,00000000), ref: 10018AC1
Part of subcall function 10018A83: FreeResource.KERNEL32(00000000), ref: 10018AF0

Part of subcall function 1001CE88: _vswprintf_s.LIBCMT ref: 1001CEBA

Strings

(%d), xrefs: 1001939D
(0x%x), xrefs: 10019396

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Resource$ErrorFindFreeLoad_vswprintf_s
String ID: (%d)$ (0x%x)
API String ID: 2604501751-1856249361
Opcode ID: 83964eb3b7a0b9fb08bf1eab22925f7f9683f9bfa9936e47df866b392a2a8e6b
Instruction ID: e5f202c90f6f256ce63ba39c0b15b61b3f65b84362f19161d1c97914d201051d
Opcode Fuzzy Hash: 83964eb3b7a0b9fb08bf1eab22925f7f9683f9bfa9936e47df866b392a2a8e6b
Instruction Fuzzy Hash: 0711CE76A0011EABDF14CB60CD42FDE37A9EF04254F8081A5FD18AB091DE34EF948BA4

Uniqueness

Uniqueness Score: -1.00%

Function 1000F71C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_snprintf.AHNIEX(?,?,10117588,00000000,?,?,10117AB8), ref: 1000F774
AhnIEx_snprintf.AHNIEX(?,?,10117588,00000012), ref: 1000F78D

Strings

TRUE, xrefs: 1000F742

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Ex_snprintf$FreeGlobal
String ID: TRUE
API String ID: 1041112508-3412697401
Opcode ID: 3f1c2f4d84bdbdb81d39fe5061c7af9e836644df77984001d1c9ce07e8144bec
Instruction ID: 0e74421f87334207d8f8e84e26e11e5a02296af16a43536cc1c08e10310c0048
Opcode Fuzzy Hash: 3f1c2f4d84bdbdb81d39fe5061c7af9e836644df77984001d1c9ce07e8144bec
Instruction Fuzzy Hash: F101FD72E402287BE714EA518C82EDF7AACDB0A290F004065FD047B282E372AF0052F2

Uniqueness

Uniqueness Score: -1.00%

Function 1000F5E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

Part of subcall function 100109F1: lstrcmpiW.KERNEL32(?,?,?,00000000,?), ref: 10010A92

Part of subcall function 100045AB: __EH_prolog3.LIBCMT ref: 100045CA
Part of subcall function 100045AB: RegisterWindowMessageW.USER32(_WM_AIL_Detail_Print,AIL::CreateChildSetup,0000003C), ref: 10004615
Part of subcall function 100045AB: GetLastError.KERNEL32 ref: 10004620

AhnIEx_snprintf.AHNIEX(?,?,101196DC,00000000,?,TRUE,101730F8,00000000,00000000,00000000), ref: 1000F647
AhnIEx_snprintf.AHNIEX(?,?,10117588,00000000,?,?,101196DC,00000000,?,TRUE,101730F8,00000000,00000000,00000000), ref: 1000F65A

Strings

TRUE, xrefs: 1000F623

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Ex_snprintf$ErrorFreeGlobalH_prolog3LastMessageRegisterWindowlstrcmpi
String ID: TRUE
API String ID: 2503917278-3412697401
Opcode ID: 7217af8071ea089064f773b5c4d440eb2e01aa4371206c0b23a79ede0cf96303
Instruction ID: c4ab8d911efec826fa54506dc898f2c172d986cc3c9d63642a5da5ffa08a10d1
Opcode Fuzzy Hash: 7217af8071ea089064f773b5c4d440eb2e01aa4371206c0b23a79ede0cf96303
Instruction Fuzzy Hash: 55F0F4B7A001187BEB08DA51DC03DDF3BACDB45261F104025FE10BA152EB75FE8082A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000520D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32(?,00000000,?,00000000), ref: 10005234

Strings

IniFile, xrefs: 10005215
SecFile, xrefs: 10005240

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: PrivateProfile
String ID: IniFile$SecFile
API String ID: 1469295129-1758573970
Opcode ID: 408fbd22f5764bb0e3e66de70add6cd32d68553f01d8a66eae9a4b24b193351a
Instruction ID: b8a5b4a51e1d0e7af23b85150a2e5ae1fa63a9031302900c6218b4d9a77215a9
Opcode Fuzzy Hash: 408fbd22f5764bb0e3e66de70add6cd32d68553f01d8a66eae9a4b24b193351a
Instruction Fuzzy Hash: F2F0B4369001157BFB12AA65DC048AB7BBDEF432F1B094061FD189B164D7379CC0C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 10104571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 100FB42F: __getptd.LIBCMT ref: 100FB435
Part of subcall function 100FB42F: __getptd.LIBCMT ref: 100FB445

__getptd.LIBCMT ref: 10104580

Part of subcall function 1010506B: __getptd_noexit.LIBCMT ref: 1010506E
Part of subcall function 1010506B: __amsg_exit.LIBCMT ref: 1010507B

__getptd.LIBCMT ref: 1010458E

Strings

csm, xrefs: 1010459C

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e2952549570f8cd79ed594e30ef69eb55010559dd397d91e61585375e1f2871f
Instruction ID: e319c8b6b62f801e3f957f74dcd8fc1566906bd9cd9aae2c8ab43431068e820f
Opcode Fuzzy Hash: e2952549570f8cd79ed594e30ef69eb55010559dd397d91e61585375e1f2871f
Instruction Fuzzy Hash: 3A014FB88406059FCB38DF21CA8065DB7B5EF14391FA4851EE08296195CF39AD81DB51

Uniqueness

Uniqueness Score: -1.00%

Function 100161CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100161D5

Part of subcall function 1000A1C0: GetLastError.KERNEL32(?,?,?,?,80004005,?,?), ref: 1000A234
Part of subcall function 1000A1C0: SetLastError.KERNEL32(00000000,?,?,?,80004005,?,?), ref: 1000A247

Part of subcall function 1000A260: GetProcAddress.KERNEL32(?,101728B8), ref: 1000A267

Strings

SHFolder.dll, xrefs: 100161EB
SHGetFolderPathW, xrefs: 100161FC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorLast$AddressH_prolog3Proc
String ID: SHFolder.dll$SHGetFolderPathW
API String ID: 840592111-4056499019
Opcode ID: 5adad9d1d9fabc8542fd6b05e5215686da5452858405c935d3b1e58ae213cf5e
Instruction ID: 913bb4bfeb40212a9a267469b9165df6580f7e8894b8db899f54565bba22afb5
Opcode Fuzzy Hash: 5adad9d1d9fabc8542fd6b05e5215686da5452858405c935d3b1e58ae213cf5e
Instruction Fuzzy Hash: D5F0F638640209A7EB04C7A0CD13BEC7721EF48390F610228FA116B0C1EF74ED819A50

Uniqueness

Uniqueness Score: -1.00%

Function 1011531F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10115326

Part of subcall function 10011D94: std::runtime_error::runtime_error.LIBCPMT ref: 10011D9B

__CxxThrowException@8.LIBCMT ref: 10115351

Part of subcall function 100FDAE8: RaiseException.KERNEL32(?,?,100FBD6D,101728B8,?,?,?,?,100FBD6D,101728B8,1016AAA4,1017A7F4,101728B8,1000A8CB), ref: 100FDB2A

Part of subcall function 100FB7DB: __lock.LIBCMT ref: 100FB7F9
Part of subcall function 100FB7DB: ___sbh_find_block.LIBCMT ref: 100FB804
Part of subcall function 100FB7DB: ___sbh_free_block.LIBCMT ref: 100FB813
Part of subcall function 100FB7DB: HeapFree.KERNEL32(00000000,?,1016B308,0000000C,10105A72,00000000,1016B8C0,0000000C,10105AAC,?,100FAE08,?,1010B1F2,00000004,1016BA20,0000000C), ref: 100FB843
Part of subcall function 100FB7DB: GetLastError.KERNEL32(?,1010B1F2,00000004,1016BA20,0000000C,1010569C,?,100FAE17,00000000,00000000,00000000,?,1010501D,00000001,00000214), ref: 100FB854

Strings

invalid string position, xrefs: 1011532B

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: ErrorExceptionException@8FreeH_prolog3HeapLastRaiseThrow___sbh_find_block___sbh_free_block__lockstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 341023312-1799206989
Opcode ID: 3b11b75b66ae860e9e729d85312bcf8c5ddbf5e6a84a45d0495727295747629a
Instruction ID: d692ba678c0962cc6babe3d8d44da89e1bd042798ba74613e111b64b8db763ce
Opcode Fuzzy Hash: 3b11b75b66ae860e9e729d85312bcf8c5ddbf5e6a84a45d0495727295747629a
Instruction Fuzzy Hash: 1FF0827681021897DB14DBA1DC45BDE73A8EF04321F144419F051A7081DBFCE984CB24

Uniqueness

Uniqueness Score: -1.00%

Function 10111FB1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,10112001,?,00000000,00000007,00000007,?,10112146,00000000,?,?,1016BBA8,0000000C,1010ED14,?), ref: 10111FD7

Strings

:, xrefs: 10111FCB
\, xrefs: 10111FCF

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: c427d03500aff44e335a89ef33fdc9d557a344826f3742c52b56bc48fb8ed08a
Instruction ID: f9fd66c4f0ebfad70527e24dd105b002192e8a030624b97a22742b3948891307
Opcode Fuzzy Hash: c427d03500aff44e335a89ef33fdc9d557a344826f3742c52b56bc48fb8ed08a
Instruction Fuzzy Hash: 21E048313082CE5DEB41CAB59544B8A7FDCDB416D8F05C065F85CCE141D335DA578366

Uniqueness

Uniqueness Score: -1.00%

Function 1000D20D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWinNT.AHNIEX ref: 1000D21C

Part of subcall function 10018600: AhnIEx_GetOS.AHNIEX(1000A7FA,InstallInfo:Init,00000018), ref: 10018609

Strings

false, xrefs: 1000D22F
true, xrefs: 1000D228

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobal
String ID: false$true
API String ID: 2979337801-2658103896
Opcode ID: 3d8af5dca0134a36f1c0a4aa2269ad05b75709f8b99a4829415c52b87ad25fb1
Instruction ID: 516f7ad9126363a94b1ac7e5801c9405051cabed685979c32afadba03b31c630
Opcode Fuzzy Hash: 3d8af5dca0134a36f1c0a4aa2269ad05b75709f8b99a4829415c52b87ad25fb1
Instruction Fuzzy Hash: 0DE012766442087BEA14EE61AD03F9B73DCDB2D250F108022F904AE295E676F6904566

Uniqueness

Uniqueness Score: -1.00%

Function 1000D4B1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWorkstation.AHNIEX ref: 1000D4C0

Strings

false, xrefs: 1000D4D3
true, xrefs: 1000D4CC

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: FreeGlobalWorkstation
String ID: false$true
API String ID: 1451512138-2658103896
Opcode ID: 477cd7d0f8a5ae3f42f2cae73cc6434da9fd4f5a07a444e2d23082be2879a8d4
Instruction ID: 5b93352b25b44569f2f4ec8cf9b3cfbeffa2434d80eb29b0c1b9ccd63b058769
Opcode Fuzzy Hash: 477cd7d0f8a5ae3f42f2cae73cc6434da9fd4f5a07a444e2d23082be2879a8d4
Instruction Fuzzy Hash: 30E0C2362443086BEA14EE60AC03E4B33CDEB18250F00C022F908AE291E672F5904162

Uniqueness

Uniqueness Score: -1.00%

Function 1000D534 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsWow64Process.AHNIEX ref: 1000D543

Part of subcall function 10017CC7: GetModuleHandleW.KERNEL32(Kernel32.DLL,?,?), ref: 10017CE5
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017D0A
Part of subcall function 10017CC7: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 10017D14
Part of subcall function 10017CC7: GetCurrentProcess.KERNEL32(00000018,?), ref: 10017D24

Strings

false, xrefs: 1000D556
true, xrefs: 1000D54F

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressProcProcess$CurrentFreeGlobalHandleModuleWow64
String ID: false$true
API String ID: 1294942151-2658103896
Opcode ID: 8a187434b90f00b0fbce7c6e8ceb22506138d6eeb2d1d5f4c83346b86412e69e
Instruction ID: 578a46df08d61785164e95f2e9c20f69ce6ca763601e467d08aa4dbc17a65dd9
Opcode Fuzzy Hash: 8a187434b90f00b0fbce7c6e8ceb22506138d6eeb2d1d5f4c83346b86412e69e
Instruction Fuzzy Hash: 8BE0C2326006082BEB14EE74AC13F4B33CCEB09251F008022FE08AE295E676F6904162

Uniqueness

Uniqueness Score: -1.00%

Function 1000D56D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsProcessorIA64.AHNIEX ref: 1000D57C

Part of subcall function 10017D77: GetModuleHandleW.KERNEL32(Kernel32.DLL), ref: 10017D82
Part of subcall function 10017D77: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 10017D92

Strings

false, xrefs: 1000D58F
true, xrefs: 1000D588

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressFreeGlobalHandleModuleProcProcessor
String ID: false$true
API String ID: 1824391111-2658103896
Opcode ID: e432bab0605e61708a7ced872848944c8d457eb26dc8520300482dc9322a3f26
Instruction ID: 70bdf1ba379c5e14438e148c403221546a7f1cd53222542a1d87ee1096e8e4c9
Opcode Fuzzy Hash: e432bab0605e61708a7ced872848944c8d457eb26dc8520300482dc9322a3f26
Instruction Fuzzy Hash: 0CE0C2323003086BEB18EA60AC03F5B73DCEF0C265F008022FD08AE295EA76F6900162

Uniqueness

Uniqueness Score: -1.00%

Function 1000D5A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsProcessorAMD64.AHNIEX ref: 1000D5B5

Part of subcall function 10017DB2: GetModuleHandleW.KERNEL32(Kernel32.DLL), ref: 10017DBD
Part of subcall function 10017DB2: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 10017DCD

Strings

false, xrefs: 1000D5C8
true, xrefs: 1000D5C1

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressFreeGlobalHandleModuleProcProcessor
String ID: false$true
API String ID: 1824391111-2658103896
Opcode ID: 846755b310a622cf0d505e5bc791f0cfcc31656b2b09d8a93e0d99e615e1198f
Instruction ID: c5948d54b1153662d0518acd970a3fd29c850955d232b950c8561636c01a5211
Opcode Fuzzy Hash: 846755b310a622cf0d505e5bc791f0cfcc31656b2b09d8a93e0d99e615e1198f
Instruction Fuzzy Hash: 33E0C2332443082BEB14EA60AC03F8B37DCEB19252F008022FD08EE2D1E672F6D00122

Uniqueness

Uniqueness Score: -1.00%

Function 1000D5DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsProcessorARM64.AHNIEX ref: 1000D5EE

Part of subcall function 10017DED: GetModuleHandleW.KERNEL32(Kernel32.DLL,?,00000000,00000000,?,1000D5F3), ref: 10017DF8
Part of subcall function 10017DED: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 10017E08
Part of subcall function 10017DED: GetCurrentProcess.KERNEL32(?,?,?,00000000,00000000,?,1000D5F3), ref: 10017E1C

Strings

false, xrefs: 1000D601
true, xrefs: 1000D5FA

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: AddressCurrentFreeGlobalHandleModuleProcProcessProcessor
String ID: false$true
API String ID: 2062928741-2658103896
Opcode ID: e26312334f88abeebe68084f3ae0f6134dd6a5513a91c9e40f8969ec8541c375
Instruction ID: eed7f4b58f6dadb01a48c347d01918b57fad772f07e3c845bbb39491a7ffd6b3
Opcode Fuzzy Hash: e26312334f88abeebe68084f3ae0f6134dd6a5513a91c9e40f8969ec8541c375
Instruction Fuzzy Hash: FAE0C2326043082BEB14EEA0EC03E4B37DCEB09250F008022F908EE291EA77F5A00166

Uniqueness

Uniqueness Score: -1.00%

Function 1000D7B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 10010986: GlobalFree.KERNEL32 ref: 100109BC

AhnIEx_IsSupportSHA256.AHNIEX ref: 1000D7C8

Strings

false, xrefs: 1000D7DB
true, xrefs: 1000D7D4

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: A256FreeGlobalSupport
String ID: false$true
API String ID: 1383886200-2658103896
Opcode ID: 350dc3b18e158384c9ede77af4a2d2075908982ea0438f6856bc82351056651b
Instruction ID: 370ed6c16afd4f5478ebfc5c99dceca2bc99207fb034d6016675823b8a52403b
Opcode Fuzzy Hash: 350dc3b18e158384c9ede77af4a2d2075908982ea0438f6856bc82351056651b
Instruction Fuzzy Hash: FDE0C2322042082BEA14EEA09C43F4B33DCEB0D290F048422F908EE691FA72F6900122

Uniqueness

Uniqueness Score: -1.00%

Function 1000C30D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,PendingFileRenameOperations,00000000,00000007,?,?,1000C7AC,00000001,00000000,0000002C,1000C944,?,?,1000C9F0,?,?), ref: 1000C31F

Strings

PendingFileRenameOperations, xrefs: 1000C317
AIL:MoveFileOnReboot:Set err=%d, xrefs: 1000C32A

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: Value
String ID: AIL:MoveFileOnReboot:Set err=%d$PendingFileRenameOperations
API String ID: 3702945584-2938056964
Opcode ID: f7503a28e89fff0add5a9df65eb77cbd41b43219479498f2df2a1816c27d38b1
Instruction ID: c0897d46289f65fe815ab04d82c3b853cb05b3d8891ceda6c016c73d49835166
Opcode Fuzzy Hash: f7503a28e89fff0add5a9df65eb77cbd41b43219479498f2df2a1816c27d38b1
Instruction Fuzzy Hash: FCD0A771760304B7EA151F308C06F623B68EB11645F248474B20CFC1D6E73BD423E654

Uniqueness

Uniqueness Score: -1.00%

Function 1000C340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(?,PendingFileRenameOperations,1000C798,00000001,00000000,0000002C,1000C944,?,?,1000C9F0,?,?,00000104), ref: 1000C348

Strings

PendingFileRenameOperations, xrefs: 1000C340
AIL:MoveFileOnReboot:Delete err=%d, xrefs: 1000C353

Memory Dump Source

Source File: 00000000.00000002.2479877218.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2479815862.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2485743047.0000000010117000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487160386.000000001015C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487658296.0000000010170000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487785925.000000001017A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2487880272.000000001017D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_astx_setup.jbxd

Similarity

API ID: DeleteValue
String ID: AIL:MoveFileOnReboot:Delete err=%d$PendingFileRenameOperations
API String ID: 1108222502-180118580
Opcode ID: 0b1cf4fa26daa300b1ad961e3dc8470d6cd3e529ed3411bc060e71f8da3daa5f
Instruction ID: 81b3733d52331df82688a96e5591332d21f6c070297ac0540a6bff24b7bd2ed0
Opcode Fuzzy Hash: 0b1cf4fa26daa300b1ad961e3dc8470d6cd3e529ed3411bc060e71f8da3daa5f
Instruction Fuzzy Hash: 57C08CB0B703086BEB086F304C4AFB222ACEB42586F044474B40DEC299FB39C9A5F014

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: V3Medic.exePID: 6624, Parent PID: 6348COMMON

Executed Functions

Function 0063FFD2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, Offset: 00638000, based on PE: false

Associated: 00000006.00000003.1545470671.0000000000620000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_620000_V3Medic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction ID: 52acefd55ffb3fbd5fc39273abb7d30feaade31298bf6635afb15a2d14cb038d
Opcode Fuzzy Hash: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction Fuzzy Hash: DE019271218A488FE794EB54D882BEAB3E2FBD4315F600A2EE48BC3141EF349505CB47

Uniqueness

Uniqueness Score: -1.00%

Function 0063FFD2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, Offset: 00627000, based on PE: false

Associated: 00000006.00000003.1545470671.0000000000620000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_620000_V3Medic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction ID: 52acefd55ffb3fbd5fc39273abb7d30feaade31298bf6635afb15a2d14cb038d
Opcode Fuzzy Hash: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction Fuzzy Hash: DE019271218A488FE794EB54D882BEAB3E2FBD4315F600A2EE48BC3141EF349505CB47

Uniqueness

Uniqueness Score: -1.00%

Function 0063FFD2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2162841684.000000000062D000.00000004.00000020.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Associated: 00000006.00000003.1545470671.0000000000620000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_620000_V3Medic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction ID: 52acefd55ffb3fbd5fc39273abb7d30feaade31298bf6635afb15a2d14cb038d
Opcode Fuzzy Hash: 5efe258a2e2199cd78adeee1f4f95f981c0e24f7634e12237a8f1a0781f10c36
Instruction Fuzzy Hash: DE019271218A488FE794EB54D882BEAB3E2FBD4315F600A2EE48BC3141EF349505CB47

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report astx_setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\AhnLab\Safe Transaction\AHAWKE.DLL

C:\Program Files\AhnLab\Safe Transaction\AHAWKENT.SYS

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark32.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark32lgplv2.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64a.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64algplv2.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\Ark64lgplv2.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\asdf.sld.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\asdsr.dat.ahc

C:\Program Files\AhnLab\Safe Transaction\AHC\ckwcfg.dat.ahc

Windows Analysis Report
astx_setup.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre